Skip to content

Commit 4817772

Browse files
initcroninitcron
committed
adding secops policies
1 parent c95a2bb commit 4817772

3 files changed

Lines changed: 206 additions & 3 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 110 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,10 +8,15 @@ env:
88
REGISTRY: docker.io
99
IMAGE_NAME: ${{ secrets.DOCKERHUB_USERNAME }}/tech-stack-advisor
1010

11+
permissions:
12+
contents: read
13+
security-events: write
14+
actions: read
15+
1116
jobs:
1217
build-and-test:
1318
runs-on: ubuntu-latest
14-
19+
1520
steps:
1621
- name: Checkout repository
1722
uses: actions/checkout@v4
@@ -30,7 +35,7 @@ jobs:
3035
run: python train.py
3136

3237
- name: Test application
33-
run: |
38+
run: |
3439
# Check if model files were created
3540
if [ -f "model.pkl" ] && [ -f "encoders.pkl" ]; then
3641
echo "✅ Model files created successfully"
@@ -50,7 +55,10 @@ jobs:
5055
docker-build:
5156
needs: build-and-test
5257
runs-on: ubuntu-latest
53-
58+
outputs:
59+
image-digest: ${{ steps.build.outputs.digest }}
60+
image-tags: ${{ steps.meta.outputs.tags }}
61+
5462
steps:
5563
- name: Checkout repository
5664
uses: actions/checkout@v4
@@ -82,6 +90,7 @@ jobs:
8290
8391
- name: Build and push multi-architecture image
8492
uses: docker/build-push-action@v6
93+
id: build
8594
with:
8695
context: .
8796
platforms: linux/amd64,linux/arm64
@@ -100,3 +109,101 @@ jobs:
100109
echo "| Platforms | linux/amd64, linux/arm64 |" >> $GITHUB_STEP_SUMMARY
101110
echo "| Tags | ${{ steps.meta.outputs.tags }} |" >> $GITHUB_STEP_SUMMARY
102111
echo "| Registry | Docker Hub |" >> $GITHUB_STEP_SUMMARY
112+
113+
security-scan:
114+
needs: docker-build
115+
runs-on: ubuntu-latest
116+
117+
steps:
118+
- name: Checkout repository
119+
uses: actions/checkout@v4
120+
121+
- name: Set up Trivy
122+
run: |
123+
sudo apt-get update
124+
sudo apt-get install wget apt-transport-https gnupg lsb-release
125+
wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo apt-key add -
126+
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
127+
sudo apt-get update
128+
sudo apt-get install trivy
129+
130+
- name: Log in to Docker Hub
131+
uses: docker/login-action@v3
132+
with:
133+
username: ${{ secrets.DOCKERHUB_USERNAME }}
134+
password: ${{ secrets.DOCKERHUB_TOKEN }}
135+
136+
- name: Run Trivy vulnerability scan
137+
run: |
138+
echo "🔍 Running Trivy vulnerability scan..."
139+
trivy image \
140+
--format sarif \
141+
--output trivy-results.sarif \
142+
${{ env.IMAGE_NAME }}:latest
143+
144+
- name: Run Trivy vulnerability scan (table format)
145+
run: |
146+
echo "🔍 Running Trivy scan for human-readable output..."
147+
trivy image \
148+
--format table \
149+
--output trivy-results.txt \
150+
${{ env.IMAGE_NAME }}:latest
151+
152+
- name: Generate SBOM with Trivy
153+
run: |
154+
echo "📋 Generating SBOM with Trivy..."
155+
trivy image \
156+
--format spdx-json \
157+
--output sbom.spdx.json \
158+
${{ env.IMAGE_NAME }}:latest
159+
160+
- name: Check for HIGH and CRITICAL vulnerabilities
161+
id: vuln-check
162+
run: |
163+
echo "🚨 Checking for HIGH/CRITICAL vulnerabilities..."
164+
165+
# Count HIGH and CRITICAL vulnerabilities
166+
HIGH_COUNT=$(trivy image --format json ${{ env.IMAGE_NAME }}:latest | jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length')
167+
CRITICAL_COUNT=$(trivy image --format json ${{ env.IMAGE_NAME }}:latest | jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length')
168+
169+
echo "high-count=$HIGH_COUNT" >> $GITHUB_OUTPUT
170+
echo "critical-count=$CRITICAL_COUNT" >> $GITHUB_OUTPUT
171+
172+
echo "Found $CRITICAL_COUNT CRITICAL and $HIGH_COUNT HIGH severity vulnerabilities"
173+
174+
# Display summary
175+
echo "## 🔒 Security Scan Results" >> $GITHUB_STEP_SUMMARY
176+
echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
177+
echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
178+
echo "| CRITICAL | $CRITICAL_COUNT |" >> $GITHUB_STEP_SUMMARY
179+
echo "| HIGH | $HIGH_COUNT |" >> $GITHUB_STEP_SUMMARY
180+
181+
- name: Security gate - Fail on CRITICAL vulnerabilities
182+
if: steps.vuln-check.outputs.critical-count > 5
183+
run: |
184+
echo "❌ SECURITY GATE FAILED: Found ${{ steps.vuln-check.outputs.critical-count }} CRITICAL vulnerabilities"
185+
echo "🚨 Build blocked due to critical security issues"
186+
exit 1
187+
188+
- name: Security gate - Warn on HIGH vulnerabilities
189+
if: steps.vuln-check.outputs.high-count > 5
190+
run: |
191+
echo "⚠️ WARNING: Found ${{ steps.vuln-check.outputs.high-count }} HIGH severity vulnerabilities"
192+
echo "💡 Consider reviewing and addressing these vulnerabilities"
193+
194+
- name: Upload security artifacts
195+
uses: actions/upload-artifact@v4
196+
if: always()
197+
with:
198+
name: security-reports
199+
path: |
200+
trivy-results.sarif
201+
trivy-results.txt
202+
sbom.spdx.json
203+
204+
- name: Upload SARIF results to GitHub Security
205+
uses: github/codeql-action/upload-sarif@v3
206+
if: always()
207+
with:
208+
sarif_file: trivy-results.sarif
209+
category: trivy

