TT-17509: Update s1-cns-scan.yml workflow references

[probelabs]

Problem / Task

Update s1-cns-scan.yml workflow references to use @production and policy_id.
Requested by U02SC7C53TQ in Slack thread: https://tyktech.slack.com/archives/C09C27R77TL/p1786000659351899

Changes

• Replaced tag input with policy_id: ${{ vars.S1_POLICY_ID }}
• Updated workflow reference to use @production tag

Testing

• Verified workflow syntax

Ticket Details

TT-17509

Status	In Dev
Summary	Run S1 vulnerability scanner on a schedule and disable it on PRs

Generated at: 2026-08-06 09:48:23

[netlify]

✅ Deploy Preview for nifty-johnson-6002dd ready!

Name	Link
🔨 Latest commit	ed1b05c
🔍 Latest deploy log	https://app.netlify.com/projects/nifty-johnson-6002dd/deploys/6a7458386d6f770009689ab5
😎 Deploy Preview	https://deploy-preview-420--nifty-johnson-6002dd.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[probelabs]

This PR updates the .github/workflows/nightly-security-scan.yml GitHub Actions workflow. The reusable s1-cns-scan.yml workflow reference is changed from a specific commit hash to the @production tag, ensuring the job always runs the latest stable version. Additionally, the configuration is updated to use policy_id (sourced from the S1_POLICY_ID repository variable) instead of the deprecated tag parameter for the SentinelOne CNS scan.

Files Changed Analysis

• .github/workflows/nightly-security-scan.yml: Modified (+2, -2)
  • The single file changed reflects a focused update to the CI/CD configuration for security scanning.

Architecture & Impact Assessment

• What this PR accomplishes: It standardizes the nightly security scan by aligning it with the production version of the shared s1-cns-scan.yml workflow and centralizes its configuration using a repository variable.
• Key technical changes introduced:
  1. The uses clause for the reusable workflow is updated from a commit SHA to the @production tag.
  2. The with block is modified to pass policy_id from vars.S1_POLICY_ID instead of a hardcoded tag.
• Affected system components: The change directly impacts the s1-scan job within the repository's CI/CD pipeline. This job is responsible for running nightly security vulnerability scans using SentinelOne.

graph TD
    A[nightly-security-scan.yml] -- triggers --> B(s1-scan job);
    B -- uses --> C(TykTechnologies/github-actions/.github/workflows/s1-cns-scan.yml@production);
    C -- with --> D["policy_id: ${{ vars.S1_POLICY_ID }}"];
    C -- secrets --> E["S1_API_TOKEN: ${{ secrets.S1_API_TOKEN }}"];

Loading

Scope Discovery & Context Expansion

• Broader Context: This change appears to be part of a wider effort to standardize CI/CD security practices across multiple repositories by adopting a centralized, version-managed reusable workflow (@production) and moving configuration from hardcoded values to repository-level variables.
• Further Exploration: A search for other workflow files (.github/workflows/*.yml) confirms that nightly-security-scan.yml is the only workflow in this repository that utilizes the s1-cns-scan.yml action. Therefore, the scope of this change is correctly confined to this single file.

Metadata

• Review Effort: 1 / 5
• Primary Label: chore

---

Powered by Visor from Probelabs

Last updated: 2026-08-06T09:49:29.612Z | Triggered by: pr_opened | Commit: ed1b05c

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/nightly-security-scan.yml:24	The reusable workflow is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This practice introduces a supply-chain risk. If the `production` tag in the `TykTechnologies/github-actions` repository is maliciously or accidentally moved to a different commit, this workflow will execute unintended code. This could lead to compromised builds, data exfiltration, or other security breaches within the CI/CD pipeline. 💡 Suggestion For maximum security and build reproducibility, pin the reusable workflow to a specific commit SHA. The previous version of this file correctly used a commit SHA (`78124512432a6f63372529cecbbbf58bf0411fa5`). If an update is intended, determine the full commit SHA that the `@production` tag points to and use that SHA directly.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Security Issues (1)

Severity	Location	Issue
🟡 Warning	.github/workflows/nightly-security-scan.yml:24	The reusable workflow is pinned to a mutable tag (`@production`) instead of an immutable commit SHA. This practice introduces a supply-chain risk. If the `production` tag in the `TykTechnologies/github-actions` repository is maliciously or accidentally moved to a different commit, this workflow will execute unintended code. This could lead to compromised builds, data exfiltration, or other security breaches within the CI/CD pipeline. 💡 Suggestion For maximum security and build reproducibility, pin the reusable workflow to a specific commit SHA. The previous version of this file correctly used a commit SHA (`78124512432a6f63372529cecbbbf58bf0411fa5`). If an update is intended, determine the full commit SHA that the `@production` tag points to and use that SHA directly.

\n\n \n\n

✅ Performance Check Passed

No performance issues found – changes LGTM.

\n\n

✅ Quality Check Passed

No quality issues found – changes LGTM.

---

Powered by Visor from Probelabs

Last updated: 2026-08-06T09:49:28.436Z | Triggered by: pr_opened | Commit: ed1b05c

💡 TIP: You can chat with Visor using /visor ask <your question>

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud