Video source upload UI part #4550
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security scan workflow | |
| # | |
| # This workflow performs security scanning using multiple tools to identify vulnerabilities, | |
| # secrets, configuration issues, and code quality problems across the entire codebase. | |
| # It also scans GitHub Actions workflows for potential security issues. | |
| # | |
| # Security Tools: | |
| # - Zizmor: GitHub Actions workflow security scanner | |
| # - Bandit: Python security linter | |
| # - Trivy: Vulnerability and misconfiguration scanner | |
| # - ZAP: Dynamic application security testing (DAST) tool | |
| # - Schemathesis: API fuzz testing tool | |
| name: "Security scan" | |
| on: | |
| pull_request: | |
| branches: | |
| - develop | |
| - release/** | |
| push: | |
| branches: | |
| - develop | |
| - "release/**" | |
| schedule: | |
| - cron: "0 4 * * *" # Run security checks every day at 4 AM UTC (after daily build) | |
| workflow_dispatch: | |
| permissions: {} # No permissions by default | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| zizmor-scan: | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| security-events: write # Needed to upload the results to code-scanning dashboard | |
| steps: | |
| - &checkout | |
| name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Run Zizmor scan | |
| uses: open-edge-platform/geti-ci/actions/zizmor@7e686c1248b3939f8ee8e04e2612da727e379d91 | |
| with: | |
| scan-scope: ${{ github.event_name == 'pull_request' && 'changed' || 'all' }} | |
| severity-level: ${{ github.event_name == 'pull_request' && 'MEDIUM' || 'LOW' }} | |
| confidence-level: "LOW" | |
| fail-on-findings: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} | |
| bandit-scan: | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| security-events: write # Needed to upload the results to code-scanning dashboard | |
| steps: | |
| - *checkout | |
| - name: Run Bandit scan | |
| uses: open-edge-platform/geti-ci/actions/bandit@7e686c1248b3939f8ee8e04e2612da727e379d91 | |
| with: | |
| scan-scope: ${{ github.event_name == 'pull_request' && 'changed' || 'all' }} | |
| severity-level: "LOW" | |
| confidence-level: "LOW" | |
| config_file: ".ci/ipas_default.config" | |
| fail-on-findings: ${{ github.event_name == 'pull_request' && 'true' || 'false' }} | |
| trivy-scan: | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| if: github.event_name != 'pull_request' | |
| permissions: | |
| contents: read | |
| security-events: write # Needed to upload the results to code-scanning dashboard | |
| steps: | |
| - *checkout | |
| - name: Run Trivy scan | |
| id: trivy | |
| uses: open-edge-platform/geti-ci/actions/trivy@7e686c1248b3939f8ee8e04e2612da727e379d91 | |
| with: | |
| scan_type: "fs" | |
| scan-scope: all | |
| severity: LOW | |
| scanners: "secret,config" | |
| format: "sarif" | |
| timeout: "15m" | |
| ignore_unfixed: "false" | |
| dast-scan: | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| ai-device: [cpu] | |
| steps: | |
| - name: Runner cleanup | |
| uses: open-edge-platform/geti-ci/actions/cleanup-runner@7e686c1248b3939f8ee8e04e2612da727e379d91 | |
| with: | |
| type: "initial" | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Pull container image for ${{ matrix.ai-device }} | |
| env: | |
| DEVICE: ${{ matrix.ai-device }} | |
| run: | | |
| IMAGE_NAME="ghcr.io/open-edge-platform/geti-${DEVICE}:develop" | |
| echo "Pulling image: $IMAGE_NAME" | |
| docker pull "$IMAGE_NAME" | |
| - name: Run the docker image | |
| id: run-image | |
| env: | |
| DEVICE: ${{ matrix.ai-device }} | |
| run: | | |
| CONTAINER_NAME="geti-${DEVICE}" | |
| IMAGE_NAME="ghcr.io/open-edge-platform/geti-${DEVICE}:develop" | |
| # Start the container in detached mode | |
| docker run -d \ | |
| --name "$CONTAINER_NAME" \ | |
| -p 7860:7860 \ | |
| "$IMAGE_NAME" | |
| TEST_URL="localhost:7860" | |
| # Wait for container to be ready (max 60 seconds) | |
| echo "Waiting for container to be ready..." | |
| HEALTH_OK=false | |
| for i in {1..12}; do | |
| if curl -sf $TEST_URL/health > /dev/null 2>&1; then | |
| echo "✅ Health check passed!" | |
| HEALTH_OK=true | |
| break | |
| fi | |
| echo "Attempt $i/12 - waiting 5 seconds..." | |
| sleep 5 | |
| done | |
| if [[ "$HEALTH_OK" != "true" ]]; then | |
| echo "❌ Health check failed after 60 seconds" | |
| exit 1 | |
| fi | |
| echo "CONTAINER_NAME=${CONTAINER_NAME}" >> $GITHUB_ENV | |
| - name: Run ZAP API Scan | |
| uses: zaproxy/action-api-scan@5158fe4d9d8fcc75ea204db81317cce7f9e5453d # v0.10.0 | |
| with: | |
| target: "http://localhost:7860/api/openapi.json" | |
| format: "openapi" | |
| cmd_options: "-a" | |
| allow_issue_writing: false | |
| fail_action: false | |
| artifact_name: zapapi | |
| - name: Run ZAP Full Scan | |
| uses: zaproxy/action-full-scan@3c58388149901b9a03b7718852c5ba889646c27c # v0.13.0 | |
| with: | |
| target: "http://localhost:7860" | |
| cmd_options: "-a -j" | |
| allow_issue_writing: false | |
| fail_action: false | |
| artifact_name: zapfull | |
| - name: Run Schemathesis Scan | |
| uses: schemathesis/action@806cace2053cbbac93188e1281ff7da415643160 # v3 | |
| continue-on-error: true | |
| with: | |
| schema: "http://localhost:7860/api/openapi.json" | |
| args: >- | |
| --continue-on-failure | |
| --report-dir schemathesis-report | |
| --report junit | |
| --report-junit-path schemathesis-report/junit.xml | |
| - name: Upload Schemathesis report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: always() | |
| with: | |
| name: schemathesis-report-${{ matrix.ai-device }} | |
| path: schemathesis-report/junit.xml | |
| - name: Re-check container health after testing | |
| if: always() | |
| run: | | |
| TEST_URL="localhost:7860" | |
| echo "Running post-scan health check..." | |
| if curl -sf $TEST_URL/health > /dev/null 2>&1; then | |
| echo "✅ Post-scan health check passed!" | |
| else | |
| echo "❌ Post-scan health check failed" | |
| echo "=== Container logs ===" | |
| docker logs "$CONTAINER_NAME" || true | |
| exit 1 | |
| fi | |
| - name: Save container logs to file | |
| if: always() | |
| run: | | |
| mkdir -p dast-scan-logs | |
| if [ -n "$CONTAINER_NAME" ]; then | |
| echo "Saving logs for container $CONTAINER_NAME" | |
| docker logs "$CONTAINER_NAME" > dast-scan-logs/container-$CONTAINER_NAME.log 2>&1 || true | |
| else | |
| echo "CONTAINER_NAME not set" > dast-scan-logs/container-lookup.log | |
| fi | |
| - name: Upload container logs | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: always() | |
| with: | |
| name: container-logs | |
| path: dast-scan-logs/ | |
| - name: Stop and Cleanup Container | |
| if: always() | |
| run: | | |
| if [ -n "${CONTAINER_NAME}" ]; then | |
| echo "Stopping container ${CONTAINER_NAME}..." | |
| docker stop "${CONTAINER_NAME}" || true | |
| fi | |
| trivy-image-scan: | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ${{ github.repository_owner == 'open-edge-platform' && 'overflow' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| strategy: | |
| matrix: | |
| ai-device: [cpu, cuda, xpu] | |
| steps: | |
| - name: Run container image scan (${{ matrix.ai-device }}) | |
| uses: open-edge-platform/geti-ci/actions/trivy@7e686c1248b3939f8ee8e04e2612da727e379d91 | |
| with: | |
| artifact-name: "trivy-scan-container-${{ matrix.ai-device }}" | |
| scan_type: "image" | |
| scan_target: "ghcr.io/open-edge-platform/geti-${{ matrix.ai-device }}:develop" | |
| scan-scope: all | |
| severity: "LOW" | |
| scanners: "vuln,secret,config" | |
| format: "table" | |
| timeout: "15m" | |
| ignore_unfixed: "true" |