FEAT [DTECSCSAO-4805] GHAS integration: Code scanning & Dependency review

[sekhara-madduru]

JIRA ID | Git Issue

https://paypal.atlassian.net/browse/DTECSCSAO-4805

Change Type

• Bug fix (is this a backward compatible change?)
• New feature (is this a backward compatible change?)
• Breaking change (is this a non-backward compatible change?)
• DB changes (add scripts in the sql/migrations/{date} folder)

Change Impact

Summary

• GHAS integration: Adding a workflow action files for Code scanning & Dependency review.

Demo

Notes

The PayPal Product Security Team is replacing Coverity, Black Duck, and Cycode with GitHub Advanced Security (GHAS). This change will affect all PayPal and business unit production repositories on GitHub. GitHub Advanced Security provides three important security scanning capabilities including plaintext secrets detection, software composition analysis (SCA) for open source software (OSS) via Dependabot and Dependency Review, and static code analysis via CodeQL. We’re making this change because contracts for our existing software security tools are expiring and because we heard strong developer feedback in support of GHAS. You can access GHAS by clicking on the “Security” tab in your repository. Please keep an eye on this Security tab and respond to the security findings that appear here and in your Pull Requests (PRs). GHAS is essential to PayPal's Product Security program, ensuring we meet industry standards, regulatory mandates, and our commitment to customer security and trust.

Testing Instructions

• Monitoring actions logs.
• Make sure all scans successful and results shown.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)

See the Details below.

Scanned Files

• .github/workflows/security.code-scanning.yml
• .github/workflows/security.dependency-review.yml

[ansonipaypal]

Please fix the failing checks.

[yusharma-pp]

LGTM