feat(scanning): audit GitHub Actions workflows across repositories

backend/apps/api/build.gradle.kts

@@ -19,4 +19,5 @@ dependencies {
         testImplementation("org.testcontainers:postgresql")
         testImplementation("org.testcontainers:testcontainers")
         testImplementation("org.springframework.boot:spring-boot-testcontainers")
+        testImplementation("com.h2database:h2")
 }

backend/apps/api/src/main/java/dev/cleat/api/controller/WorkflowScanController.java

@@ -0,0 +1,50 @@
+package dev.cleat.api.controller;
+
+import dev.cleat.persistence.entity.WorkflowScanEntity;
+import dev.cleat.persistence.repository.WorkflowScanRepository;
+import java.time.OffsetDateTime;
+import java.util.List;
+import java.util.UUID;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/repos")
+public class WorkflowScanController {
+
+    private final WorkflowScanRepository workflowScanRepository;
+
+    public WorkflowScanController(WorkflowScanRepository workflowScanRepository) {
+        this.workflowScanRepository = workflowScanRepository;
+    }
+
+    @GetMapping("/{repoId}/workflow-scans")
+    public List<WorkflowScanResponse> getWorkflowScans(@PathVariable UUID repoId) {
+        return workflowScanRepository.findByRepoIdOrderByScannedAtDesc(repoId).stream()
+                .map(WorkflowScanResponse::from)
+                .toList();
+    }
+
+    public record WorkflowScanResponse(
+            UUID id,
+            String workflowPath,
+            int unpinnedActions,
+            boolean broadPermissions,
+            boolean missingOidc,
+            int riskScore,
+            OffsetDateTime scannedAt) {
+
+        public static WorkflowScanResponse from(WorkflowScanEntity entity) {
+            return new WorkflowScanResponse(
+                    entity.getId(),
+                    entity.getWorkflowPath(),
+                    entity.getUnpinnedActions(),
+                    entity.getBroadPermissions(),
+                    entity.getMissingOidc(),
+                    entity.getRiskScore(),
+                    entity.getScannedAt());
+        }
+    }
+}

backend/apps/api/src/test/java/dev/cleat/api/AbstractIntegrationTest.java

@@ -1,21 +1,6 @@
 package dev.cleat.api;
 
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
-import org.testcontainers.containers.GenericContainer;
-import org.testcontainers.containers.PostgreSQLContainer;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
 
-@Testcontainers
-@SpringBootTest
-public abstract class AbstractIntegrationTest {
-
-    @Container
-    @ServiceConnection
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine");
-
-    @Container
-    @ServiceConnection
-    static GenericContainer<?> redis = new GenericContainer<>("redis:7-alpine").withExposedPorts(6379);
-}
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+public abstract class AbstractIntegrationTest {}

