supply-chain-audit

Supply Chain Audit

Overview

Use this skill to audit everything that crosses the trust boundary into the build: Go modules, container base images, image signatures, SBOMs, and GitHub Actions. Scope intentionally excludes runtime authn/z, RBAC, and cluster posture — those live in security-audit-platform and k8s-hardening-audit.

Findings use the shared template at ../_shared/FINDINGS-TEMPLATE.md.

Step 1 — Inventory the build inputs

• Go modules: go list -m -json all > /tmp/go-mods.json from repo root and from each services/<name>/ with its own go.mod.
• Images built by this repo: collect Dockerfile paths.

  find . -name 'Dockerfile*' -not -path './inspirations/*' -not -path './node_modules/*'
  

• GitHub Actions workflows: ls .github/workflows/.
• Reusable composite actions: find . -path '*/.github/actions/*' -name action.yml -o -name action.yaml.
• Pre-commit hook versions: .pre-commit-config.yaml.

State the inventory in the report so a future audit knows the surface.

Step 2 — Vulnerable Go dependencies

govulncheck reports CVEs the binary actually reaches, not just modules in the graph. Run from every Go module root:

go install golang.org/x/vuln/cmd/govulncheck@latest

govulncheck ./...
for d in services/*/; do
  [ -f "$d/go.mod" ] && (cd "$d" && govulncheck ./...)
done

Report each Vulnerability block as a finding with severity drawn from the upstream advisory and the CallStack field as exploitability evidence.

Step 3 — Container image scans

Mirror .github/workflows/security-trivy.yaml locally. Build every image the repo produces and scan it as an image (filesystem scans miss base-image CVEs). Pin the same Trivy action version (currently 0.36.0 → aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25):

docker build --pull -f Dockerfile.operator -t mcp-runtime-operator:audit .
docker build --pull -f services/platform-api/Dockerfile -t mcp-platform-api:audit .
docker build --pull -f services/analytics-api/Dockerfile -t mcp-analytics-api:audit .
docker build --pull -f services/runtime-api/Dockerfile -t mcp-runtime-api:audit .
docker build --pull -f services/platform-api/Dockerfile -t mcp-platform-api:audit .
docker build --pull -f services/runtime-api/Dockerfile -t mcp-runtime-api:audit .
docker build --pull -f services/analytics-api/Dockerfile -t mcp-analytics-api:audit .
docker build --pull -f services/ui/Dockerfile -t mcp-sentinel-ui:audit .
docker build --pull -f services/ingest/Dockerfile -t mcp-sentinel-ingest:audit .
docker build --pull -f services/processor/Dockerfile -t mcp-sentinel-processor:audit .
docker build --pull -f services/mcp-gateway/Dockerfile -t mcp-sentinel-mcp-gateway:audit .

# Or use the repo helper (same image set + CI-matching flags):
bash hack/trivy-sentinel-images.sh

for img in mcp-runtime-operator:audit mcp-platform-api:audit mcp-runtime-api:audit \
           mcp-analytics-api:audit mcp-sentinel-ui:audit \
           mcp-sentinel-ingest:audit mcp-sentinel-processor:audit \
           mcp-sentinel-mcp-gateway:audit; do
  trivy image --exit-code 0 --severity CRITICAL,HIGH --ignore-unfixed \
              --vuln-type os,library --format table "$img"
done