{"slug": "github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free", "title": "GitHub put Shell, Dockerfiles, Terraform and PHP behind a paywall. Here's a free Action that scans them.", "summary": "A developer created a free GitHub Action that runs ShellCheck, Hadolint, tfsec, and PHPStan on repositories and uploads the results as SARIF to GitHub's Security tab, bypassing the paywall for GitHub's AI-powered security detections on Shell, Dockerfiles, Terraform, and PHP. The action merges findings into a single SARIF document and posts a grouped PR comment, providing free coverage for ecosystems that CodeQL's free tier does not analyze.", "body_md": "On [July 14, 2026](https://github.blog/changelog/2026-07-14-code-scanning-shows-ai-security-detections-on-pull-requests/) GitHub shipped AI security detections on pull requests. The changelog is one sentence long, and the important part is the qualifier: the feature is available *\"for customers with GitHub Code Security (GitHub Advanced Security)\"*.\n\nThe changelog doesn't say which ecosystems it covers. The [companion post](https://github.blog/security/application-security/github-expands-application-security-coverage-with-ai-powered-detections/) does, verbatim:\n\necosystems newly supported through AI-powered detections, including\n\nShell/Bash, Dockerfiles, Terraform configurations (HCL), and PHP\n\nThose four have something in common: **CodeQL's free tier doesn't analyze any of them.** CodeQL covers C/C++, C#, Go, Java/Kotlin, JavaScript/TypeScript, Python, Ruby, Rust and Swift. If your repo is a pile of deploy scripts, a Dockerfile and some Terraform — which describes a lot of infrastructure repos — free code scanning has been giving you nothing, and the thing that would cover you is now a paid SKU.\n\nThe scanners for those four ecosystems already exist, are mature, and are free. What was missing is the part GHAS actually sells: unified reporting, SARIF in the Security tab, and a PR comment that tells you what changed. So I wired it up.\n\n```\n- uses: Booyaka101/ghas-free-pack@v1\n  with:\n    github-token: ${{ github.token }}\n```\n\nThat runs **ShellCheck** over `.sh`\n\n/`.bash`\n\n, **Hadolint** over `Dockerfile*`\n\n, **tfsec** over `.tf`\n\n, and **PHPStan** over `.php`\n\n— then merges every finding into one SARIF 2.1.0 document, uploads it to code scanning, and posts a grouped PR comment with rule links.\n\nFindings land in the Security tab exactly like CodeQL's do, because SARIF is SARIF.\n\nFrom the fixtures in the repo's own test suite, all real findings from the real scanners:\n\n`SC2163`\n\n— `export $INPUT`\n\nexports the `DL3002`\n\n— last `USER`\n\nis root. Your container runs privileged.`aws-ec2-no-public-ingress-sgr`\n\n— `0.0.0.0/0`\n\ningress.`enable-phpstan: true`\n\n). Most PHP projects need a tuned `phpstan.neon`\n\n, and turning it on by default would bury you in noise on day one.`security-events: write`\n\n`pull-requests: write`\n\n. Without those it still runs and still writes a job summary, it just can't publish. Grant them explicitly:\n\n```\npermissions:\n  contents: read\n  security-events: write\n  pull-requests: write\n```\n\nI don't expect anyone to take a security tool's word for it, so the repo ships the harness I used: `test/run-local.ps1`\n\nbuilds the image, runs it against `test/fixtures`\n\nwith a mocked GitHub API, and asserts 17 acceptance criteria — including that the merged SARIF validates against the SARIF 2.1.0 schema with ajv, that the PR comment contains the expected rules, and that a re-run PATCHes the existing comment in place instead of posting a second one.\n\nOne thing that cost me time and is worth writing down: the OASIS `sarif-spec`\n\nraw URL for the 2.1.0 schema (`master/Schemata/sarif-schema-2.1.0.json`\n\n) is **404** — the repo was restructured. The working copy is `https://json.schemastore.org/sarif-2.1.0.json`\n\n, which declares draft-07 and validates fine with ajv 8 given `strict: false`\n\n.\n\nMIT. Repo: [https://github.com/Booyaka101/ghas-free-pack](https://github.com/Booyaka101/ghas-free-pack)", "url": "https://wpnews.pro/news/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free", "canonical_source": "https://dev.to/booyaka101/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-heres-a-free-action-that-scans-46m8", "published_at": "2026-07-27 11:20:28+00:00", "updated_at": "2026-07-27 11:34:05.896054+00:00", "lang": "en", "topics": ["developer-tools", "ai-products"], "entities": ["GitHub", "CodeQL", "ShellCheck", "Hadolint", "tfsec", "PHPStan", "Booyaka101"], "alternates": {"html": "https://wpnews.pro/news/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free", "markdown": "https://wpnews.pro/news/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free.md", "text": "https://wpnews.pro/news/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free.txt", "jsonld": "https://wpnews.pro/news/github-put-shell-dockerfiles-terraform-and-php-behind-a-paywall-here-s-a-free.jsonld"}}