huntridge-labs/argus
GitHub: huntridge-labs/argus
Argus 是一个基于 GitHub Actions 的统一安全扫描编排框架，将 SAST、容器、IaC、密钥检测和 DAST 等多种开源安全工具整合到单一可复用工作流中，实现自动化持续安全防护。
Stars: 9 | Forks: 1
   [](
   [](https://codecov.io/gh/huntridge-labs/argus) [](https://www.gnu.org/licenses/agpl-3.0) [](https://github.com/eFAILution/AICaC)
专为 GitHub Actions 打造的统一安全扫描 —— 在单一工作流中集成 SAST、容器、IaC、secrets 和 DAST 扫描。
GHES 快速入门
``` name: Security Scan (GHES) on: [pull_request, push] permissions: contents: read security-events: write pull-requests: write jobs: sast: runs-on: ubuntu-latest steps: - uses: actions/checkout@v6 # Use composite actions directly from github.com - uses: huntridge-labs/argus/.github/actions/scanner-gitleaks@0.6.7 with: enable_code_security: true fail_on_severity: high env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - uses: huntridge-labs/argus/.github/actions/scanner-bandit@0.6.7 with: enable_code_security: true fail_on_severity: high ```所有扫描器及 GitHub Security
``` name: Complete Security Scan on: push: branches: [main] pull_request: branches: [main] schedule: - cron: '0 2 * * 1' # Weekly Monday at 2 AM permissions: contents: read security-events: write pull-requests: write jobs: security: uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7 with: scanners: all enable_code_security: true post_pr_comment: true fail_on_severity: high secrets: inherit ```仅 SAST 扫描器
``` name: SAST Security Scan on: [pull_request] jobs: sast: uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7 with: scanners: codeql,bandit,opengrep,gitleaks codeql_languages: 'python,javascript' enable_code_security: true fail_on_severity: medium secrets: GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} ```容器扫描
``` name: Container Security on: push: tags: ['v*'] jobs: scan-image: uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7 with: scanners: trivy-container,grype,sbom image_ref: 'ghcr.io/myorg/myapp:${{ github.ref_name }}' enable_code_security: true fail_on_severity: critical ```配置驱动的多容器扫描
``` name: Multi-Container Scan on: push: paths: ['container-config.yml'] jobs: scan: uses: huntridge-labs/argus/.github/workflows/container-scan-from-config.yml@0.6.7 with: config_file: container-config.yml enable_code_security: true fail_on_severity: high secrets: inherit ``` **container-config.yml：** ``` containers: - name: frontend registry: host: ghcr.io username: ${GITHUB_TRIGGERING_ACTOR} auth_secret: GITHUB_TOKEN image: repository: myorg name: frontend tag: latest scanners: - trivy-container - grype - name: backend image: myorg/backend:latest scanners: - trivy-container - sbom ``` 完整文档请参见[容器扫描指南](docs/container-scanning.md)。基础设施即代码
``` name: Infrastructure Security on: pull_request: paths: - 'terraform/**' - 'infrastructure/**' jobs: iac: uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7 with: scanners: trivy-iac,checkov iac_path: 'terraform/' enable_code_security: true fail_on_severity: high ```分支特定阈值
``` name: Security with Branch Rules on: pull_request: branches: ['**'] jobs: security: uses: huntridge-labs/argus/.github/workflows/reusable-security-hardening.yml@0.6.7 with: scanners: all enable_code_security: true post_pr_comment: true fail_on_severity: ${{ github.base_ref == 'main' && 'high' || 'critical' }} secrets: inherit ```标签：Bandit, CI/CD安全, CISA项目, CodeQL, DAST, DevSecOps, GitHub Actions, Gitleaks, IaC扫描, IP 地址批量处理, Llama, OpenGrep, SAST, StruQ, Web截图, 上游代理, 代码安全, 安全扫描, 安全管道, 安全评估工具, 容器安全, 恶意软件分析, 持续安全, 数据可视化, 时序注入, 机密检测, 漏洞枚举, 盲注攻击, 结构化查询, 自动化安全, 自动笔记, 逆向工具