devsecops-github-audit

A Claude Code skill that performs automated DevSecOps gap analysis on GitHub repositories.

Point it at a repo and it reads your existing GitHub Actions workflows, audits your security posture, and optionally generates ready-to-use workflow YAML files for every gap it finds.

---

What It Does

Step 0 — Preflight

Asks seven questions upfront: repo visibility, GHAS status, whether you want workflow files generated, branch protection settings, agentic code review status, compliance framework target, and whether self-hosted runners are in use. Answers shape every recommendation downstream.

Step 1 — Repository Intelligence

Reads all files in .github/workflows/, package manifests, Dockerfiles, IaC files, and other signals to understand your stack before making any recommendations.

Step 2 — Coverage Detection

Audits existing workflows across 13 control categories:

#	Category	Tools recognized
1	Secret Scanning	Gitleaks, truffleHog, detect-secrets, GitHub native push protection
2	SAST	CodeQL, Semgrep, Bandit, ESLint security, Gosec, Brakeman, SpotBugs
3	Dependency / SCA	Dependabot, npm audit, pip-audit, govulncheck, cargo audit, bundle audit, Snyk
4	Container Scanning	Trivy, Grype, Docker Scout, Snyk Container
5	IaC Scanning	Checkov, tfsec, KICS, cfn-nag, Terrascan
6	License Compliance	FOSSA, license-checker, Trivy license scan
7	DAST	OWASP ZAP, Nuclei
8	Supply Chain / Pinning	SHA-pinned actions, harden-runner, SLSA provenance, cosign image signing, commit signing, Dependabot for Actions
9	Branch Protection	Required status checks, PR reviews, signed commits, force-push restrictions
10	Agentic Code Review	CodeRabbit, GitHub Copilot code review, Ellipsis, Greptile, PR Agent, custom AI workflow
11	OIDC / Workload Identity	No long-lived cloud credentials; OIDC federation for AWS, GCP, Azure
12	SBOM Generation	anchore/sbom-action, syft, cyclonedx — SPDX and CycloneDX output
13	API Security Linting	Spectral (OWASP API Security Top 10), 42Crunch — only if OpenAPI spec detected

Each category is marked ✅ Present, ⚠️ Partial (exists but not blocking PRs), or ❌ Missing.

Soft-fail detection: catches the full spectrum of security theater — soft_fail: true, continue-on-error: true, exit-code: '0', fail_action: false, || true, and if: always() on scan steps.

SHA validation: flags unpinned actions (@v4), mutable refs (@main), and SHAs with no version comment.

Step 3 — Gap Analysis Report

• Repo profile summary
• Coverage matrix with blocking status and priority
• Priority findings (High → Medium → Low) with recommended tools and PR-blocking configuration
• Branch protection recommendations based on your actual settings

Step 4 — Workflow Generation (optional)

For each gap, generates a complete, ready-to-use GitHub Actions YAML file:

• .github/workflows/secret-scanning.yml
• .github/workflows/sast.yml
• .github/workflows/dependency-scanning.yml
• .github/workflows/container-scanning.yml
• .github/workflows/iac-scanning.yml
• .github/workflows/supply-chain.yml
• .github/workflows/sbom.yml
• .github/workflows/api-security.yml (if OpenAPI spec detected)
• .github/workflows/oidc-migration.yml (per-cloud-provider OIDC snippets)

All generated workflows:

• Trigger on pull_request (PR blocking) and push to main, plus weekly scheduled scan
• Pin actions to full commit SHAs with version comments
• Include a SHA freshness warning — you're told exactly which releases pages to verify before committing
• Hard-fail on CRITICAL/HIGH (no soft fails)
• Upload SARIF to GitHub Security tab (when GHAS is available)

GHAS-aware: private repos without GitHub Advanced Security get Semgrep instead of CodeQL, Gitleaks-only for secret scanning, and SARIF upload steps are omitted with a clear explanation.

Step 5 — Branch Protection Checklist

A concrete checklist for GitHub Settings → Branches → Branch protection rules, with already-configured items pre-marked based on your Step 0 answers.

---

Installation

This skill requires Claude Code.

# Clone into your Claude Code skills directory
git clone https://github.com/ufkesba/devsecops-github-audit ~/.claude/skills/devsecops-github-audit

The skill is auto-discovered by Claude Code on next session start.

---

Usage

In any Claude Code session:

/devsecops-github-audit

Or describe what you want:

"Audit my GitHub repo for missing security scanning" "What DevSecOps controls am I missing?" "Check my CI/CD security pipeline"

Then either paste your workflow files directly into the chat or point Claude at a repo URL with gh access.

---

Reference Files

File	Purpose
references/language-tools.md	Canonical SAST and SCA tool selection by language/ecosystem
references/workflow-standards.md	YAML templates with pinned action SHAs for all 6 workflow types

SHA freshness: The SHAs in workflow-standards.md were last verified on 2026-04-10. Before deploying generated workflows, verify each SHA at the action's GitHub releases page. Add Dependabot for the github-actions ecosystem to keep them current automatically.

---

License

MIT