qfer-preflight/.github/workflows/security.yml at main · ghzhost/qfer-preflight · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly, so a newly published advisory is caught without a commit.
    - cron: "17 6 * * 1"

permissions:
  contents: read

concurrency:
  group: security-${{ github.ref }}
  cancel-in-progress: true

jobs:
  secret-scan:
    name: Secret scan
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out the full history
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Install gitleaks
        env:
          GITLEAKS_VERSION: "8.30.1"
          GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
        run: |
          set -euo pipefail
          url="https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl -fsSL -o gitleaks.tar.gz "${url}"
          echo "${GITLEAKS_SHA256}  gitleaks.tar.gz" | sha256sum -c -
          tar -xzf gitleaks.tar.gz gitleaks
          chmod +x gitleaks

      - name: Scan the working tree and history
        run: ./gitleaks detect --source . --redact --no-banner --exit-code 1

  sast:
    name: Static analysis
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out the repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          enable-cache: true

      - name: Install the locked dependency set
        run: uv sync --locked

      - name: Run bandit over the package
        run: uv run bandit -q -c pyproject.toml -r src

  dependency-audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Check out the repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          enable-cache: true

      - name: Install the locked dependency set
        run: uv sync --locked

      - name: Audit the locked dependencies with pip-audit
        env:
          NO_COLOR: "1"
        run: |
          set -euo pipefail
          uv export --locked --no-emit-project --no-header --no-hashes \
            --no-annotate --format requirements-txt > requirements-audit.txt
          uv run pip-audit --strict -r requirements-audit.txt