Skip to content

Commit 0ced866

Browse files
azvoleffazvoleff
committed
More security fixes
1 parent 4f404d8 commit 0ced866

File tree

7 files changed

+448
-14
lines changed

7 files changed

+448
-14
lines changed

‎.bandit‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Bandit configuration file
2+
[bandit]
3+
skips = []
4+
exclude_dirs = [
5+
"security-venv",
6+
".git",
7+
"__pycache__",
8+
"*.pyc",
9+
".pytest_cache"
10+
]
11+
12+
[bandit.severity_levels]
13+
low = ["B201", "B301", "B302", "B303", "B304", "B305", "B306", "B307", "B308", "B309", "B310", "B311", "B312", "B313", "B314", "B315", "B316", "B317", "B318", "B319", "B320", "B321", "B322", "B323", "B324", "B325", "B601", "B602", "B603", "B604", "B605", "B606", "B607", "B608", "B609", "B610", "B611", "B701", "B702", "B703"]
14+
medium = ["B101", "B102", "B103", "B104", "B105", "B106", "B107", "B108", "B110", "B112", "B113", "B201", "B501", "B502", "B503", "B504", "B505", "B506", "B507", "B601", "B602", "B603", "B604", "B605", "B606", "B607", "B608", "B609", "B610", "B611"]
15+
high = ["B102", "B103", "B108", "B110", "B112", "B201", "B301", "B302", "B303", "B304", "B305", "B306", "B307", "B308", "B309", "B310", "B311", "B312", "B313", "B314", "B315", "B316", "B317", "B318", "B319", "B320", "B321", "B322", "B323", "B324", "B325", "B501", "B502", "B503", "B504", "B505", "B506", "B507", "B601", "B602", "B603", "B604", "B605", "B606", "B607", "B608", "B609", "B610", "B611", "B701", "B702", "B703"]
16+
17+
[bandit.plugins]
18+
include = ["B101", "B102", "B103", "B104", "B105", "B106", "B107", "B108", "B110", "B112", "B113", "B201", "B301", "B302", "B303", "B304", "B305", "B306", "B307", "B308", "B309", "B310", "B311", "B312", "B313", "B314", "B315", "B316", "B317", "B318", "B319", "B320", "B321", "B322", "B323", "B324", "B325", "B501", "B502", "B503", "B504", "B505", "B506", "B507", "B601", "B602", "B603", "B604", "B605", "B606", "B607", "B608", "B609", "B610", "B611", "B701", "B702", "B703"]

‎.github/dependabot.yml‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
version: 2
2+
updates:
3+
# Python dependencies
4+
- package-ecosystem: "pip"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
day: "monday"
9+
time: "09:00"
10+
open-pull-requests-limit: 5
11+
reviewers:
12+
- "azvoleff"
13+
assignees:
14+
- "azvoleff"
15+
commit-message:
16+
prefix: "security"
17+
include: "scope"
18+
labels:
19+
- "dependencies"
20+
- "security"
21+
allow:
22+
- dependency-type: "all"
23+
# Group patch updates together
24+
groups:
25+
security-patches:
26+
patterns:
27+
- "*"
28+
update-types:
29+
- "patch"
30+
minor-updates:
31+
patterns:
32+
- "*"
33+
update-types:
34+
- "minor"
35+
# Automatically merge security patches
36+
auto-merge:
37+
dependency-type: "all"
38+
update-type: "security"
39+
40+
# GitHub Actions dependencies
41+
- package-ecosystem: "github-actions"
42+
directory: "/"
43+
schedule:
44+
interval: "weekly"
45+
day: "monday"
46+
time: "09:00"
47+
open-pull-requests-limit: 3
48+
reviewers:
49+
- "azvoleff"
50+
assignees:
51+
- "azvoleff"
52+
commit-message:
53+
prefix: "ci"
54+
include: "scope"
55+
labels:
56+
- "dependencies"
57+
- "github-actions"
58+
59+
# Docker dependencies (if Dockerfile is present)
60+
- package-ecosystem: "docker"
61+
directory: "/"
62+
schedule:
63+
interval: "weekly"
64+
day: "monday"
65+
time: "09:00"
66+
open-pull-requests-limit: 3
67+
reviewers:
68+
- "azvoleff"
69+
assignees:
70+
- "azvoleff"
71+
commit-message:
72+
prefix: "docker"
73+
include: "scope"
74+
labels:
75+
- "dependencies"
76+
- "docker"

