From 1ea5696d1c1c13dd7d0ebeee7ee87d2f7e92d1ea Mon Sep 17 00:00:00 2001
From: Sebastian Graef <sebastian@graef.io>
Date: Wed, 26 Aug 2026 11:54:22 +1000
Subject: [PATCH 1/2] ci: add SecKit scan workflow and badge

Drop-in SecKit security scan (gitleaks, trufflehog, osv, semgrep, checkov) on push to main and pull requests. Soft-fail: findings become a warning plus a report artifact.
---
 .github/workflows/seckit-scan.yml | 70 +++++++++++++++++++++++++++++++
 README.md                         |  2 +
 2 files changed, 72 insertions(+)
 create mode 100644 .github/workflows/seckit-scan.yml

diff --git a/.github/workflows/seckit-scan.yml b/.github/workflows/seckit-scan.yml
new file mode 100644
index 0000000..3cd3848
--- /dev/null
+++ b/.github/workflows/seckit-scan.yml
@@ -0,0 +1,70 @@
+# SecKit security scan - portable drop-in for any repo.
+#
+# Runs the full SecKit flow in CI: `seckit install` to provision the scanners,
+# then `seckit scan` over the checked-out code, and publishes the markdown
+# report as a build artifact.
+#
+# Copy this file into any repo's .github/workflows/. It clones SecKit at run
+# time, so the only thing the target repo needs is this one file. Inside the
+# SecKit repo itself you can drop the "Get SecKit" step and call ./seckit.sh.
+#
+# Notes:
+# - GitHub-hosted ubuntu runners ship Homebrew, which `seckit install` uses.
+#   The install step is the slow one (a few minutes); cache or pin if it bites.
+# - gitleaks needs full git history, hence fetch-depth: 0.
+# - The scan is soft-fail by default (findings -> warning + artifact, not a
+#   red build). Flip the "Gate" step to `exit 1` to block merges on findings.
+# - socket is skipped (it needs `socket login`); drop --skip=socket to include.
+name: seckit-scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  SECKIT_REPORT_DIR: ${{ github.workspace }}/seckit-reports
+
+jobs:
+  seckit:
+    name: seckit install + scan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout (full history for gitleaks)
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Get SecKit
+        run: git clone --depth 1 https://github.com/segraef/sec-kit.git "$RUNNER_TEMP/sec-kit"
+
+      - name: Install scanners (seckit install)
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" 2>/dev/null || true
+          bash "$RUNNER_TEMP/sec-kit/seckit.sh" install --all -y
+
+      - name: Scan (seckit scan)
+        id: scan
+        continue-on-error: true
+        run: |
+          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" 2>/dev/null || true
+          bash "$RUNNER_TEMP/sec-kit/seckit.sh" scan "$GITHUB_WORKSPACE" --skip=socket
+
+      - name: Publish report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: seckit-report
+          path: ${{ env.SECKIT_REPORT_DIR }}/*.md
+          if-no-files-found: warn
+
+      - name: Gate
+        if: steps.scan.outcome == 'failure'
+        run: |
+          echo "::warning::SecKit reported findings - download the seckit-report artifact to triage."
+          # To block merges on findings instead, replace the line above with:
+          #   exit 1
diff --git a/README.md b/README.md
index fcbfaff..ff147f1 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # ![AzureIcon] ![BashIcon] ![PowershellIcon] Scripts
 
+[![Scanned with SecKit](https://raw.githubusercontent.com/segraef/sec-kit/main/docs/media/badge.svg)](https://github.com/segraef/sec-kit)
+
 A collection of automation scripts across PowerShell, Bash, Python and JavaScript for Azure, DevOps and general infrastructure tasks.
 
 ## Repository structure

From 3992f76ced32e16dc79dac446bda4c9f966be838 Mon Sep 17 00:00:00 2001
From: Sebastian Graef <sebastian@graef.io>
Date: Wed, 26 Aug 2026 20:19:08 +1000
Subject: [PATCH 2/2] ci: pin SecKit scan workflow actions to commit SHAs

---
 .github/workflows/seckit-scan.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/seckit-scan.yml b/.github/workflows/seckit-scan.yml
index 3cd3848..b99a73a 100644
--- a/.github/workflows/seckit-scan.yml
+++ b/.github/workflows/seckit-scan.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout (full history for gitleaks)
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -56,7 +56,7 @@ jobs:
 
       - name: Publish report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: seckit-report
           path: ${{ env.SECKIT_REPORT_DIR }}/*.md