Merge pull request #87 from awslabs/fix/separate-release-workflows

fix: separate release workflows for clean responsibility separation

Author: fgogolli

.github/actions/setup-python-uv/action.yml

@@ -23,6 +23,7 @@ runs:
     - name: Install UV
       uses: astral-sh/setup-uv@v6
       with:
+        version: "0.9.6"
         enable-cache: true
         cache-dependency-glob: "pyproject.toml"
         cache-suffix: ${{ inputs.cache-key-suffix }}
@@ -38,6 +39,10 @@ runs:
       shell: bash
       run: make generate-pyproject
 
+    - name: Upgrade pip to secure version
+      shell: bash
+      run: python -m pip install --upgrade pip>=25.3
+
     - name: Install dependencies
       if: inputs.install-deps == 'true'
       shell: bash

.github/workflows/ci-quality.yml

@@ -22,6 +22,10 @@ on:
       - 'mypy.ini'
       - '.github/workflows/ci-quality.yml'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   AWS_DEFAULT_REGION: us-east-1
   AWS_ACCESS_KEY_ID: testing

.github/workflows/ci-tests.yml

@@ -22,6 +22,10 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   AWS_DEFAULT_REGION: us-east-1
   AWS_ACCESS_KEY_ID: testing

.github/workflows/container-build.yml

@@ -13,6 +13,8 @@ on:
       - 'deployment/docker/**'
       - 'dev-tools/scripts/container_build.sh'
       - '.github/workflows/container-build.yml'
+  release:
+    types: [published]
   pull_request:
     branches: [ main, develop ]
     paths:
@@ -22,10 +24,6 @@ on:
       - 'deployment/docker/**'
       - 'dev-tools/scripts/container_build.sh'
       - '.github/workflows/container-build.yml'
-  issue_comment:
-    types: [created]
-  release:
-    types: [published]
   workflow_dispatch:
     inputs:
       push_images:
@@ -34,6 +32,11 @@ on:
         default: false
         type: boolean
 
+permissions:
+  contents: read
+  packages: write
+  pull-requests: read
+
 jobs:
   config:
     name: Configuration

.github/workflows/sbom.yml

@@ -0,0 +1,49 @@
+name: Software Bill of Materials (SBOM)
+
+on:
+  release:
+    types: [published]
+  push:
+    branches: [main]
+    paths:
+      - 'pyproject.toml'
+      - 'requirements*.txt'
+      - 'uv.lock'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  config:
+    name: Configuration
+    uses: ./.github/workflows/shared-config.yml
+
+  generate-sbom:
+    name: Generate SBOM
+    runs-on: ubuntu-latest
+    needs: config
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6.0.1
+
+      - name: Setup Python and UV
+        uses: ./.github/actions/setup-python-uv
+        with:
+          python-version: ${{ needs.config.outputs.default-python-version }}
+
+      - name: Generate SBOM
+        run: |
+          source .venv/bin/activate
+          make sbom-generate
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-files
+          path: |
+            *.spdx.json
+            *.cyclonedx.json
+          retention-days: 30

.github/workflows/semantic-release.yml

@@ -28,7 +28,6 @@ permissions:
   pull-requests: read
   id-token: write
   packages: write
-  actions: write
 
 jobs:
   release:
@@ -48,10 +47,6 @@ jobs:
         with:
           python-version: '3.11'
 
-      - name: Get project configuration
-        id: config
-        uses: ./.github/actions/get-config
-
       - name: Install semantic-release
         run: |
           source .venv/bin/activate
@@ -60,8 +55,6 @@ jobs:
       - name: Run semantic release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          REGISTRY: ${{ steps.config.outputs.container-registry }}
-          IMAGE_NAME: ${{ steps.config.outputs.container-image }}
           RELEASE_MODE: ${{ inputs.mode || 'forward' }}
           RELEASE_COMMIT: ${{ inputs.commit }}
           RELEASE_VERSION: ${{ inputs.version }}
@@ -77,7 +70,7 @@ jobs:
             RELEASE_MODE=historical RELEASE_COMMIT=${{ inputs.commit }} RELEASE_VERSION=${{ inputs.version }} semantic-release version
           elif [ "${{ inputs.mode }}" = "analysis" ]; then
             echo "Running release analysis"
-            RELEASE_MODE=analysis ./dev-tools/release/orchestrator.sh
+            RELEASE_MODE=analysis ./dev-tools/release/analyze_rc_readiness.sh
           else
             echo "Running forward release with semantic-release"
             semantic-release version

