Skip to content

Commit ce87f52

Browse files
sarika-pf9sarika-pf9
committed
added security scanning
1 parent bc58e8b commit ce87f52

3 files changed

Lines changed: 219 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "pip"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"
7+
target-branch: "private/sarika/sast-scan"
8+
open-pull-requests-limit: 10
9+
reviewers:
10+
- "sarika-p9"
11+
labels:
12+
- "security"
13+
14+
- package-ecosystem: "gomod"
15+
directory: "/"
16+
schedule:
17+
interval: "daily"
18+
target-branch: "private/sarika/sast-scan"
19+
open-pull-requests-limit: 10
20+
reviewers:
21+
- "sarika-p9"
22+
labels:
23+
- "security"
24+
25+
- package-ecosystem: "github-actions"
26+
directory: "/.github/workflows"
27+
schedule:
28+
interval: "daily"
29+
target-branch: "private/sarika/sast-scan"
30+
open-pull-requests-limit: 5
31+
reviewers:
32+
- "sarika-p9"

‎.github/workflows/python-scan.yml‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: Python Security & Linting
2+
3+
on:
4+
push:
5+
branches: [ private/sarika/sast-scan ]
6+
pull_request:
7+
branches: [ private/sarika/sast-scan ]
8+
schedule:
9+
- cron: '0 0 * * 0' # Every Monday at 12 PM UTC
10+
11+
jobs:
12+
setup:
13+
name: Shared Setup
14+
runs-on: ubuntu-latest
15+
outputs:
16+
python-version: '3.10'
17+
steps:
18+
- name: Checkout Code
19+
uses: actions/checkout@v3
20+
21+
bandit_scan:
22+
name: Bandit Security Scan (Full)
23+
runs-on: ubuntu-latest
24+
outputs:
25+
bandit-high-found: ${{ steps.scan.outputs.bandit_high_found }}
26+
steps:
27+
- name: Checkout Code
28+
uses: actions/checkout@v3
29+
30+
- name: Set up Python
31+
uses: actions/setup-python@v4
32+
with:
33+
python-version: '3.10'
34+
35+
- name: Install Bandit
36+
run: pip install bandit jq
37+
38+
- name: Run Full Bandit Scan
39+
id: scan
40+
run: |
41+
echo "🚨 Running full Bandit scan..."
42+
mkdir -p tmp
43+
bandit -r . -f json -o tmp/bandit_output.json || true
44+
cat tmp/bandit_output.json || echo "{}"
45+
count=$(jq '.results | map(select(.issue_severity == "HIGH")) | length' tmp/bandit_output.json || echo 0)
46+
echo "bandit_high_found=$([[ $count -gt 0 ]] && echo true || echo false)" >> $GITHUB_OUTPUT
47+
48+
- name: Upload Bandit Report
49+
uses: actions/upload-artifact@v4
50+
with:
51+
name: bandit-json
52+
path: tmp/bandit_output.json
53+
54+
auto-pr:
55+
name: Create Pull Request if High Vulnerabilities Found
56+
needs: [bandit_scan]
57+
if: needs.bandit_scan.outputs.bandit-high-found == 'true'
58+
runs-on: ubuntu-latest
59+
permissions:
60+
contents: write
61+
pull-requests: write
62+
steps:
63+
- name: Checkout Code
64+
uses: actions/checkout@v3
65+
66+
- name: Download Bandit Report
67+
uses: actions/download-artifact@v4
68+
with:
69+
name: bandit-json
70+
path: tmp
71+
72+
- name: Generate PR Body with High Severity Bandit Results
73+
run: |
74+
echo "# 🚨 Bandit Full Scan Report" > tmp/pr-body.md
75+
if [[ -f tmp/bandit_output.json ]]; then
76+
jq -r '.results[]
77+
| select(.issue_severity == "HIGH")
78+
| "* File: \(.filename)\n • Line: \(.line_number)\n • Severity: \(.issue_severity)\n • Confidence: \(.issue_confidence)\n • Issue: \(.issue_text)\n"' tmp/bandit_output.json >> tmp/pr-body.md
