scanner-detection

Security Scanner Detection

Overview

Detect which security scanners are relevant by examining repository artifacts, CI configurations, dependency manifests, and infrastructure files.

Detection Signals

Scanner	Definitive Markers	Supporting Signals
GHAS (CodeQL)	.github/workflows/*.yml with codeql-analysis action	.github/ directory + GitHub remote
GHAS (Secret Scanning)	GitHub remote (enabled by default on public repos)	.github/secret-scanning.yml
GHAS (Dependabot)	.github/dependabot.yml	GitHub remote
GHAS (Push Protection)	GitHub remote + Advanced Security license	Organization settings
SonarQube	sonar-project.properties, sonar-project.json	sonar-scanner in CI workflows
Snyk (Code)	.snyk file, snyk.json	Snyk badge in README
Snyk (Open Source)	package.json, requirements.txt, go.mod, pom.xml, *.csproj	Any dependency manifest
Snyk (IaC)	.tf files, cloudformation/*.yml, k8s/*.yml	Infrastructure directory present
Snyk (Container)	Dockerfile, docker-compose.yml	Container registry references
Wiz	Wiz config file, .wiz directory	Terraform files + cloud provider markers

Process

1. Scan for GitHub markers:

   • Check for .github/ directory and GitHub remote URL
   • If present → GHAS likely available
   • Check .github/workflows/ for CodeQL action references
   • Check for .github/dependabot.yml

2. Scan for scanner config files:

   • Use Glob to find sonar-project.properties, .snyk, snyk.json
   • Check CI workflow files for scanner invocations

3. Scan for dependency manifests:

   • package.json, requirements.txt, go.mod, pom.xml, *.csproj, Gemfile
   • If any found → Snyk Open Source applicable

4. Scan for infrastructure files:

   • .tf files → Snyk IaC and/or Wiz
   • Dockerfile → Snyk Container
   • CloudFormation, K8s manifests → Snyk IaC

5. Confidence scoring:

   • Definitive marker → high confidence
   • Supporting signal only → medium confidence
   • Inferred from file types → low confidence

Output

Return: [{ scanner: "<id>", features: ["<feature>"], confidence: "high|medium|low", signals: ["<what>"] }]

Sorted by confidence descending.