‎.github/workflows/code-quality.yml‎

Lines changed: 32 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -55,19 +55,46 @@ jobs:
5555
with:
5656
python-version: "3.11"
5757

58-
- name: Install bandit
58+
- name: Install security tools
5959
run: |
6060
python -m pip install --upgrade pip
61-
pip install bandit[toml]
61+
pip install bandit[toml] safety
6262
6363
- name: Run bandit security check
6464
run: |
6565
bandit -r gefcore/ -f json -o bandit-report.json || true
6666
bandit -r gefcore/
6767
68-
- name: Upload bandit report
68+
- name: Run dependency vulnerability scan
69+
run: |
70+
safety scan -r requirements.txt --json --output vulnerability-report.json || true
71+
safety scan -r requirements.txt
72+
73+
- name: Upload security reports
6974
uses: actions/upload-artifact@v3
7075
if: always()
7176
with:
72-
name: bandit-security-report
73-
path: bandit-report.json
77+
name: security-reports
78+
path: |
79+
bandit-report.json
80+
vulnerability-report.json
81+
82+
dependency-check:
83+
runs-on: ubuntu-latest
84+
85+
steps:
86+
- uses: actions/checkout@v4
87+
88+
- name: Run Trivy vulnerability scanner
89+
uses: aquasecurity/trivy-action@master
90+
with:
91+
scan-type: 'fs'
92+
scan-ref: '.'
93+
format: 'sarif'
94+
output: 'trivy-results.sarif'
95+
96+
- name: Upload Trivy scan results to GitHub Security tab
97+
uses: github/codeql-action/upload-sarif@v2
98+
if: always()
99+
with:
100+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/security.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
name: Security Scan
2+
3+
on:
4+
schedule:
5+
# Run daily at 2 AM UTC
6+
- cron: '0 2 * * *'
7+
push:
8+
branches: [ main, master, develop ]
9+
pull_request:
10+
branches: [ main, master, develop ]
11+
workflow_dispatch: # Allow manual triggering
12+
13+
jobs:
14+
vulnerability-scan:
15+
runs-on: ubuntu-latest
16+
17+
permissions:
18+
security-events: write
19+
actions: read
20+
contents: read
21+
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
26+
- name: Set up Python
27+
uses: actions/setup-python@v4
28+
with:
29+
python-version: "3.11"
30+
31+
- name: Install dependencies
32+
run: |
33+
python -m pip install --upgrade pip
34+
pip install -r requirements.txt
35+
pip install safety bandit[toml]
36+
37+
- name: Run Safety dependency vulnerability scan
38+
run: |
39+
safety scan -r requirements.txt --json --output safety-report.json || true
40+
safety scan -r requirements.txt --short-report
41+
42+
- name: Run Bandit code security scan
43+
run: |
44+
bandit -r gefcore/ -f json -o bandit-report.json || true
45+
bandit -r gefcore/ --severity-level medium
46+
47+
- name: Run Trivy filesystem scan
48+
uses: aquasecurity/trivy-action@master
49+
with:
50+
scan-type: 'fs'
51+
scan-ref: '.'
52+
format: 'sarif'
53+
output: 'trivy-results.sarif'
54+
severity: 'CRITICAL,HIGH,MEDIUM'
55+
56+
- name: Upload Trivy scan results to GitHub Security tab
57+
uses: github/codeql-action/upload-sarif@v2
58+
if: always()
59+
with:
60+
sarif_file: 'trivy-results.sarif'
61+
62+
- name: Upload security scan artifacts
63+
uses: actions/upload-artifact@v3
64+
if: always()
65+
with:
66+
name: security-scan-reports
67+
path: |
68+
safety-report.json
69+
bandit-report.json
70+
trivy-results.sarif
71+
retention-days: 30
72+
73+
- name: Create security summary
74+
if: always()
75+
run: |
76+
echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY
77+
echo "" >> $GITHUB_STEP_SUMMARY
78+
79+
echo "### Safety (Dependency Vulnerabilities)" >> $GITHUB_STEP_SUMMARY
80+
if [ -f safety-report.json ]; then
81+
echo "✅ Safety scan completed - check artifacts for details" >> $GITHUB_STEP_SUMMARY
82+
else
83+
echo "❌ Safety scan failed" >> $GITHUB_STEP_SUMMARY
84+
fi
85+
echo "" >> $GITHUB_STEP_SUMMARY
86+
87+
echo "### Bandit (Code Security)" >> $GITHUB_STEP_SUMMARY
88+
if [ -f bandit-report.json ]; then
89+
echo "✅ Bandit scan completed - check artifacts for details" >> $GITHUB_STEP_SUMMARY
90+
else
91+
echo "❌ Bandit scan failed" >> $GITHUB_STEP_SUMMARY
92+
fi
93+
echo "" >> $GITHUB_STEP_SUMMARY
94+
95+
echo "### Trivy (Container/Filesystem Security)" >> $GITHUB_STEP_SUMMARY
96+
if [ -f trivy-results.sarif ]; then
97+
echo "✅ Trivy scan completed - results uploaded to Security tab" >> $GITHUB_STEP_SUMMARY
98+
else
99+
echo "❌ Trivy scan failed" >> $GITHUB_STEP_SUMMARY
100+
fi

