ceqa-preflight/.github/workflows/security.yml at main · ghzhost/ceqa-preflight · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Security

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "17 4 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  application-security:
    name: Application security
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
        with:
          python-version: "3.12"
          enable-cache: true
      # --locked, not --frozen: see the note in ci.yml. A drifted lockfile must not audit green.
      - run: uv sync --all-groups --locked
      - run: make security audit
  secrets:
    name: Secret scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read # gitleaks-action lists the PR's commits
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      actions: read # codeql-action reads its own workflow-run metadata
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          languages: python
          build-mode: none
      # Code scanning is not enabled for this repository, so the SARIF-upload API would
      # hard-fail `analyze` with "Code scanning is not enabled for this repository".
      # Write the SARIF locally instead and gate on it ourselves: without the gate below,
      # nothing would make this job reflect its own findings.
      #
      # The repository is public, so code scanning can now be turned on at no cost. Doing
      # that is a deliberate follow-up, not a side effect of this file: the local gate
      # below fails the job on error-severity findings either way.
      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
        with:
          category: /language:python
          upload: never
          output: sarif-results
      - name: Fail on error-severity findings
        run: python3 scripts/codeql_gate.py sarif-results