GitHub Actions artifacts not part of the GitHub scanner

[karimelmel]

Description

The GitHub scanner does currently not download and scan artifacts for secrets. Secrets are oftentimes found in artifiacts, e.g. GitHub Actions workflows that stores Terraform output in state, even though variables are set to sensitive.

Preferred Solution

An opt-in --include-artifacts flag on the github subcommand, and a process to:

1. Enumerates GET /repos/{owner}/{repo}/actions/artifacts, skipping entries with expired: true.
2. Download each artifact zip via the /zip endpoint.
3. Feed the zip into the existing archive handler in pkg/handlers, that handles nested archives.
4. Deduplicate by artifact digest to ensure output are scanned once rather than once per run.
5. Add artifact ID, run ID, workflow name, and in-zip path to message Github in proto/source_metadata.proto, to make a finding traceable back to a specific run.

Additional Context

• Auth is mandatory even for public repos, the artifact download endpoint requires a token with actions:read.
• There's a default 90 days retention for artifacts, meaning all scans will be a point-in-time and not necessarily reproducible.

References

• https://unit42.paloaltonetworks.com/github-repo-artifacts-leak-tokens/