79+
else
80+
echo "❌ Bandit report not found or scan failed." >> tmp/pr-body.md
81+
fi
82+
83+
- name: Commit Bandit Alert Log (Optional)
84+
run: |
85+
jq -r '.results[]
86+
| select(.issue_severity == "HIGH")
87+
| "* File: \(.filename)\n • Line: \(.line_number)\n • Severity: \(.issue_severity)\n • Confidence: \(.issue_confidence)\n • Issue: \(.issue_text)\n"' tmp/bandit_output.json > .bandit-alert.log || true
88+
git config user.name github-actions
89+
git config user.email github-actions@github.com
90+
git add -f .bandit-alert.log || true
91+
git commit -m "chore: bandit security alert log" || true
92+
93+
- name: Create Pull Request
94+
uses: peter-evans/create-pull-request@v5
95+
with:
96+
commit-message: "chore: issues detected by Bandit (all severities)"
97+
title: "chore: auto PR for Bandit scan"
98+
body-path: tmp/pr-body.md
99+
branch: "auto/bandit-security-scan"
100+
base: "master"
101+
delete-branch: true
102+
103+
semgrep_scan:
104+
name: Semgrep SAST Scan
105+
runs-on: ubuntu-latest
106+
steps:
107+
- name: Checkout Code
108+
uses: actions/checkout@v3
109+
110+
- name: Run Semgrep (default rules)
111+
uses: returntocorp/semgrep-action@v1
112+
with:
113+
config: "p/ci"
114+
115+
codeql_scan:
116+
name: CodeQL Static Analysis
117+
runs-on: ubuntu-latest
118+
permissions:
119+
actions: read
120+
contents: read
121+
security-events: write
122+
steps:
123+
- name: Checkout Code
124+
uses: actions/checkout@v3
125+
126+
- name: Initialize CodeQL
127+
uses: github/codeql-action/init@v2
128+
with:
129+
languages: python
130+
131+
- name: Autobuild
132+
uses: github/codeql-action/autobuild@v2
133+
134+
- name: Perform CodeQL Analysis
135+
uses: github/codeql-action/analyze@v2
136+
137+
ruff_lint:
138+
name: Ruff Major Lint Check
139+
runs-on: ubuntu-latest
140+
steps:
141+
- name: Checkout Code
142+
uses: actions/checkout@v3
143+
144+
- name: Set up Python
145+
uses: actions/setup-python@v4
146+
with:
147+
python-version: '3.10'
148+
149+
- name: Install Ruff
150+
run: pip install ruff
151+
152+
- name: Run Ruff Check (E, F, I)
153+
run: |
154+
echo "🧹 Running Ruff for major lint issues..."
155+
ruff check . --select E,F,I --exit-zero > ruff_output.txt
156+
cat ruff_output.txt

‎.github/workflows/trivy-scan.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Trivy Security Scan
2+
3+
on:
4+
push:
5+
branches: [ private/sarika/sast-scan ]
6+
pull_request:
7+
branches: [ private/sarika/sast-scan ]
8+
schedule:
9+
- cron: '0 0 * * 0' # Runs every Sunday at midnight UTC (weekly)
10+
11+
jobs:
12+
security_scan:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout Code
16+
uses: actions/checkout@v3
17+
18+
- name: Install Trivy
19+
run: |
20+
sudo apt update
21+
sudo apt install wget -y
22+
wget -O- https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo tee /etc/apt/trusted.gpg.d/trivy.asc
23+
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
24+
sudo apt update
25+
sudo apt install -y trivy
26+
27+
- name: Scan Code Dependencies
28+
run: trivy fs --scanners vuln,config .
29+
30+
# - name: Scan Docker Image (optional)
31+
# run: trivy image your-docker-image:latest || true

0 commit comments

Comments
 (0)