Gh Code Scanning

title: GH Code Scanning Skill Security Model description: STRIDE threat model for the gh-code-scanning skill organized by assets, adversaries, and trust buckets (CLI to gh/GitHub API subprocess, untrusted alert-data rendering, CLI caller process and credentials) with in-code mitigations and acknowledged enterprise readiness gaps author: microsoft/hve-core ms.date: 2026-10-02 ms.topic: reference estimated_reading_time: 8 keywords:

• security

• STRIDE

• gh-code-scanning

• github

• threat model

<!-- markdownlint-disable-file -->

GH Code Scanning Skill Security Model

This document records the STRIDE threat model for the gh-code-scanning skill (scripts/Get-CodeScanningAlerts.ps1 and scripts/get-code-scanning-alerts.sh, the PowerShell and POSIX twins). The model is organized by trust bucket: CLI → gh/GitHub API subprocess (B1), Untrusted alert-data rendering (B2), and CLI caller process and credentials (B3). Each bucket enumerates all six STRIDE categories with the in-code mitigations that address them. Assets and adversaries are enumerated first. Acknowledged enterprise readiness gaps are listed at the end.

The skill reads open GitHub code-scanning alerts for a repository and branch through the gh CLI, groups them by rule, and prints a table or JSON. With the opt-in -IncludeDismissedStillDetected (-d in bash) option it makes one more read-only GET on the same endpoint with state=dismissed, keeps alerts whose branch instance is not fixed, and adds their dismissed_reason enum value to the output; the dismissal comment is not read or rendered. It handles no credential directly (gh owns the token), opens no local listener, and writes no files: output goes to stdout only.

See also: repo-wide STRIDE model. This skill participates in the repository-wide threat model at docs/security/security-model.md and is registered in its Skill Security Models section.

Executive Summary

The gh-code-scanning skill is a read-only reporting wrapper over gh api. Its highest-risk behavior is rendering untrusted alert data returned by the GitHub API to the operator's terminal or a JSON consumer. Every caller-supplied argument (Owner, Repo, Branch, output format, severity) is validated against a strict allow-list before it is interpolated into the gh api endpoint, closing argument- and query-injection vectors; alert fields are emitted as data (Format-Table, ConvertTo-Json, jq), never executed. Credentials are delegated entirely to gh and never touched by the script. Residual risk concentrates in the unpinned gh/jq PATH dependencies and TLS trust delegated to gh.

Security Posture Overview

Contents

• System Description

• Trust Boundaries

• Assets

• Adversaries

• Bucket B1: CLI → gh/GitHub API subprocess

• Bucket B2: Untrusted alert-data rendering

• Bucket B3: CLI caller process and credentials

• Enterprise Readiness Gaps

• References

System Description

Components

1. scripts/Get-CodeScanningAlerts.ps1 — PowerShell twin: validates parameters via [ValidatePattern]/[ValidateSet], calls gh api, groups alerts by rule, and prints a table or JSON.

2. scripts/get-code-scanning-alerts.sh — POSIX/bash twin with the same behavior, validating arguments with regex guards and grouping via jq.

Data Flow

flowchart TD
    subgraph HOST["Operator Workstation / Runner (trust zone)"]
        CLI["Get-CodeScanningAlerts.ps1 / .sh"]
        GHAUTH["gh auth token store<br/>(keyring / GH_TOKEN)"]
        OUT["Grouped alert output<br/>(table / JSON)"]
    end
    subgraph GH["GitHub REST API (network boundary)"]
        API["code-scanning/alerts endpoint"]
    end
    CLI -->|"validated args"| GHSUB["gh CLI subprocess"]
    GHSUB -->|"reads token"| GHAUTH
    GHSUB -->|"GET (HTTPS/TLS)"| API
    API -->|"alert JSON (untrusted data)"| GHSUB
    GHSUB -->|"stdout"| CLI
    CLI -->|"renders as data"| OUT

Trust Boundaries

Boundary Diagram

┌───────────────────────────────────────────────────────────┐
│ TRUST BOUNDARY: Operator Workstation / Runner             │
│  ┌─────────────┐   ┌──────────────┐   ┌────────────────┐  │
│  │ CodeScanning│   │ gh token     │   │ stdout report  │  │
│  │ CLI twins   │   │ (keyring/env)│   │ (table/JSON)   │  │
│  └─────────────┘   └──────────────┘   └────────────────┘  │
└───────────────────────────┬───────────────────────────────┘
                            │ TLS (via gh)
        ┌────────────────────▼────────────────────┐
        │ TRUST BOUNDARY: GitHub REST API          │
        │  ┌────────────────────────────────────┐  │
        │  │ code-scanning/alerts (read-only)   │  │
        │  └────────────────────────────────────┘  │
        └──────────────────────────────────────────┘

Boundary Descriptions

Assets

Adversaries

Bucket B1: CLI → gh/GitHub API subprocess

Spoofing

• Authentication and endpoint identity are delegated to gh, which validates the GitHub API's TLS certificate. The script constructs the endpoint from a fixed template with validated path segments.

Tampering

• All caller inputs are validated before use: Owner and Repo against ^[a-zA-Z0-9._-]+$, Branch against ^[a-zA-Z0-9._/-]+$, OutputFormat against a [ValidateSet], and severity against a fixed enum. Because &, ?, and whitespace are excluded, a caller cannot inject additional query parameters or alter the REST path.

• The Branch value is confined to the ref=refs/heads/... query-string segment; its allow-list still permits . and / (including ..), recorded as G-TAM-1.

Repudiation

• Not applicable. This is a read-only reporting tool with no state change to attribute.

Information Disclosure

• No secret is handled in-script; the token lives only inside gh. GH_PAGER is cleared to keep output non-interactive.

Denial of Service

• The query caps page size (per_page=100) and uses gh --paginate; runtime is bounded by the number of open alerts. No unbounded local loops.

Elevation of Privilege

• The subprocess runs with the caller's privileges; access is limited to whatever the gh token already grants. The script requests no additional scope.

Risk Rating

Bucket B2: Untrusted alert-data rendering

Spoofing

• Not applicable. Alert content carries no identity claim; it is treated as data.

Tampering

• The script does not modify alert data; it groups and sorts it for display.

Repudiation

• Not applicable.

Information Disclosure

• Alert descriptions, affected paths, and URLs originate from the operator's own repository scanning and are printed to the operator's terminal or a JSON consumer. They are rendered as data; downstream consumers are responsible for their own safe handling.

Denial of Service

• Grouping is proportional to the number of alerts returned; there is no amplification.

Elevation of Privilege

• Rendered fields are never interpreted as code or commands, so hostile alert content cannot drive execution.

Risk Rating

Bucket B3: CLI caller process and credentials

Spoofing

• Not applicable. No local identity surface.

Tampering

• The script writes no files; output is stdout only, so there is no on-disk artifact to tamper with.

Repudiation

• Not applicable. Local read-only tool.

Information Disclosure

• The token is never read, logged, or echoed by the script; it stays inside gh. Only grouped alert data reaches stdout.

Denial of Service

• No local resource is consumed beyond the bounded gh call and in-memory grouping.

Elevation of Privilege

• Runs entirely with the caller's privileges; no elevation and no setuid behavior.

Risk Rating

Enterprise Readiness Gaps

The following are known limitations recorded so operators can make informed deployment decisions. Severity ratings are the project's own assessment and are not equivalent to a CVSS score.

For an active issue tracker entry covering these gaps, see the hve-core issues list.

References

• STRIDE Threat Model

• OWASP Top 10

• GitHub CLI (gh) manual

• GitHub code scanning alerts REST API

• Repository security model

🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.