Summary
Currently, nightly builds skip security scans (skip_code_scans: true) for faster execution. While security scans run on every PR and push to main/develop/release branches, this means vulnerabilities in dependencies discovered between PRs won't be detected until someone opens a new PR.
Proposal
Add a weekly scheduled workflow that runs full security scans (CodeQL + Trivy) without skipping. This provides periodic security coverage for vulnerabilities that may be discovered in dependencies between active development periods.
Implementation
Create a new scheduled-security-scan.yml workflow that:
- Runs weekly (e.g., Sunday at 3:00 AM UTC)
- Calls
build.yml with skip_code_scans: false and skip_linkcheck: true
- Targets the
develop branch
Example:
name: Weekly Security Scan
on:
schedule:
- cron: '0 3 * * 0' # Sunday at 3:00 AM UTC
workflow_dispatch:
jobs:
security-scan:
uses: ./.github/workflows/build.yml
with:
ref: develop
skip_code_scans: false
skip_linkcheck: true
secrets: inheritTasks
Context
This was suggested during PR review of the nightly build workflow refactoring. While Dependabot provides real-time alerts, having scheduled scans ensures CodeQL and Trivy analysis runs periodically regardless of PR activity.
Summary
Currently, nightly builds skip security scans (
skip_code_scans: true) for faster execution. While security scans run on every PR and push to main/develop/release branches, this means vulnerabilities in dependencies discovered between PRs won't be detected until someone opens a new PR.Proposal
Add a weekly scheduled workflow that runs full security scans (CodeQL + Trivy) without skipping. This provides periodic security coverage for vulnerabilities that may be discovered in dependencies between active development periods.
Implementation
Create a new
scheduled-security-scan.ymlworkflow that:build.ymlwithskip_code_scans: falseandskip_linkcheck: truedevelopbranchExample:
Tasks
Context
This was suggested during PR review of the nightly build workflow refactoring. While Dependabot provides real-time alerts, having scheduled scans ensures CodeQL and Trivy analysis runs periodically regardless of PR activity.