# csantiagu/ci-security-scan architecture

> Architecture diagram of the GitHub repository csantiagu/ci-security-scan, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-11). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/csantiagu/ci-security-scan
- Repository: https://github.com/csantiagu/ci-security-scan

## Overview

This repository provides a reusable GitHub Actions security-scan workflow. A caller configures it for a pull request or scheduled run; enabled dependency, secret, code, image, and configuration scans report findings to a final Verdict job, which summarizes results and applies the configured failure policy. A separate SARIF-upload workflow supports GitHub code scanning. The README documents these relationships; no workflow source excerpts were provided, so the graph does not claim implementation details beyond that documentation.

Main entry points: [`.github/workflows/scan.yml`](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml) (Security scan), [`examples/accepted-findings`](https://github.com/csantiagu/ci-security-scan/tree/main/examples/accepted-findings) (Finding exceptions), [`.github/workflows/upload-sarif.yml`](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/upload-sarif.yml) (SARIF upload)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_orchestration["Workflow orchestration"]
  node_scan_workflow["Security scan<br/>[scan.yml]"]
  node_verdict["Verdict job<br/>[scan.yml]"]
end

subgraph group_dependencies["Dependency scans"]
  node_maven_scan["Maven dependencies<br/>[scan.yml]"]
  node_osv["OSV-Scanner"]
  node_npm_scan["npm dependencies<br/>[scan.yml]"]
  node_npm_audit["npm audit"]
end

subgraph group_repository_scans["Repository scans"]
  node_secrets_scan["Secret history<br/>[scan.yml]"]
  node_gitleaks["gitleaks"]
  node_code_scan["Source code<br/>[scan.yml]"]
  node_semgrep["Semgrep"]
  node_image_scan["Container image<br/>[scan.yml]"]
  node_trivy_image["Trivy image"]
  node_config_scan["Config and IaC<br/>[scan.yml]"]
  node_trivy_config["Trivy config"]
end

subgraph group_reporting["Reporting and exceptions"]
  node_accepted_findings["Finding exceptions"]
  node_sarif_upload["SARIF upload<br/>[upload-sarif.yml]"]
end

node_caller(("Workflow caller"))
node_github_security["GitHub code scanning"]

node_caller -->|"invokes"| node_scan_workflow
node_scan_workflow -->|"runs optionally"| node_maven_scan
node_maven_scan -->|"scans dependencies"| node_osv
node_scan_workflow -->|"runs optionally"| node_npm_scan
node_npm_scan -->|"audits packages"| node_npm_audit
node_scan_workflow -->|"runs optionally"| node_secrets_scan
node_secrets_scan -->|"scans history"| node_gitleaks
node_scan_workflow -->|"runs optionally"| node_code_scan
node_code_scan -->|"scans source"| node_semgrep
node_scan_workflow -->|"runs optionally"| node_image_scan
node_image_scan -->|"scans image"| node_trivy_image
node_scan_workflow -->|"runs optionally"| node_config_scan
node_config_scan -->|"scans config"| node_trivy_config
node_maven_scan -->|"reports findings"| node_verdict
node_npm_scan -->|"reports findings"| node_verdict
node_secrets_scan -->|"reports findings"| node_verdict
node_code_scan -->|"reports findings"| node_verdict
node_image_scan -->|"reports findings"| node_verdict
node_config_scan -->|"reports findings"| node_verdict
node_accepted_findings -->|"configures exceptions"| node_maven_scan
node_accepted_findings -->|"configures exceptions"| node_secrets_scan
node_accepted_findings -->|"configures exceptions"| node_code_scan
node_accepted_findings -->|"configures exceptions"| node_image_scan
node_accepted_findings -->|"configures exceptions"| node_config_scan
node_sarif_upload -->|"uploads SARIF"| node_github_security

click node_scan_workflow "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_verdict "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_maven_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_npm_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_secrets_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_code_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_image_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_config_scan "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml"
click node_accepted_findings "https://github.com/csantiagu/ci-security-scan/tree/main/examples/accepted-findings"
click node_sarif_upload "https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/upload-sarif.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_scan_workflow,node_verdict toneBlue
class node_maven_scan,node_osv,node_npm_scan,node_npm_audit toneAmber
class node_secrets_scan,node_gitleaks,node_code_scan,node_semgrep,node_image_scan,node_trivy_image,node_config_scan,node_trivy_config toneMint
class node_accepted_findings,node_sarif_upload toneRose
class node_caller,node_github_security toneIndigo
```

## Components

### Workflow orchestration

- [Security scan](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- [Verdict job](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`

### Dependency scans

- [Maven dependencies](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **OSV-Scanner**
- [npm dependencies](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **npm audit**

### Repository scans

- [Secret history](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **gitleaks**
- [Source code](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **Semgrep**
- [Container image](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **Trivy image**
- [Config and IaC](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/scan.yml): `.github/workflows/scan.yml`
- **Trivy config**

### Reporting and exceptions

- [Finding exceptions](https://github.com/csantiagu/ci-security-scan/tree/main/examples/accepted-findings): `examples/accepted-findings`
- [SARIF upload](https://github.com/csantiagu/ci-security-scan/blob/main/.github/workflows/upload-sarif.yml): `.github/workflows/upload-sarif.yml`

### Other components

- **Workflow caller**
- **GitHub code scanning**

## Connections

- Workflow caller → Security scan: invokes (evidence: `README.md`)
- Security scan → Maven dependencies: runs optionally (evidence: `README.md`)
- Maven dependencies → OSV-Scanner: scans dependencies (evidence: `README.md`)
- Security scan → npm dependencies: runs optionally (evidence: `README.md`)
- npm dependencies → npm audit: audits packages (evidence: `README.md`)
- Security scan → Secret history: runs optionally (evidence: `README.md`)
- Secret history → gitleaks: scans history (evidence: `README.md`)
- Security scan → Source code: runs optionally (evidence: `README.md`)
- Source code → Semgrep: scans source (evidence: `README.md`)
- Security scan → Container image: runs optionally (evidence: `README.md`)
- Container image → Trivy image: scans image (evidence: `README.md`)
- Security scan → Config and IaC: runs optionally (evidence: `README.md`)
- Config and IaC → Trivy config: scans config (evidence: `README.md`)
- Maven dependencies → Verdict job: reports findings (evidence: `README.md`)
- npm dependencies → Verdict job: reports findings (evidence: `README.md`)
- Secret history → Verdict job: reports findings (evidence: `README.md`)
- Source code → Verdict job: reports findings (evidence: `README.md`)
- Container image → Verdict job: reports findings (evidence: `README.md`)
- Config and IaC → Verdict job: reports findings (evidence: `README.md`)
- Finding exceptions → Maven dependencies: configures exceptions (evidence: `README.md`)
- Finding exceptions → Secret history: configures exceptions (evidence: `README.md`)
- Finding exceptions → Source code: configures exceptions (evidence: `README.md`)
- Finding exceptions → Container image: configures exceptions (evidence: `README.md`)
- Finding exceptions → Config and IaC: configures exceptions (evidence: `README.md`)
- SARIF upload → GitHub code scanning: uploads SARIF (evidence: `README.md`)