ci: Add InfraScan audit workflow for IaC security and cost optimization

[igor-soldev]

To improve infrastructure's quality, security, and cost-efficiency, I am adding a new CI/CD workflow powered by InfraScan.

What does this PR change?

• Automated scanning: Every push and pull_request will now be automatically audited for misconfigurations.
• Comprehensive Analysis: We are using the comprehensive scanner mode, which covers:
  • Security: Detection of vulnerabilities and permission issues.
  • Cost Optimization: Identification of "low-hanging fruit".
  • Container Auditing: Scanning image references for known CVEs.

Before proposing this change, I already ran a manual InfraScan web scan to validate the approach: https://infrascan.soldevelo.com/?scan_id=fea7f321-b0eb-4104-977c-22482f567ded

Free Reports & Artifacts

The workflow is configured to provide immediate feedback through visual reporting:

1. Interactive HTML Format: Generates a standalone dashboard with A-F grading.
2. Action Artifacts: The report is automatically uploaded as a GitHub Action artifact named infrascan-report.
3. Persistence: Reports are stored for 14 days and can be downloaded by anyone on the team.

How to access the results?

1. Go to the Actions tab of this repository.
2. Select the latest InfraScan Audit run.
3. Scroll down to the Artifacts section and download infrascan-report.
4. Open the report.html file in your browser to view the smart recommendations and risk assessments.

[ewaterman]

Hello @igor-soldev !

The code looks good to me but I'm hesitant to merge this because I'm unclear of the value add.

It looks like it's currently warning about MySQL 5.7 and Tomcat 7. I don't know how InfraScan is detecting those but we're on newer versions of both now. Our lowest supported version of those is MySQL 8 and Tomcat 8.

I can definitely see this integration being helpful for flagging new vulnerabilities introduced by a PR but I don't know if it has that capability (of doing a diff of the report between develop and this PR). Currently it looks like it's only flagging docker images which we aren't officially supporting.

[igor-soldev]

Hello @ewaterman,

Thanks for taking a look.

The discrepancy comes from the fact that the scan you referenced was run against the master branch, while this PR targets develop. In this repository, develop is the main development branch, and the scan results differ between the two branches.

I ran a scan specifically for develop, and the report is available here:
https://infrascan.soldevelo.com/report/openboxes-e6bb4197-4537-493a-86fd-256ce8ca7c0f

Could you take a look and let me know if these results seem more accurate with respect to the currently supported versions and infrastructure?

Also, from your perspective, what type of scanning would provide the most value for this project? I'd like to make sure the workflow is focused on the kinds of findings that are actually useful for the OpenBoxes team.

[ewaterman]

The discrepancy comes from the fact that the scan you referenced was run against the master branch

ah that makes sense. Yes we no longer use the master branch (only develop and main). That looks more accurate now.

what type of scanning would provide the most value for this project?

From the InfraScan README it looks like the tool supports Terraform, Kubernetes manifests, CloudFormation, Helm, and Dockerfiles. Of those we only use Docker. Outside of the image that we generate for openboxes itself, the only other base image that we depend on is mariadb. So I don't think we'll see anything other than the warning that we should upgrade to a newer mariadb version (which we're already aware of but don't have immediate plans to upgrade).

If InfraScan could do a deeper analysis of the semantics of our docker-compose files it miiight be able to find something interesting, but our docker setup is quite primitive at the moment so I don't think there's very much that it could flag.

The bulk of our IaC config is done via Ansible (currently in a private repo), which it doesn't seem to be supported by InfraScan.

[igor-soldev]

Hello @ewaterman,

thanks a lot for the detailed feedback. We're taking this kind of input very seriously.

Based on your comments, we're planning to quickly iterate on this and extend the integration to better cover OpenBoxes configuration.

Our goal is to make InfraScan more actionable for the project, not just limited to Docker-related checks.

We'll follow up with an updated version of the workflow once this is in place, and it would be great to get your feedback again at that point to see if the signal quality improves from your perspective.

[igor-soldev]

Hello @ewaterman,

Just a quick update, we've released InfraScan v1.0.7, which now includes support for Ansible scanning, addressing the gap you mentioned in your previous feedback.

You can find the GitHub Action integration here:

name: InfraScan Audit

on:
  push:
  pull_request:

jobs:
  infrascan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Create Reports Directory
        run: |
          mkdir -p infrascan-reports
          chmod 777 infrascan-reports

      - name: Run InfraScan
        uses: soldevelo/infrascan@v1.0.7
        with:
          scanner: comprehensive
          format: html
          out: infrascan-reports/report.html

      - name: Upload InfraScan Report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: infrascan-report
          path: infrascan-reports/report.html
          retention-days: 14

It might be worth giving it a try against your Ansible repository to see whether the findings are more relevant to your infrastructure setup now.

Looking forward to hearing your thoughts and whether the additional Ansible coverage provides more value for the OpenBoxes project.

[awalkowiak]

@igor-soldev, fyi our devops repo with Ansible is private. However, I already tested the InfraScan there last week and shared the report with @jkondrat internally. Let me know if there are any updates on your end within the plugin, and I can regenerate a report. We will discuss our next steps regarding this workflow internally (in the OB team).

cc @ewaterman

[igor-soldev]

Hi @awalkowiak,

Thanks for the update and for testing InfraScan against your Ansible repository.

At the moment, nothing has changed on our side, but if during your internal discussions or further testing you identify any specific needs, gaps, or areas where the findings could be more useful, please let us know. I'll be happy to look into it and work on improvements to make sure the integration provides value for the OpenBoxes team.

[awalkowiak]

Closing, as we decided, we do not need it for now. The feedback was passed to the InfraScan team.

[pgesek]

Hello @awalkowiak and @ewaterman

Just writing to let you know that we have recently extended InfraScan with additional features, including the one you mentioned - flagging new vulnerabilities on a PR (and cost changes for Terraform). See example here: SolDevelo/InfraScan#110

If you use the v1 version (not a specific v1.0.X version) of InfraScan in your devops repo, you should get that functionality out of the box. Otherwise I would suggest switching to the v1 version.

Again - we appreciate the feedback you gave, we hope that the tool grows to be more and more useful.

[awalkowiak]

@pgesek thanks for the info. Yup, we have v1.07 in there. I'll change it and test it out in the devops repo.