Security Pipeline #558
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Security Pipeline | |
| on: | |
| push: | |
| branches: [main, develop, security-scans] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| env: | |
| PYTHON_VERSION: "3.11" | |
| jobs: | |
| security-scan: | |
| name: Security Scanning | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install -r requirements-dev.txt | |
| - name: Create security reports directory | |
| run: mkdir -p security-reports | |
| - name: Dependency vulnerability scan (pip-audit) | |
| run: | | |
| pip install pip-audit | |
| pip-audit --format json \ | |
| --output security-reports/dependency-audit.json | |
| - name: Secret detection | |
| run: | | |
| pip install detect-secrets | |
| if [ ! -f .secrets.baseline ]; then | |
| detect-secrets scan --all-files > .secrets.baseline | |
| fi | |
| detect-secrets scan --all-files > \ | |
| security-reports/secrets-scan.json || true | |
| echo "Secret detection completed" | |
| - name: Static code analysis (bandit) | |
| run: | | |
| pip install bandit[toml] | |
| # Skip B104 (0.0.0.0 binding - expected for proxy server) | |
| bandit -r src/ -ll --skip B104 -f json \ | |
| -o security-reports/bandit-results.json | |
| - name: Advanced static analysis (semgrep) | |
| run: | | |
| pip install semgrep | |
| semgrep --config p/python --config p/security-audit \ | |
| --exclude tests/ --exclude src/interceptors/live_trace/frontend/ \ | |
| --json -o security-reports/semgrep-results.json src/ || true | |
| - name: Generate security summary | |
| if: always() | |
| run: | | |
| echo "# Security Scan Summary" > security-reports/SUMMARY.md | |
| echo "Generated: $(date -u)" >> security-reports/SUMMARY.md | |
| echo "Commit: ${{ github.sha }}" >> security-reports/SUMMARY.md | |
| echo "" >> security-reports/SUMMARY.md | |
| echo "## Report Files" >> security-reports/SUMMARY.md | |
| ls -la security-reports/ | grep -v "^total" | grep -v "^d" | \ | |
| awk '{print "- " $9}' >> security-reports/SUMMARY.md | |
| cat security-reports/SUMMARY.md | |
| - name: Upload security reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-reports-${{ github.sha }} | |
| path: security-reports/ | |
| retention-days: 90 |