From cec15d3928f39d528d9f44666d4c0de1e115afb5 Mon Sep 17 00:00:00 2001 From: RORO Date: Sun, 26 Jul 2026 11:48:42 +0200 Subject: [PATCH] Replace Trivy with OSV-Scanner, switch docs from pipx to uv - ci.yml and release.yml: drop Trivy steps, add osv-scan job using the google/osv-scanner-action reusable workflow (v2.3.8), gate build on it - release.yml: remove trivy JSON files from release assets - README.md: install and dev setup now use uv instead of pipx, security tools list now covers OSV-Scanner - SECURITY.md: dependency scanning now lists Safety and OSV-Scanner --- .github/workflows/ci.yml | 93 ++++------------------------------- .github/workflows/release.yml | 28 ++++------- README.md | 44 +++++++++-------- SECURITY.md | 2 +- 4 files changed, 43 insertions(+), 124 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4f78074..ac3c4f0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -75,28 +75,6 @@ jobs: pip install -e ".[dev]" pip install safety detect-secrets bandit - - name: Run Trivy filesystem scan - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: '.' - format: 'table' - - - name: Run Trivy filesystem scan (JSON report) - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: '.' - format: 'json' - output: 'trivy-fs-results.json' - - - name: Upload Trivy filesystem results - uses: actions/upload-artifact@v4 - if: always() - with: - name: trivy-fs-results - path: trivy-fs-results.json - - name: Run bandit security linter run: | bandit -r src/ -c pyproject.toml @@ -109,10 +87,18 @@ jobs: run: | detect-secrets scan --baseline .secrets.baseline + osv-scan: + name: OSV-Scanner Vulnerability Scan + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 + permissions: + actions: read + contents: read + security-events: write + build: name: Build Package runs-on: ubuntu-latest - needs: [test, security] + needs: [test, security, osv-scan] steps: - uses: actions/checkout@v4 @@ -131,70 +117,9 @@ jobs: run: | python -m build - - name: Run Trivy scan on built package - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: 'dist/' - format: 'table' - - - name: Run Trivy scan on built package (JSON report) - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: 'dist/' - format: 'json' - output: 'trivy-package-results.json' - - - name: Upload Trivy package results - uses: actions/upload-artifact@v4 - if: always() - with: - name: trivy-package-results - path: trivy-package-results.json - - name: Upload artifacts uses: actions/upload-artifact@v4 with: name: dist path: dist/ - # Container security scan job - uncomment when you add Docker support - # container-security: - # name: Container Security Scan - # runs-on: ubuntu-latest - # needs: [build] - # - # steps: - # - uses: actions/checkout@v4 - # - # - name: Build Docker image - # run: | - # docker build -t py_plate:latest . - # - # - name: Run Trivy container scan - # uses: aquasecurity/trivy-action@master - # with: - # image-ref: 'py_plate:latest' - # format: 'sarif' - # output: 'trivy-container-results.sarif' - # - # - name: Upload Trivy container scan results to GitHub Security tab - # uses: github/codeql-action/upload-sarif@v3 - # if: always() - # with: - # sarif_file: 'trivy-container-results.sarif' - # - # - name: Run Trivy container scan (JSON report) - # uses: aquasecurity/trivy-action@master - # with: - # image-ref: 'py_plate:latest' - # format: 'json' - # output: 'trivy-container-results.json' - # - # - name: Upload Trivy container results - # uses: actions/upload-artifact@v4 - # if: always() - # with: - # name: trivy-container-results - # path: trivy-container-results.json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 7d3f97b..d2a19fb 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -36,10 +36,18 @@ jobs: ruff format --check mypy src/ + osv-scan: + name: OSV-Scanner Vulnerability Scan + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 + permissions: + actions: read + contents: read + security-events: write + build: name: Build and publish runs-on: ubuntu-latest - needs: test + needs: [test, osv-scan] environment: name: release url: https://pypi.org/p/py_plate @@ -69,22 +77,6 @@ jobs: run: | pip install safety bandit detect-secrets - - name: Run Trivy filesystem scan - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: '.' - format: 'json' - output: 'trivy-fs-results.json' - - - name: Run Trivy package scan - uses: aquasecurity/trivy-action@master - with: - scan-type: 'fs' - scan-ref: 'dist/' - format: 'json' - output: 