[javiergarciavera]

Summary

Adds a wiz-sensor composite action that starts the Wiz runner sensor as the first step of a job. It is the single shared step that all Consensys repos will reference by commit SHA (INFRA-4214, epic INFRA-4005 / SOCIR-12061). Same approach as INFRA-4094 in consensys-vertical-apps.

The action does nothing until the org variable WIZ_SENSOR_ENABLED is the string true and the org secret WIZ_SENSOR_TOKEN is set. Both will be created by TechOps. Merging this PR changes no behaviour on its own, because nothing calls the action yet.

Behaviour

• Starts the sensor only on Linux GitHub-hosted runners. Self-hosted, macOS and Windows runners are skipped with a log line.
• Never starts on pull_request_target.
• Skips with a log line (e.g. Skipped because WIZ_SENSOR_ENABLED is not true) when the variable is not true or the token is empty.
• Fail-open: a sensor failure never fails the job (continue-on-error).
• Off switch: set WIZ_SENSOR_ENABLED to false at org level, no workflow change needed.
• The Wiz action is pinned by commit SHA: wiz-sec-public/wiz-sensor-github-action@2f72488477988739561233bbc10ceff0c53273fd (current default branch head, 2026-09-30, verified).
• Parsed token fields (registry-username, registry-password, wiz-api-client-id, wiz-api-client-secret) are masked with ::add-mask:: before the Wiz action runs, because GitHub masks the whole JSON secret but not the fields parsed from it, and the Wiz action puts them on a docker run command line. The sensor does not start if masking fails.

Review notes

• The token must be single-line JSON. A pretty-printed token makes GitHub mask { and } and silently drops job outputs containing them. Documented in wiz-sensor/README.md.
• This repo's own workflows must not pass the token to a local-path action from pull-request workflows. No workflow in this repo uses the action.
• Differences from the cva version: also skips non-GitHub-hosted runners (runner.environment), skips pull_request_target, and fails closed when the token is not a JSON object.
• Gating logic checked exhaustively over event / OS / runner type / variable / token combinations: the skip step and the sensor steps are mutually exclusive in all of them.

Test plan

• With WIZ_SENSOR_ENABLED unset or false, a job using the action logs the skip line and passes.
• On a self-hosted or pull_request_target run, the action logs the skip line and passes.
• Pilot (INFRA-4214 Phase 3): repo-level WIZ_SENSOR_ENABLED=true on one private repo shows image pulled, signature verified, Wiz Sensor started successfully!, token masked, no registry password or client secret in logs, job passes.

Refs INFRA-4214

---

Note

Medium Risk
Introduces handling of org-level Wiz credentials and pre-masking of parsed secret fields; safeguards (gating, no pull_request_target, fail-open) limit blast radius but token misuse in workflows would still be sensitive.

Overview
Adds a new wiz-sensor composite action (plus README) so workflows can start the Wiz GitHub runner sensor as the first job step, gated by org variable WIZ_SENSOR_ENABLED and secret WIZ_SENSOR_TOKEN. Nothing in this repo calls it yet, so merge alone does not change CI behavior.

The action no-ops with a notice when the runner is not Linux/GitHub-hosted, the event is pull_request_target, enabled is not the string true, or the token is empty. When it runs, a Node step parses the single-line JSON token and registers registry/API credential fields with ::add-mask:: before invoking the pinned wiz-sec-public/wiz-sensor-github-action; the sensor step is skipped if masking fails. Both masking and the Wiz step use continue-on-error, so sensor problems never fail the job.

^{Reviewed by Cursor Bugbot for commit 5dbb215. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{Reviewed by Cursor Bugbot for commit 5dbb215. Configure here.}

[cursor]

Skip path can fail jobs

Low Severity

The skip step is the no-op path for Windows, macOS, and self-hosted runners, and it invokes bash without fail-open handling. On a Windows self-hosted runner where Git Bash is not on PATH, the runner cannot start that step and fails the calling job.

 

^{Reviewed by Cursor Bugbot for commit 5dbb215. Configure here.}