.github/workflows/suggest-rc.yml

@@ -6,14 +6,22 @@ ARG PACKAGE_NAME_SHORT=orb
 
 FROM python:${PYTHON_VERSION}-slim
 
+# Update system packages to fix security vulnerabilities
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates=20250419 && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/*
+
 ARG PYTHON_VERSION=3.13
 ARG PACKAGE_NAME_SHORT=orb
 
 # Security: Update system packages and install security updates
 RUN apt-get update && \
     apt-get upgrade -y && \
     apt-get install -y --no-install-recommends \
-        ca-certificates && \
+        ca-certificates=20250419 && \
     apt-get clean && \
     rm -rf /var/lib/apt/lists/* && \
     # Security: Upgrade setuptools to latest version
@@ -42,7 +50,7 @@ ENV BUILD_DATE="${BUILD_DATE}" \
 
 # Install runtime dependencies and create user in single layer
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    ca-certificates \
+    ca-certificates=20250419 \
     && rm -rf /var/lib/apt/lists/* \
     && apt-get clean \
     && groupadd -r "${PACKAGE_NAME_SHORT:-orb}" \

Dockerfile

@@ -11,7 +11,7 @@
 logger = logging.getLogger(__name__)
 
 
-def detect_secrets(source_dir: str = "src") -> bool:
+def detect_credentials(source_dir: str = "src") -> bool:
     """Detect potential hardcoded secrets in Python files."""
 
     # Pattern to match potential secrets
@@ -36,39 +36,38 @@ def detect_secrets(source_dir: str = "src") -> bool:
         logger.error(f"Source directory '{source_dir}' not found")
         return False
 
-    found_secrets = []
+    found_issues = []
 
     for py_file in source_path.rglob("*.py"):
         try:
             with open(py_file, encoding="utf-8") as f:
                 content = f.read()
 
             for line_num, line in enumerate(content.split("\n"), 1):
-                matches = secret_pattern.findall(line)
-                for _match in matches:
+                # Check if line contains potential secrets without storing the match content
+                if secret_pattern.search(line):
                     # Check if this is an exception
                     if not any(exc in line for exc in exceptions):
-                        found_secrets.append(f"{py_file}:{line_num}: {line.strip()}")
+                        # Store only file path and line number to avoid retaining credential content
+                        found_issues.append((str(py_file), line_num))
 
         except Exception as e:
             logger.warning(f"Could not read {py_file}: {e}")
 
-    if found_secrets:
-        logger.error("Potential hardcoded secrets found:")
-        for secret in found_secrets:
-            # Security: Don't log the actual secret content, only the location
-            logger.error(
-                f"  Secret detected at: {secret.split(':')[0] if ':' in secret else 'unknown location'}"
-            )
+    if found_issues:
+        logger.error("Potential hardcoded credentials found:")
+        for file_path, line_number in found_issues:
+            # Security: Log only file and line number, never the actual credential content
+            logger.error(f"  Issue detected at: {file_path}:{line_number}")
         return False
     else:
-        logger.info("No hardcoded secrets detected")
+        logger.info("No hardcoded credentials detected")
         return True
 
 
 def main():
     """Main function."""
-    if not detect_secrets():
+    if not detect_credentials():
         sys.exit(1)
     sys.exit(0)
 

dev-tools/security/detect_secrets.py dev-tools/security/detect_credentials.pydev-tools/security/detect_secrets.py renamed to dev-tools/security/detect_credentials.py

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=61.0", "wheel"]
+requires = ["setuptools>=80.9.0", "wheel"]
 build-backend = "setuptools.build_meta"
 
 [project]