Announcing third-party code scanning tools: infrastructure as code and container scanning

Code Scanning Extends Beyond Static Analysis

With code scanning now generally available, GitHub is widening the range of third-party security tools that can plug into the platform. The latest additions focus on two areas: container image scanning and configuration auditing for infrastructure as code. These build on GitHub's earlier integrations with static analysis and developer security training providers, all of which feed results into the native code scanning experience via GitHub Actions or GitHub Apps.

The common thread is SARIF (Static Analysis Results Interchange Format), which lets external tools report findings in a format GitHub code scanning can ingest. By adding support for tools that inspect build artifacts and cloud configuration templates, GitHub is attempting to cover more of the software development lifecycle within a single interface. Teams can coordinate static analysis during development, dependency checks via Dependabot, container scanning on build artifacts, and configuration validation before cloud deployment. For teams practicing DevSecOps and shifting security left, these integrations aim to make security review a routine part of engineering workflows rather than a separate phase.

All the new integrations are available through the GitHub Marketplace, or from the Advanced Security tab where pre-configured workflows and GitHub Apps can be set up directly in the code scanning UI.

Infrastructure as Code and API Testing Integrations

42Crunch

The REST API Static Security Testing Action plugs a SAST (static application security testing) step into CI/CD workflows and pull request checks. It runs against OpenAPI files and flags quality and security issues when a workflow executes after a push. The checks are powered by 42Crunch's API Contract Security Audit engine, which applies over 200 tests covering best practices and potential weaknesses in how an API definition handles authentication, authorization, transport, and data validation.

Accurics

Accurics positions its platform as a way to reduce cloud attack surface by detecting and fixing risks in infrastructure-as-code definitions before resources are provisioned. It also monitors runtime infrastructure to catch risks introduced by configuration changes. The platform is offered in both free and commercial tiers.

Bridgecrew

Bridgecrew provides cloud security scanning across both build time and runtime. It detects misconfigurations in Terraform, CloudFormation, and Serverless Framework templates before deployment, and supports AWS, Kubernetes, Azure, and Google Cloud environments at runtime. Its integrations with version control systems and CI/CD pipelines are designed to push cloud security earlier into the development cycle, aiming to make the process accessible to teams of any size.

Snyk Infrastructure as Code

Snyk's offering is part of a broader security platform that covers open source dependencies, containers, and infrastructure as code. The solution addresses vulnerabilities and license violations across these areas, drawing on a proprietary vulnerability database maintained by Snyk's research team. Its integrations with source control, CI/CD, and existing workflows are intended to shorten time-to-fix for security findings.

Container Scanning Integrations

Aqua Security Trivy

Aqua Security brings Trivy, an open source container image scanner, into the GitHub Actions ecosystem. Trivy is part of a larger set of Aqua open source tools that includes Kube-Bench for CIS Kubernetes Benchmark checks and Kube-Hunter for Kubernetes penetration testing. Aqua's commercial cloud native security platform spans prevention, detection, and response across the build phase, cloud infrastructure, and running workloads.

Anchore

Anchore Enterprise is a container security workflow tool built for professional teams, with support for large-scale deployments in both air-gapped and public cloud environments. It offers a UI for security teams to audit and verify compliance, and is based on Anchore Engine, an open source project that performs deep image inspection and vulnerability scanning. The integration is designed to let teams enforce industry security standards without sacrificing pace.

Snyk Container

Snyk Container applies Snyk's vulnerability scanning to container images, leveraging the same database and workflow integrations as the company's infrastructure-as-code tooling. The goal is to find and fix container vulnerabilities as part of normal development workflows.