From c18fef016b1e8bbb727ca36dd9c3952103301728 Mon Sep 17 00:00:00 2001 From: Mario Date: Wed, 27 May 2026 20:51:17 +0200 Subject: [PATCH 1/6] Add Aisle JIT security scan workflow --- .github/workflows/aisle-jit-scan.yml | 35 ++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/workflows/aisle-jit-scan.yml diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml new file mode 100644 index 0000000..3ca3ec2 --- /dev/null +++ b/.github/workflows/aisle-jit-scan.yml @@ -0,0 +1,35 @@ +name: Aisle JIT security scan + +on: + pull_request: + branches: [master] + types: [closed] + workflow_dispatch: + +permissions: + contents: read + +concurrency: + group: aisle-jit-scan-${{ github.ref }} + cancel-in-progress: false + +jobs: + aisle-scan: + name: Aisle security scan + runs-on: pb-2c-4g + timeout-minutes: 15 + if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch' + permissions: + contents: read + pull-requests: write + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - uses: productboard/shared-workflows/.github/actions/jit-scan@main + with: + api_token: ${{ secrets.AISLE_API_TOKEN }} + api_url: ${{ secrets.AISLE_API_URL }} + scan_types: sast,sca,licenses + fail_on_findings: false From 66e0f340e7161eed693864ccdced65343f4de16c Mon Sep 17 00:00:00 2001 From: Mario Date: Thu, 28 May 2026 20:22:44 +0200 Subject: [PATCH 2/6] Pin jit-scan action to commit SHA (supply-chain security) --- .github/workflows/aisle-jit-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml index 3ca3ec2..83da3a8 100644 --- a/.github/workflows/aisle-jit-scan.yml +++ b/.github/workflows/aisle-jit-scan.yml @@ -27,9 +27,9 @@ jobs: with: persist-credentials: false - - uses: productboard/shared-workflows/.github/actions/jit-scan@main + - uses: productboard/shared-workflows/.github/actions/jit-scan@049662c75ef011f3165aef8e32d9c4446d409da0 # main with: api_token: ${{ secrets.AISLE_API_TOKEN }} api_url: ${{ secrets.AISLE_API_URL }} scan_types: sast,sca,licenses - fail_on_findings: false + fail_on_findings: false \ No newline at end of file From e9f0e148dfaa35cb412f9a74fc998065b48f6fac Mon Sep 17 00:00:00 2001 From: Mario Date: Thu, 28 May 2026 22:14:58 +0200 Subject: [PATCH 3/6] Remove unnecessary checkout step --- .github/workflows/aisle-jit-scan.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml index 83da3a8..98075be 100644 --- a/.github/workflows/aisle-jit-scan.yml +++ b/.github/workflows/aisle-jit-scan.yml @@ -23,13 +23,9 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - uses: productboard/shared-workflows/.github/actions/jit-scan@049662c75ef011f3165aef8e32d9c4446d409da0 # main - with: api_token: ${{ secrets.AISLE_API_TOKEN }} api_url: ${{ secrets.AISLE_API_URL }} scan_types: sast,sca,licenses - fail_on_findings: false \ No newline at end of file + fail_on_findings: false From ae407fa076f01772144838888d2ea5cdbbb8b213 Mon Sep 17 00:00:00 2001 From: Mario Date: Thu, 28 May 2026 22:20:29 +0200 Subject: [PATCH 4/6] Fix workflow: remove checkout, restore with block --- .github/workflows/aisle-jit-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml index 98075be..0dfa9c2 100644 --- a/.github/workflows/aisle-jit-scan.yml +++ b/.github/workflows/aisle-jit-scan.yml @@ -23,9 +23,9 @@ jobs: contents: read pull-requests: write steps: - - uses: productboard/shared-workflows/.github/actions/jit-scan@049662c75ef011f3165aef8e32d9c4446d409da0 # main + with: api_token: ${{ secrets.AISLE_API_TOKEN }} - api_url: ${{ secrets.AISLE_API_URL }} + api_url: ${{ secrets.AISLE_API_URL }} scan_types: sast,sca,licenses fail_on_findings: false From decc566c44d5f4cddcba9df7b13ea68da22a6d27 Mon Sep 17 00:00:00 2001 From: Mario Date: Fri, 29 May 2026 10:10:51 +0200 Subject: [PATCH 5/6] Remove sca from scan_types --- .github/workflows/aisle-jit-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml index 0dfa9c2..92a4d2d 100644 --- a/.github/workflows/aisle-jit-scan.yml +++ b/.github/workflows/aisle-jit-scan.yml @@ -27,5 +27,5 @@ jobs: with: api_token: ${{ secrets.AISLE_API_TOKEN }} api_url: ${{ secrets.AISLE_API_URL }} - scan_types: sast,sca,licenses + scan_types: sast,licenses fail_on_findings: false From 961ee19b8b5d22883355c0074cf887372de7b73d Mon Sep 17 00:00:00 2001 From: Mario Date: Fri, 29 May 2026 11:14:34 +0200 Subject: [PATCH 6/6] Update jit-scan action to new shared-workflows SHA --- .github/workflows/aisle-jit-scan.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/aisle-jit-scan.yml b/.github/workflows/aisle-jit-scan.yml index 92a4d2d..510f257 100644 --- a/.github/workflows/aisle-jit-scan.yml +++ b/.github/workflows/aisle-jit-scan.yml @@ -23,7 +23,7 @@ jobs: contents: read pull-requests: write steps: - - uses: productboard/shared-workflows/.github/actions/jit-scan@049662c75ef011f3165aef8e32d9c4446d409da0 # main + - uses: productboard/shared-workflows/.github/actions/jit-scan@6e034ce790a4d426755d32c111ca5d6ffbe0bd5f # main with: api_token: ${{ secrets.AISLE_API_TOKEN }} api_url: ${{ secrets.AISLE_API_URL }}