open-resource-broker/.github/workflows/security-code.yml at 93bbd791480e751d7da9e3749f135147ab0a6cac · awslabs/open-resource-broker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
name: Security Scanning

on:
  push:
    branches: [ main, develop ]
    paths:
      - 'src/**'
      - 'requirements*.txt'
      - 'pyproject.toml'
      - 'uv.lock'
      - '.github/workflows/security-code.yml'
  pull_request:
    branches: [ main, develop ]
    paths:
      - 'src/**'
      - 'requirements*.txt'
      - 'pyproject.toml'
      - 'uv.lock'
      - '.github/workflows/security-code.yml'
  schedule:
    - cron: '0 3 * * 0'

jobs:
  config:
    name: Configuration
    uses: ./.github/workflows/shared-config.yml

  security-bandit:
    name: Bandit (Security Scan)
    needs: config
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: ./.github/workflows/reusable-security.yml
    with:
      scan-type: bandit
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      python-version: ${{ needs.config.outputs.default-python-version }}

  security-safety:
    name: Safety (Dependency Scan)
    needs: config
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: ./.github/workflows/reusable-security.yml
    with:
      scan-type: safety
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      python-version: ${{ needs.config.outputs.default-python-version }}

  security-semgrep:
    name: Semgrep (Static Analysis)
    needs: config
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: ./.github/workflows/reusable-security.yml
    with:
      scan-type: semgrep
      default-python-version: ${{ needs.config.outputs.default-python-version }}

  security-trivy-fs:
    name: Trivy (Filesystem Scan)
    needs: config
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: ./.github/workflows/reusable-security.yml
    with:
      scan-type: trivy-fs
      default-python-version: ${{ needs.config.outputs.default-python-version }}

  security-trufflehog:
    name: TruffleHog (Secrets Scan)
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' || (github.event_name == 'push' && github.event.before != '0000000000000000000000000000000000000000')

    permissions:
      security-events: write
      actions: read
      contents: read

    steps:
    - name: Checkout code
      uses: actions/checkout@v6
      with:
        fetch-depth: 0

    - name: Check for secrets with TruffleHog
      uses: trufflesecurity/trufflehog@v3.94.3
      with:
        path: ./
        base: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before }}
        head: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.event.after }}
        extra_args: --debug --only-verified

  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'

    steps:
    - name: Checkout code
      uses: actions/checkout@v6

    - name: Dependency Review
      uses: actions/dependency-review-action@v4
      with:
        fail-on-severity: moderate
        allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Unlicense
        # werkzeug 3.1.6 reports compound SPDX 'BSD-3-Clause AND LicenseRef-scancode-unknown-license-reference'
        # due to upstream metadata issue — it is BSD-3-Clause, exempt it from license check
        allow-dependencies-licenses: 'pkg:pypi/werkzeug, pkg:githubactions/trufflesecurity/trufflehog'

  codeql-analysis:
    name: CodeQL Analysis
    needs: config
    if: github.event_name == 'schedule' || contains(github.event.head_commit.message, '[security]')
    permissions:
      contents: read
      actions: read
      security-events: write
    uses: ./.github/workflows/reusable-security.yml
    with:
      scan-type: codeql
      default-python-version: ${{ needs.config.outputs.default-python-version }}
      python-version: ${{ needs.config.outputs.default-python-version }}