E07: Security Pipelines (`security-workflows`)¶

Goal: A paved-road, tool-replaceable security pipeline that produces verifiable evidence. Design: pipeline architecture.

F01: Foundations¶

Story: As the platform team, I want a dedicated workflows repo with strict controls, so that the code that runs in every pipeline is protected.
AC: Ruleset: 2 approvals, CODEOWNERS = platform team, signed commits, no force-push. Its own CI: actionlint, zizmor, canary e2e. permissions: {} default. Actions allowlist applies.
Security: Write access is effectively write access to every consumer pipeline. Membership is reviewed quarterly.

Story: As every capability workflow, I need a shared step that writes the manifest, attests it and uploads the artifact, so that evidence is uniform and verifiable.
Technical: Builds evidence-manifest.json (schema-validated in the action), computes SHA-256 of outputs, actions/attest with predicate type https://fortproof.dev/attestation/evidence/v1, uploads artifact aap-evidence-<capability> (retention 3 days, 1 day if public).
AC: The manifest validates against schemas/evidence/evidence-manifest.schema.json. The attestation verifies with gh attestation verify --signer-workflow. Public-repo mode prints counts only.
Tests: Canary run. A schema-invalid manifest fails the step.

Story: As a team, I want one caller that auto-detects languages, ecosystems, IaC, Dockerfiles, OpenAPI and workflows, and runs the right capabilities, so that onboarding is one file.
AC: Detection output shown in the job summary. Override inputs work. Unsupported languages are listed (not silently skipped). PR p90 added time ≤ 10 min (PS-11).

AC: Runs CodeQL for detected languages with a tier-appropriate suite. SARIF → GHAS. Manifest includes languages detected vs analysed. Accepts org default setup as an alternative (platform reads the analyses API).

AC: Scans all lockfiles. MAL-* advisories reported distinctly. Dependency review on PRs with org config (fail on new critical/high when the gate is enabled, licence deny list). Evidence for both.

Technical: Port the image-scan logic from the earlier prototype (keep the SHA-pinned Trivy). Remove the DefectDojo push. Digest-bound container evidence.
AC: SARIF to GHAS (categories per tool). Manifests bound to commit or image digest.

Technical: Port the Terraform lock-file → CycloneDX parser from the infra repo's sbom-scan.yml (already debugged in the pilot). cdxgen for source. Syft for images. No direct upload to Dependency-Track (the platform forwards).
AC: Pilot repo C produces an SBOM with ≥ 95% purl coverage. The Terraform parser handles non-registry hosts.

AC per adapter: manifest + attestation. DAST records target, auth mode and URLs crawled (inconclusive below threshold). Provenance via attest-build-provenance. deploy-evidence runs gh attestation verify on the deployed digest. test-evidence extracts JUnit testcases with asvs/threat properties.

AC: Tag → release notes → PR to config/trusted-producers.yaml adding the release SHA. 90-day retirement for old SHAs. Dependabot config template for consumers.

AC: Pilot repos use aap-security.yml. Repo secrets DEFECTDOJO_API_KEY / DEPENDENCY_TRACK_API_KEY deleted and the keys rotated (PS-14). No double import into DD during the overlap.