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ var/
2323
*.egg-info/
2424
.installed.cfg
2525
*.egg
26+
security-venv
2627

2728
# PyInstaller
2829
# Usually these files are written by a python script from a template

‎README.md‎

Lines changed: 39 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,45 @@
1-
# GEF Environment
1+
# trends.earth Environment
22

3-
This project belongs to the GEF Project.
3+
This project belongs to the trends.earth project by Conservation International.
44

5-
This repo implements the Core Platform of the GEF Environment.
5+
This repository implements the Core Platform of the trends.earth Environment for running Google Earth Engine scripts.
66

7-
Check out the other parts of the GEF project:
7+
Check out the other parts of the trends.earth project:
88

9-
- The API [GEF API](https://github.com/Vizzuality/GEF-API)
10-
- The Command Line Interface. It allows to create and test custom scripts locally. It also can be used to publish the scripts to the GEF Environment [GEF CLI](https://github.com/Vizzuality/GEF-CLI)
11-
- A web app to explore and manage the API entities [GEF UI](https://github.com/Vizzuality/GEF-UI)
9+
- The API [trends.earth API](https://github.com/ConservationInternational/trends.earth-API)
1210

13-
## Getting started
11+
## Security
1412

15-
In progress...
13+
### Security Tools
14+
15+
Use the dependency manager script for security checks:
16+
17+
```bash
18+
# Check for vulnerabilities
19+
python scripts/dependency_manager.py --check-vulns
20+
21+
# Check for outdated packages
22+
python scripts/dependency_manager.py --check-outdated
23+
24+
# Run comprehensive security audit
25+
python scripts/dependency_manager.py --audit
26+
27+
# Run all security checks
28+
python scripts/dependency_manager.py --all
29+
```
30+
31+
### Manual Security Scanning
32+
33+
```bash
34+
# Install security tools
35+
pip install safety bandit[toml]
36+
37+
# Check dependencies for vulnerabilities
38+
safety scan -r requirements.txt
39+
40+
# Scan code for security issues
41+
bandit -r gefcore/
42+
43+
# Container security scan (requires Docker)
44+
docker run --rm -v $(pwd):/workspace aquasec/trivy fs /workspace
45+
```

0 commit comments

Comments
 (0)