react2shell-scanner/.github/workflows/example-usage.yml at main · gensecaihq/react2shell-scanner · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
# Example workflows showing how to use react2shell-guard in your project
# Copy the relevant job to your repo's .github/workflows/ directory

name: React2Shell Security Scan Examples

# This is an EXAMPLE workflow file - users should copy relevant jobs to their repos
# Trigger manually to test examples
on:
  workflow_dispatch:

jobs:
  # ===========================================
  # Basic Usage - Simplest setup
  # ===========================================
  basic-scan:
    name: Basic Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Scan for CVE-2025-55182
        uses: gensecaihq/react2shell-scanner@v1
        with:
          path: '.'
          fail-on-vuln: true
          ignore-paths: 'examples/**'  # Ignore test fixtures in this repo

  # ===========================================
  # Full Featured - All options enabled
  # ===========================================
  full-featured-scan:
    name: Full Featured Scan
    runs-on: ubuntu-latest
    permissions:
      security-events: write  # Required for SARIF upload
      contents: read
      pull-requests: write    # Required for PR comments

    steps:
      - uses: actions/checkout@v4

      - name: Scan for CVE-2025-55182
        uses: gensecaihq/react2shell-scanner@v1
        with:
          path: '.'
          format: sarif
          fail-on-vuln: true
          upload-sarif: true
          add-pr-comment: true
          ignore-paths: 'examples/**,test/fixtures/**'

  # ===========================================
  # SBOM Scan - Scan CycloneDX SBOM files
  # ===========================================
  sbom-scan:
    name: SBOM Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Generate SBOM
        run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json

      - name: Scan SBOM for vulnerabilities
        uses: gensecaihq/react2shell-scanner@v1
        with:
          scan-type: sbom
          sbom-file: sbom.json
          fail-on-vuln: true

  # ===========================================
  # Container Scan - Scan Docker images
  # ===========================================
  container-scan:
    name: Container Scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install and build
        run: npm ci && npm run build

      - name: Build Docker image
        run: docker build -t myapp:latest .

      - name: Scan container for vulnerabilities
        uses: gensecaihq/react2shell-scanner@v1
        with:
          scan-type: container
          container-image: myapp:latest
          fail-on-vuln: true

  # ===========================================
  # Manual CLI Usage - Without the action
  # ===========================================
  manual-cli:
    name: Manual CLI Usage
    runs-on: ubuntu-latest
    permissions:
      security-events: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install react2shell-guard
        run: npm install -g react2shell-guard@latest

      - name: Run scan with SARIF output
        run: react2shell-guard . --sarif --ignore-path examples > results.sarif
        continue-on-error: true

      - name: Upload SARIF to GitHub Security
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: results.sarif
          category: react2shell-guard

      - name: Fail if vulnerable
        run: react2shell-guard . --ignore-path examples

  # ===========================================
  # Conditional Fix PR - Auto-create fix PRs
  # ===========================================
  auto-fix:
    name: Auto-Fix Vulnerabilities
    runs-on: ubuntu-latest
    # In your repo, use: if: github.event_name == 'schedule'
    permissions:
      contents: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install react2shell-guard
        run: npm install -g react2shell-guard@latest

      - name: Check for vulnerabilities
        id: scan
        run: |
          if react2shell-guard . --json --ignore-path examples | grep -q '"vulnerable": true'; then
            echo "vulnerable=true" >> $GITHUB_OUTPUT
          else
            echo "vulnerable=false" >> $GITHUB_OUTPUT
          fi

      - name: Create fix PR
        if: steps.scan.outputs.vulnerable == 'true'
        run: react2shell-guard create-pr .
        env:
          GH_TOKEN: ${{ github.token }}