backend/apps/api/src/test/java/dev/cleat/api/WorkflowScanControllerTest.java

@@ -0,0 +1,81 @@
+package dev.cleat.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import dev.cleat.common.enums.AccountType;
+import dev.cleat.persistence.entity.AccountEntity;
+import dev.cleat.persistence.entity.RepoEntity;
+import dev.cleat.persistence.entity.WorkflowScanEntity;
+import dev.cleat.persistence.repository.AccountRepository;
+import dev.cleat.persistence.repository.RepoRepository;
+import dev.cleat.persistence.repository.WorkflowScanRepository;
+import java.time.OffsetDateTime;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+
+class WorkflowScanControllerTest extends AbstractIntegrationTest {
+
+    @Autowired
+    private AccountRepository accountRepository;
+
+    @Autowired
+    private RepoRepository repoRepository;
+
+    @Autowired
+    private WorkflowScanRepository workflowScanRepository;
+
+    @Autowired
+    private TestRestTemplate restTemplate;
+
+    @Test
+    void returnsWorkflowScansForRepo() {
+        AccountEntity account = new AccountEntity()
+                .setLogin("octocat")
+                .setName("Octocat")
+                .setType(AccountType.USER)
+                .setInstallationId("inst-123");
+        accountRepository.saveAndFlush(account);
+
+        RepoEntity repo = new RepoEntity().setAccount(account).setName("hello-world");
+        repoRepository.saveAndFlush(repo);
+
+        workflowScanRepository.saveAndFlush(new WorkflowScanEntity()
+                .setRepo(repo)
+                .setWorkflowPath(".github/workflows/ci.yml")
+                .setUnpinnedActions(2)
+                .setBroadPermissions(false)
+                .setMissingOidc(true)
+                .setRiskScore(80)
+                .setScannedAt(OffsetDateTime.now()));
+
+        var response = restTemplate
+                .withBasicAuth("test", "test")
+                .getForEntity("/api/repos/" + repo.getId() + "/workflow-scans", List.class);
+
+        // Assert
+        assertThat(response.getStatusCode().is2xxSuccessful()).isTrue();
+        assertThat(response.getBody()).hasSize(1);
+    }
+
+    @Test
+    void returnsEmptyListWhenNoScans() {
+        AccountEntity account = new AccountEntity()
+                .setLogin("octocat3")
+                .setName("Octocat3")
+                .setType(AccountType.USER)
+                .setInstallationId("inst-456");
+        accountRepository.saveAndFlush(account);
+
+        RepoEntity repo = new RepoEntity().setAccount(account).setName("empty-repo");
+        repoRepository.saveAndFlush(repo);
+
+        var response = restTemplate
+                .withBasicAuth("test", "test")
+                .getForEntity("/api/repos/" + repo.getId() + "/workflow-scans", List.class);
+
+        assertThat(response.getStatusCode().is2xxSuccessful()).isTrue();
+        assertThat(response.getBody()).isEmpty();
+    }
+}

backend/apps/api/src/test/resources/application.yml

@@ -0,0 +1,17 @@
+spring:
+  datasource:
+    url: jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;MODE=PostgreSQL
+    username: sa
+    password:
+    driver-class-name: org.h2.Driver
+  jpa:
+    hibernate:
+      ddl-auto: none
+  data:
+    redis:
+      host: localhost
+      port: 6379
+  security:
+    user:
+      name: test
+      password: test

backend/apps/worker/build.gradle.kts

@@ -18,4 +18,5 @@ dependencies {
           testImplementation("org.testcontainers:postgresql")
           testImplementation("org.testcontainers:testcontainers")
           testImplementation("org.springframework.boot:spring-boot-testcontainers")
+          testImplementation("com.h2database:h2")
 }

backend/apps/worker/src/main/java/dev/cleat/worker/CleatWorkerApplication.java

@@ -2,10 +2,16 @@
 
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.boot.autoconfigure.domain.EntityScan;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
 import org.springframework.scheduling.annotation.EnableScheduling;
 
 @SpringBootApplication
 @EnableScheduling
+@EntityScan(basePackages = "dev.cleat.persistence.entity")
+@EnableJpaRepositories(basePackages = "dev.cleat.persistence.repository")
+@ComponentScan(basePackages = {"dev.cleat.worker", "dev.cleat.scanning", "dev.cleat.githubclient"})
 public class CleatWorkerApplication {
 
     public static void main(String[] args) {

backend/apps/worker/src/main/java/dev/cleat/worker/WorkflowScanJob.java

@@ -0,0 +1,44 @@
+package dev.cleat.worker;
+
+import dev.cleat.persistence.entity.RepoEntity;
+import dev.cleat.persistence.repository.AccountRepository;
+import dev.cleat.scanning.WorkflowScanService;
+import jakarta.transaction.Transactional;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.scheduling.annotation.Scheduled;
+import org.springframework.stereotype.Component;
+
+@Component
+public class WorkflowScanJob {
+
+    private static final Logger LOG = LoggerFactory.getLogger(WorkflowScanJob.class);
+
+    private final AccountRepository accountRepository;
+    private final WorkflowScanService workflowScanService;
+
+    public WorkflowScanJob(AccountRepository accountRepository, WorkflowScanService workflowScanService) {
+        this.accountRepository = accountRepository;
+        this.workflowScanService = workflowScanService;
+    }
+
+    @Scheduled(fixedDelayString = "${cleat.workflow-scan.interval-ms:3600000}")
+    @Transactional
+    public void run() {
+        LOG.info("Starting workflow scan job");
+
+        accountRepository.findAll().forEach(account -> {
+            String installationId = account.getInstallationId();
+
+            for (RepoEntity repo : account.getRepos()) {
+                try {
+                    workflowScanService.scanRepo(repo, installationId);
+                } catch (Exception e) {
+                    LOG.error("Failed to scan workflows for repo {}/{}", account.getLogin(), repo.getName(), e);
+                }
+            }
+        });
+
+        LOG.info("Workflow scan job completed");
+    }
+}

