|
9 | 9 | jobs: |
10 | 10 | security: |
11 | 11 | runs-on: ubuntu-latest |
| 12 | + |
12 | 13 | steps: |
13 | 14 | - uses: actions/checkout@v4 |
14 | | - |
15 | | - - name: Run Bandit security scan |
| 15 | + |
| 16 | + # Match your project target |
| 17 | + - name: Set up Python |
| 18 | + uses: actions/setup-python@v5 |
| 19 | + with: |
| 20 | + python-version: '3.10' |
| 21 | + |
| 22 | + - name: Install Poetry |
| 23 | + run: | |
| 24 | + pipx install poetry |
| 25 | + poetry --version |
| 26 | +
|
| 27 | + # (Optional) cache to speed up installs |
| 28 | + - name: Cache Poetry |
| 29 | + uses: actions/cache@v4 |
| 30 | + with: |
| 31 | + path: | |
| 32 | + ~/.cache/pypoetry |
| 33 | + ~/.local/share/pypoetry |
| 34 | + key: ${{ runner.os }}-poetry-${{ hashFiles('**/poetry.lock') }} |
| 35 | + restore-keys: ${{ runner.os }}-poetry- |
| 36 | + |
| 37 | + # Install your project + dev tools in the Poetry venv |
| 38 | + - name: Install dependencies with Poetry |
16 | 39 | run: | |
17 | | - pip install bandit |
18 | | - bandit -r min_ratio_cycle/ |
19 | | - |
20 | | - - name: Run Safety check |
| 40 | + poetry install --with dev --no-interaction --no-ansi |
| 41 | +
|
| 42 | + # Keep the venv's tooling up to date (reduces false positives) |
| 43 | + - name: Update security tooling in venv |
| 44 | + run: | |
| 45 | + poetry run python -m pip install --upgrade pip setuptools wheel |
| 46 | + poetry run python -m pip install --upgrade safety pip-audit |
| 47 | +
|
| 48 | + # Bandit scans your source tree |
| 49 | + - name: Bandit (security linter) |
21 | 50 | run: | |
22 | | - pip install safety |
23 | | - safety check |
24 | | - |
25 | | - - name: Dependency vulnerability scan |
26 | | - |
| 51 | + poetry run bandit -r min_ratio_cycle/ --severity-level medium --confidence-level high |
| 52 | +
|
| 53 | + # Safety scans the installed packages in the Poetry venv |
| 54 | + - name: Safety (scan installed env) |
| 55 | + run: | |
| 56 | + poetry run safety check --full-report |
| 57 | +
|
| 58 | + # pip-audit scans the installed packages in the Poetry venv |
| 59 | + # - name: pip-audit (strict) |
| 60 | + # run: | |
| 61 | + # poetry run pip-audit --strict |
0 commit comments