Security Scan #385
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| schedule: | |
| - cron: "0 3 * * 1" # every Monday at 03:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write # for CodeQL / SARIF upload | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| jobs: | |
| bandit-sast: | |
| name: Bandit SAST | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install Bandit | |
| run: pip install bandit[toml] | |
| - name: Run Bandit | |
| run: | | |
| bandit -r . \ | |
| --exclude .venv,tests,node_modules \ | |
| --severity-level medium \ | |
| --confidence-level medium \ | |
| --format json \ | |
| --output bandit-report.json || true | |
| - name: Upload Bandit report | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: bandit-report | |
| path: bandit-report.json | |
| - name: Fail on high severity issues | |
| run: | | |
| bandit -r . \ | |
| --exclude .venv,tests,node_modules \ | |
| --severity-level high \ | |
| --confidence-level high | |
| dependency-audit: | |
| name: Dependency Vulnerability Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install pip-audit | |
| run: pip install pip-audit | |
| - name: Run pip-audit | |
| run: | | |
| pip-audit \ | |
| --requirement requirements-ci.txt \ | |
| --format json \ | |
| --output pip-audit-report.json \ | |
| --skip-editable | |
| - name: Upload audit report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pip-audit-report | |
| path: pip-audit-report.json | |
| secret-scan: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Scan for leaked secrets (gitleaks) | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |