Add InfraScan audit workflow#4256
Draft
igor-soldev wants to merge 4 commits into
Draft
Conversation
|
SteRiccio
marked this pull request as draft
May 28, 2026 20:36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Added InfraScan GitHub Actions workflow for automated infrastructure scanning
Added a new CI workflow (
.github/workflows/infrascan.yml) that runs InfraScan on everypushandpull_requestto automatically detect outdated or vulnerable infrastructure dependencies (e.g. Docker images).Configured automated report generation and artifact upload
The workflow generates an HTML security report and uploads it as a GitHub Actions artifact, making scan results easily accessible for every run.
Improved security visibility for project dependencies
Enables continuous monitoring of infrastructure-level vulnerabilities, helping prevent outdated or insecure container usage from being introduced in future changes.
Closes issue Update PostgreSQL/PostGIS Docker image reference in README.md #4174
Introduces automated detection for outdated infrastructure references (including the PostGIS Docker image mentioned in the issue) and prevents similar issues from going unnoticed in future updates.
Types of changes
How has this been tested
The workflow was tested in GitHub Actions by triggering both
pushandpull_requestevents. All steps execute successfully onubuntu-latest, including:infrascan-report).Verified that
if: always()ensures report upload even when the scan step fails.Do you consider this PR needs further testing?
Recommended to validate scan coverage across different repository states and ensure compatibility with future InfraScan versions and scanner modes.
UI changes
No UI changes.
Disclaimer
This PR introduces a CI-based security scanning workflow using InfraScan. It does not modify application runtime behavior, only adds a GitHub Actions pipeline for infrastructure auditing.