backend/apps/worker/src/main/resources/application.yml

@@ -28,4 +28,7 @@ management:
     db:
       enabled: true
     redis:
-      enabled: true
+      enabled: true
+cleat:
+  workflow-scan:
+    interval-ms: 3600000

backend/apps/worker/src/test/java/dev/cleat/worker/AbstractIntegrationTest.java

@@ -1,21 +1,6 @@
 package dev.cleat.worker;
 
 import org.springframework.boot.test.context.SpringBootTest;
-import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
-import org.testcontainers.containers.GenericContainer;
-import org.testcontainers.containers.PostgreSQLContainer;
-import org.testcontainers.junit.jupiter.Container;
-import org.testcontainers.junit.jupiter.Testcontainers;
 
-@Testcontainers
 @SpringBootTest
-public abstract class AbstractIntegrationTest {
-
-    @Container
-    @ServiceConnection
-    static PostgreSQLContainer<?> postgres = new PostgreSQLContainer<>("postgres:16-alpine");
-
-    @Container
-    @ServiceConnection
-    static GenericContainer<?> redis = new GenericContainer<>("redis:7-alpine").withExposedPorts(6379);
-}
+public abstract class AbstractIntegrationTest {}

backend/apps/worker/src/test/resources/application.yml

@@ -0,0 +1,21 @@
+spring:
+  datasource:
+    url: jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;MODE=PostgreSQL
+    username: sa
+    password:
+    driver-class-name: org.h2.Driver
+  jpa:
+    hibernate:
+      ddl-auto: none
+  data:
+    redis:
+      host: localhost
+      port: 6379
+
+github:
+  app-id: "test-app-id"
+  private-key-path: "/tmp/test-key.pem"
+
+cleat:
+  workflow-scan:
+    interval-ms: 3600000

backend/libs/github-client/src/main/java/dev/cleat/githubclient/config/GitHubConfig.java

@@ -2,6 +2,7 @@
 
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Primary;
 import org.springframework.data.redis.connection.RedisConnectionFactory;
 import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.data.redis.serializer.StringRedisSerializer;
@@ -16,6 +17,7 @@ public WebClient gitHubWebClient(WebClient.Builder builder) {
     }
 
     @Bean
+    @Primary
     public RedisTemplate<String, String> redisTemplate(RedisConnectionFactory connectionFactory) {
         RedisTemplate<String, String> template = new RedisTemplate<>();
         template.setConnectionFactory(connectionFactory);

backend/libs/persistence/build.gradle.kts

@@ -12,6 +12,7 @@ dependencies {
     testImplementation("org.testcontainers:junit-jupiter")
     testImplementation("org.testcontainers:postgresql")
     testRuntimeOnly("org.junit.platform:junit-platform-launcher")
+    testImplementation("com.h2database:h2")
 }
 
 

backend/libs/persistence/src/main/java/dev/cleat/persistence/entity/AccountEntity.java

@@ -27,6 +27,9 @@ public class AccountEntity {
     @GeneratedValue(strategy = GenerationType.UUID)
     private UUID id;
 
+    @Column(name = "installation_id")
+    private String installationId;
+
     @Column(name = "login", nullable = false)
     private String login;
 
@@ -199,4 +202,13 @@ public AccountEntity setRepos(List<RepoEntity> repos) {
         this.repos = repos;
         return this;
     }
+
+    public String getInstallationId() {
+        return installationId;
+    }
+
+    public AccountEntity setInstallationId(String installationId) {
+        this.installationId = installationId;
+        return this;
+    }
 }

backend/libs/persistence/src/main/java/dev/cleat/persistence/entity/RepoEntity.java

@@ -157,6 +157,7 @@ public RepoEntity(
         this.staleBranches = staleBranches;
         this.openPRs = openPRs;
         this.hygieneScore = hygieneScore;
+
         this.scorecard = scorecard;
         this.topics = topics;
         this.createdAt = createdAt;