feat(skill): make aso_skill a real, tested, installable Python package #48
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| # Runs on every PR to dev/main and on pushes to those branches. | |
| # Plus a weekly scheduled scan. | |
| on: | |
| pull_request: | |
| branches: [dev, main] | |
| push: | |
| branches: [dev, main] | |
| schedule: | |
| - cron: '0 0 * * 1' # Mondays at 00:00 UTC | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| pull-requests: read | |
| concurrency: | |
| group: security-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: python | |
| queries: security-extended,security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: '/language:python' | |
| secret-scanning: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Full history for comprehensive scanning | |
| - name: TruffleHog secret scan | |
| uses: trufflesecurity/trufflehog@v3.82.6 | |
| with: | |
| path: ./ | |
| base: ${{ github.event.repository.default_branch }} | |
| head: HEAD | |
| extra_args: --only-verified | |
| - name: Heuristic credential pattern check | |
| run: | | |
| set -u | |
| echo "Checking for common credential patterns..." | |
| # Allowed mentions (placeholders / env-var references / approved env names) | |
| ALLOW='(PLACEHOLDER|YOUR_API_KEY|YOUR_TOKEN|CLAUDE_CODE_OAUTH_TOKEN|CLAUDE_API_KEY|GITHUB_TOKEN|secrets\.|os\.environ|getenv|getEnv)' | |
| FOUND_KEYS=$(grep -rIE "(api[_-]?key|apikey|api[_-]?secret)" \ | |
| --include="*.py" --include="*.yml" --include="*.yaml" \ | |
| app-store-optimization/ .github/ scripts/ 2>/dev/null \ | |
| | grep -vE "^[^:]+:[[:space:]]*#" \ | |
| | grep -vE "$ALLOW" || true) | |
| FOUND_TOKENS=$(grep -rIE "(token|bearer|oauth)" \ | |
| --include="*.py" --include="*.yml" --include="*.yaml" \ | |
| app-store-optimization/ .github/ scripts/ 2>/dev/null \ | |
| | grep -vE "^[^:]+:[[:space:]]*#" \ | |
| | grep -vE "$ALLOW" || true) | |
| if [ -n "$FOUND_KEYS" ]; then | |
| echo "WARNING: potential API key references found (review manually):" | |
| echo "$FOUND_KEYS" | |
| fi | |
| if [ -n "$FOUND_TOKENS" ]; then | |
| echo "WARNING: potential token references found (review manually):" | |
| echo "$FOUND_TOKENS" | |
| fi | |
| echo "Heuristic scan completed." | |
| dependency-security: | |
| name: Dependency Security Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.13' | |
| - name: Install pip-audit | |
| if: hashFiles('requirements.txt') != '' | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install 'pip-audit==2.7.3' | |
| - name: Audit requirements.txt | |
| if: hashFiles('requirements.txt') != '' | |
| run: pip-audit --requirement requirements.txt --strict | |
| - name: No runtime dependencies notice | |
| if: hashFiles('requirements.txt') == '' | |
| run: echo "No requirements.txt present; ASO skill is stdlib-only and has no runtime dependencies to audit." | |
| - name: Validate no external runtime dependencies | |
| run: | | |
| set -u | |
| echo "Validating ASO skill uses only Python standard library..." | |
| STD='^(import |from )(typing|re|collections|json|urllib|datetime|random|math|statistics|os|sys|pathlib|hashlib|functools|itertools|dataclasses|enum|copy|time|argparse|logging|tempfile|subprocess|shutil|contextlib|warnings|csv|html|http|io|inspect)( |\.|$)' | |
| EXTERNAL=$(grep -rhE "^(import |from )" app-store-optimization/ \ | |
| --include="*.py" 2>/dev/null \ | |
| | grep -vE "$STD" \ | |
| | grep -vE "^from \." || true) | |
| if [ -n "$EXTERNAL" ]; then | |
| echo "WARNING: potential external runtime imports detected:" | |
| echo "$EXTERNAL" | |
| echo | |
| echo "The ASO skill is stdlib-only. If these are valid stdlib imports," | |
| echo "add them to the allowlist in .github/workflows/security.yml." | |
| else | |
| echo "No external runtime dependencies detected." | |
| fi | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql-analysis, secret-scanning, dependency-security] | |
| if: always() | |
| steps: | |
| - name: Aggregate results | |
| env: | |
| CODEQL: ${{ needs.codeql-analysis.result }} | |
| SECRETS: ${{ needs.secret-scanning.result }} | |
| DEPS: ${{ needs.dependency-security.result }} | |
| run: | | |
| echo "CodeQL: $CODEQL" | |
| echo "Secret scanning: $SECRETS" | |
| echo "Dependency audit: $DEPS" | |
| if [ "$CODEQL" = success ] && [ "$SECRETS" = success ] && [ "$DEPS" = success ]; then | |
| echo "All security checks passed." | |
| exit 0 | |
| fi | |
| echo "One or more security checks failed." | |
| exit 1 |