‎.trivyignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# .trivyignore
2+
# Trivy ignore file for known false positives or accepted risks
3+
4+
# Example: Ignore specific CVE that doesn't affect our use case
5+
# CVE-2023-12345
6+
7+
# Example: Ignore vulnerabilities in specific packages
8+
# pkg:pypi/package-name@version
9+
10+
# Note: Only ignore vulnerabilities after proper risk assessment
11+
@initcron
12+
Comment

‎SECURITY.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Security Policy
2+
3+
## Vulnerability Scanning
4+
5+
This project uses automated security scanning as part of our CI/CD pipeline to ensure container images are free from known vulnerabilities.
6+
7+
### Scanning Tools
8+
9+
- **Trivy**: Primary vulnerability scanner for container images
10+
- **SBOM Generation**: Software Bill of Materials for supply chain transparency
11+
- **GitHub Security**: Integration with GitHub's security features
12+
13+
### Security Gates
14+
15+
Our CI pipeline implements the following security gates:
16+
17+
| Severity | Action |
18+
|----------|--------|
19+
| CRITICAL | ❌ **Block deployment** - Build fails immediately |
20+
| HIGH | ⚠️ **Warning** - Logged but build continues if < 5 vulnerabilities |
21+
| MEDIUM/LOW | ✅ **Allow** - Logged for monitoring |
22+
23+
### Security Artifacts
24+
25+
Each build generates:
26+
27+
1. **SARIF Report** - Uploaded to GitHub Security tab
28+
2. **Human-readable Report** - Stored as build artifact
29+
3. **SBOM (SPDX)** - Software Bill of Materials
30+
4. **Vulnerability Database** - Updated regularly
31+
32+
### Customizing Security Thresholds
33+
34+
To modify security gates, update the CI workflow:
35+
36+
```yaml
37+
# Example: Block on 3+ HIGH vulnerabilities instead of 5
38+
- name: Security gate - Warn on HIGH vulnerabilities
39+
if: steps.vuln-check.outputs.high-count > 3
40+
```
41+
42+
### Vulnerability Management
43+
44+
1. **Critical/High Issues**: Must be addressed before deployment
45+
2. **Medium Issues**: Addressed in next sprint
46+
3. **Low Issues**: Monitored and addressed during maintenance windows
47+
48+
### Reporting Security Issues
49+
50+
If you discover a security vulnerability, please report it to:
51+
- Email: security@yourcompany.com
52+
- Create a private security advisory on GitHub
53+
54+
### Updates and Maintenance
55+
56+
- Vulnerability database updated daily
57+
- Security policies reviewed quarterly
58+
- SBOM generated for every release
59+
60+
## Supply Chain Security
61+
62+
### SBOM (Software Bill of Materials)
63+
64+
Every container image includes:
65+
- All installed packages and versions
66+
- Dependency relationships
67+
- License information
68+
- Source repositories
69+
70+
### Image Signing
71+
72+
Consider implementing image signing for production deployments:
73+
74+
```bash
75+
# Example with Cosign
76+
cosign sign --key cosign.key $IMAGE_TAG
77+
```
78+
79+
### Base Image Security
80+
81+
- Use minimal base images (python:3.11-slim)
82+
- Regular base image updates
83+
- Non-root container execution
84+
- Read-only root filesystem when possible

0 commit comments

Comments
 (0)