feat(COD-6201): Docker approach of running the codesec GHA - unified scanning of both SCA and IaC by baltoiteodor · Pull Request #244 · lacework/code-security-action

baltoiteodor · 2026-03-10T10:55:00Z

Linked JIRA issue(s) - Required

https://lacework.atlassian.net/browse/COD-6201

Description

NOTE: At the moment, we launch this with IaC disabled as to make sure we have 1:1 scanning parity for SCA first.

Migrated the GitHub Action from Lacework CLI-based scanner to a Docker-based unified scanner (lacework/codesec:latest).

Changes:

Replaced CLI-based scanning with Docker image run via new codesecRun() function in src/util.ts
Removed Lacework CLI installation and SCA component installation from action.yaml
Removed macOS-specific steps (Docker not pre-installed on macOS runners)
Updated artifact structure from root-level files to scan-results/{sca,iac}/ paths
Added support for both SCA and IAC scanning in a single unified workflow

Potential Breaking changes:

Requires Docker on the runner (use ubuntu-latest)
Artifact paths changed from sca.sarif to scan-results/sca/sca-scan.sarif
Removed macOS runner support

Tests and additional notes

Integration tests:

Updated .github/workflows/integration-test.yml to use single ubuntu-latest runner
Removed Java setup (no longer needed)
Updated artifact name and path checks
Run with: push to main or PR against main

Testing Action on WebGoat, using lacework UEDEMO prod credentials:
PR workflow:
Scenario 1 - Only SCA originated violations: https://github.com/lacework-dev/WebGoat/pull/173
Scenario 2 - Only IaC originated violations: https://github.com/lacework-dev/WebGoat/pull/174
Scenario 3 - Combined violations: https://github.com/lacework-dev/WebGoat/pull/172

Push workflow:
Lacework UI IaC results are under "pipelines" - webgoat repo: https://uedemo.lacework.net/ui/investigation/codesec/iac/assessments/5c2840e6-a3d5-477e-ab34-01799724db40
SCA results not in UI as the scan is not done on main branch.

Notes:

The generateUILink() function is not currently being used... will need to add some support to the docker image to include this.

unified scanner docker image unified scanner docker image debug + erase macOS runner debug... debug testing clean add back the generateUILink clean added env-file to docker for iac added env-file to docker for iac code-scanning-path argument missed

jeremydubreil · 2026-03-18T12:00:15Z

.github/workflows/integration-test.yml

 env:
-  LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_CAT }}
-  LW_API_KEY: ${{ secrets.LW_API_KEY_CAT }}
-  LW_API_SECRET: ${{ secrets.LW_API_SECRET_CAT }}


I think this can be reverted now that I fixed the SCA scan

jeremydubreil · 2026-03-18T12:00:46Z

.github/workflows/integration-test.yml

-          - macos-latest
-          - ubuntu-latest
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest


This can be moved into a dedicated PR.

jeremydubreil · 2026-03-18T12:01:11Z

.github/workflows/integration-test.yml

    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
-      - name: Set up Java


Why did you remove this?

That was needed for the CLI command to work I believe? The docker approach does not need it.

I think that this code is there for another reason. I will have a look at it

jeremydubreil · 2026-03-18T12:03:50Z

src/index.ts

-import path from 'path'
-
-const artifactPrefix = getInput('artifact-prefix')
-const sarifReportPath = getInput('code-scanning-path')


Why is this removed? This is useful for the end user when they want to post-process the SARIF report, e.g. if they want to upload it to the GitHub Advanced Security UI.

Both should still be there: https://github.com/lacework/code-security-action/pull/244/changes#diff-a2a171449d862fe29692ce031981047d7ab755ae7f84c707aef80701b3ea0c80R61, https://github.com/lacework/code-security-action/pull/244/changes#diff-a2a171449d862fe29692ce031981047d7ab755ae7f84c707aef80701b3ea0c80R42.
Is there any functionality removed?

jeremydubreil · 2026-03-18T12:07:27Z

src/index.ts


-  const uploadStart = Date.now()
+  // Upload IAC JSON from the returned results path
+  const iacJsonFile = path.join(resultsPath, 'iac', `iac-${targetScan}.json`)


Maybe, the first version should do SCA only but use Docker for the scans and we make sure the functionalities are preserved. We can then add IaC in another PR.

jeremydubreil · 2026-03-23T10:23:27Z

src/index.ts

  }
-  if (debug()) {
-    args.push('--debug')
+  const resultsPath = await codesecRun('scan', true, true, targetScan)


Suggested change

const resultsPath = await codesecRun('scan', true, true, targetScan)

const shouldRunSca = true

// TODO(...): set to true

const shouldRunIaC = false

const resultsPath = await codesecRun('scan', shouldRunIaC, shouldRunSca, targetScan)

disable iac scanning for now

jeremydubreil · 2026-03-23T14:45:56Z

.github/workflows/integration-test.yml

-      matrix:
-        os:
-          - macos-latest
-          - ubuntu-latest


Are these changes based on the latest version of main?

they were not, they are now

… into COD-6201-unified

baltoiteodor force-pushed the COD-6201-unified branch 4 times, most recently from b5a3559 to ffb930e Compare March 11, 2026 16:27

baltoiteodor changed the title ~~do not merge - testing~~ feat(COD-6201): Docker approach of running the codesec GHA - unified scanning of both SCA and IaC Mar 18, 2026

unified scanner docker image

57c7727

unified scanner docker image unified scanner docker image debug + erase macOS runner debug... debug testing clean add back the generateUILink clean added env-file to docker for iac added env-file to docker for iac code-scanning-path argument missed

baltoiteodor force-pushed the COD-6201-unified branch from 5ba91d4 to 57c7727 Compare March 18, 2026 11:50

jeremydubreil reviewed Mar 18, 2026

View reviewed changes

jeremydubreil reviewed Mar 23, 2026

View reviewed changes

baltoiteodor added 2 commits March 23, 2026 13:53

disable iac scanning for now

4bcf05d

disable iac scanning for now

check older credentials

2d481fc

jeremydubreil reviewed Mar 23, 2026

View reviewed changes

Merge branch 'main' of ssh://github.com/lacework/code-security-action…

db45f78

… into COD-6201-unified

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(COD-6201): Docker approach of running the codesec GHA - unified scanning of both SCA and IaC#244

feat(COD-6201): Docker approach of running the codesec GHA - unified scanning of both SCA and IaC#244
baltoiteodor wants to merge 4 commits intomainfrom
COD-6201-unified

baltoiteodor commented Mar 10, 2026 •

edited

Loading

Uh oh!

jeremydubreil Mar 18, 2026

Uh oh!

jeremydubreil Mar 18, 2026

Uh oh!

jeremydubreil Mar 18, 2026

Uh oh!

baltoiteodor Mar 19, 2026

Uh oh!

jeremydubreil Mar 23, 2026

Uh oh!

jeremydubreil Mar 18, 2026

Uh oh!

baltoiteodor Mar 19, 2026

Uh oh!

jeremydubreil Mar 18, 2026

Uh oh!

jeremydubreil Mar 23, 2026

Uh oh!

jeremydubreil Mar 23, 2026

Uh oh!

baltoiteodor Mar 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-  const resultsPath = await codesecRun('scan', true, true, targetScan)
+  const shouldRunSca = true
+  // TODO(...): set to true
+  const shouldRunIaC = false
+  const resultsPath = await codesecRun('scan', shouldRunIaC, shouldRunSca, targetScan)

Conversation

baltoiteodor commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

baltoiteodor commented Mar 10, 2026 •

edited

Loading