'trivy-package-results.json' - - name: Run bandit security scan run: | bandit -r src/ -f json -o bandit-results.json || true @@ -110,8 +102,6 @@ jobs: --draft=false \ --prerelease=false \ dist/* \ - trivy-fs-results.json \ - trivy-package-results.json \ bandit-results.json \ safety-results.json \ secrets-scan-results.json diff --git a/README.md b/README.md index 675cb56..4ebe158 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ A modern Python CLI template with best practices, featuring Typer, Ruff, pre-com - ๐Ÿ”ง **Development tools** with [Ruff](https://docs.astral.sh/ruff/) for linting and formatting - ๐Ÿ›ก๏ธ **Security** with pre-commit hooks and secret detection - ๐Ÿงช **Testing** with pytest and coverage reporting -- ๐Ÿ“ฆ **Easy installation** with pipx support +- ๐Ÿ“ฆ **Easy installation** with uv support - ๐ŸŽฏ **Type safety** with mypy - ๐Ÿ“‹ **Code quality** with comprehensive linting rules - ๐Ÿš€ **CI/CD** with GitHub Actions for testing, linting, and releases @@ -24,10 +24,10 @@ A modern Python CLI template with best practices, featuring Typer, Ruff, pre-com This template includes comprehensive security scanning tools that run automatically in CI/CD pipelines and can be used during development: -- **[Trivy](https://trivy.dev/)** - Vulnerability scanner for filesystems, containers, and packages +- **[OSV-Scanner](https://osv.dev/)** - Vulnerability scanner based on the OSV.dev database - Scans for known vulnerabilities in dependencies - - Generates detailed security reports in multiple formats - - Integrated into CI pipeline and release artifacts + - Uploads results to the GitHub Security tab via SARIF + - Integrated into CI pipeline and as a release gate - **[Bandit](https://bandit.readthedocs.io/)** - Security linter for Python code - Identifies common security issues in Python code @@ -46,35 +46,37 @@ This template includes comprehensive security scanning tools that run automatica All security tools generate JSON reports that are included as artifacts in GitHub releases, providing transparency and audit trails for security compliance. -## ๐Ÿš€ Quick Start with pipx +## ๐Ÿš€ Quick Start with uv -[pipx](https://pypa.github.io/pipx/) is the recommended way to install Python CLI applications. It installs packages in isolated environments while making their entry points available globally. +[uv](https://docs.astral.sh/uv/) is the recommended way to install Python CLI applications. Its `uv tool` command installs packages in isolated environments while making their entry points available globally. -### Install pipx (if not already installed) +### Install uv (if not already installed) ```bash -# On macOS -brew install pipx +# On macOS and Linux +curl -LsSf https://astral.sh/uv/install.sh | sh -# On Ubuntu/Debian -sudo apt update && sudo apt install pipx +# On macOS with Homebrew +brew install uv -# On other systems with pip -python3 -m pip install --user pipx -python3 -m pipx ensurepath +# On Windows +powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex" + +# With pip +pip install uv ``` ### Install the CLI ```bash # Install from PyPI (when published) -pipx install py-plate-template +uv tool install py-plate-template # Or install from local directory -pipx install . +uv tool install . # Or install in development mode -pipx install --editable . +uv tool install --editable . ``` ### Usage @@ -105,7 +107,7 @@ py-plate config --set debug true ### Prerequisites - Python 3.9 or higher -- pip or pipx +- uv (recommended) or pip ### Development Installation @@ -117,8 +119,10 @@ cd py_plate # Install in development mode with all dependencies pip install -e ".[dev]" -# Or use pipx for isolated development -pipx install --editable ".[dev]" +# Or use uv for isolated development +uv venv +source .venv/bin/activate +uv pip install -e ".[dev]" ``` ### Set up pre-commit hooks diff --git a/SECURITY.md b/SECURITY.md index eae08c3..60453b6 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -48,7 +48,7 @@ Please include the following information in your report: py_plate implements several security measures: -- **Dependency Scanning**: Automated vulnerability scanning of dependencies using Safety and Trivy +- **Dependency Scanning**: Automated vulnerability scanning of dependencies using Safety and OSV-Scanner - **Static Analysis**: Code security analysis using Bandit - **Secret Detection**: Automated detection of exposed secrets using detect-secrets - **Pre-commit Hooks**: Security checks run before each commit