What the developer wrote
Authored by Valerio Vaccaro
ci: add security stage
What changed, and why it matters
This commit only adds automated security scanning steps to the project's continuous-integration (CI) pipeline. It does not change any firmware, application, or wallet code, and it does not fix a known vulnerability. It enables GitLab's built-in SAST, dependency-scanning, and secret-detection tools to run on future commits.
No security action required; this is a CI hardening change. Review the configured SAST/dependency/secret-detection exclusion lists periodically to ensure they do not hide real issues.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds a new ‘security’ stage to .gitlab-ci.yml and a new gitlab/security.yml file. It includes GitLab templates for SAST, Secret-Detection, and Dependency-Scanning, sets SECURE_LOG_LEVEL to ‘info’, and configures exclusion paths for each scanner. No source code, build logic, or cryptographic behavior is modified.
Changed components
.gitlab-ci.ymlgitlab/security.ymlInspect captured patch +30 / −0
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 314451b..369e187 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2,6 +2,7 @@ variables:
GIT_SUBMODULE_STRATEGY: recursive
GIT_DEPTH: 1
GIT_SUBMODULE_UPDATE_FLAGS: --jobs 4
+ SECURE_LOG_LEVEL: "info"
stages:
- pre_test
@@ -13,6 +14,7 @@ stages:
- release
- build_diy
- docker_build
+ - security
image: blockstream/jade_builder@sha256:5db8e13ca640e6b969d66139d708610c27d39a1c4d78ca096ee98f2b4c89130f
@@ -28,6 +30,10 @@ include:
- gitlab/release.yml
- gitlab/diy_fw.yml
- gitlab/docker.yml
+ - gitlab/security.yml
+ - template: Security/SAST.gitlab-ci.yml
+ - template: Security/Secret-Detection.gitlab-ci.yml
+ - template: Security/Dependency-Scanning.gitlab-ci.yml
#
# Jade FW build template
diff --git a/gitlab/security.yml b/gitlab/security.yml
new file mode 100644
index 0000000..025d10c
--- /dev/null
+++ b/gitlab/security.yml
@@ -0,0 +1,24 @@
+#
+# Security stage
+#
+# Perform gitlab security checks.
+#
+sast:
+ stage: security
+ needs: []
+ variables:
+ SAST_EXCLUDED_PATHS: "docs, test, tools, components, pinserver, release, requirements.txt, test_data, test_jade.py, jade_*.py, set_jade_pinserver.py, update_jade_fw.py"
+
+dependency_scanning:
+ stage: security
+ needs: []
+ variables:
+ DS_GRADLE_RESOLUTION_POLICY: "none"
+ DS_EXCLUDED_PATHS: "docs, test, tools, components, pinserver, release, requirements.txt, test_data, test_jade.py, jade_*.py, set_jade_pinserver.py, update_jade_fw.py"
+
+secret_detection:
+ stage: security
+ needs: []
+ variables:
+ SECRET_DETECTION_ENABLED: "true"
+ SECRET_DETECTION_EXCLUDED_PATHS: "docs, test, tools, components, pinserver, release, requirements.txt, test_data, test_jade.py, jade_*.py, set_jade_pinserver.py, update_jade_fw.py"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.