Skip to content

Commit c480983

Browse files
saikiransayabugarisaikiransayabugari
authored
[SMART NVR WORKFLOWS]Adding new workflow file for SMART-NVR (open-edge-platform#541)
1 parent 442cb14 commit c480983

File tree

1 file changed

+243
-0
lines changed

1 file changed

+243
-0
lines changed

‎.github/workflows/metro-ai-suite-smart-nvr.yaml‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
# SPDX-FileCopyrightText: (C) 2025 Intel Corporation
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
name: "[Smart NVR] SDLe Scans"
6+
run-name: "[Smart NVR] PR workflow (by @${{ github.actor }} via ${{ github.event_name }})"
7+
8+
9+
# Only run at most 1 workflow concurrently per PR, unlimited for branches
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.event.pull_request.number || github.sha }}
12+
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
13+
14+
on:
15+
pull_request:
16+
branches:
17+
- main
18+
paths:
19+
- 'metro-ai-suite/smart-nvr/**'
20+
21+
jobs:
22+
23+
trivy-scan:
24+
runs-on: ubuntu-latest
25+
permissions:
26+
contents: read
27+
steps:
28+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
29+
with:
30+
persist-credentials: false
31+
- name: Run Trivy Filesystem Scan
32+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
33+
id: trivy-fs
34+
with:
35+
scan_type: "fs"
36+
scan-scope: "all"
37+
severity: "HIGH,CRITICAL"
38+
format: "json"
39+
scan_target: "metro-ai-suite/smart-nvr/"
40+
report_suffix: "-CT7"
41+
42+
- name: Build Docker images
43+
run: |
44+
cd metro-ai-suite/smart-nvr/
45+
docker build -t nvr-event-router:latest -f docker/Dockerfile .
46+
47+
- name: Run trivy Scan - nvr-event-router
48+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
49+
id: nvr-event-router
50+
with:
51+
scan_type: "image"
52+
scan-scope: all
53+
scan_target: "nvr-event-router:latest"
54+
severity: "HIGH,CRITICAL"
55+
format: "json"
56+
report_suffix: "-CT248"
57+
58+
- name: Scan Dockerfile with Trivy
59+
uses: open-edge-platform/orch-ci/.github/actions/security/trivy@27276444a9bcf247a27369406686b689933bd1ff
60+
with:
61+
scan_type: "config"
62+
scan_target: "edge-ai-suites-repo/metro-ai-suite/smart-nvr/docker"
63+
severity: "HIGH,CRITICAL"
64+
format: "json"
65+
misconfig_scanners: "Dockerfile"
66+
report_suffix: "-CT222"
67+
68+
- name: Upload Report
69+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
70+
with:
71+
name: trivy-report
72+
path: security-results/trivy*
73+
74+
bandit-scan:
75+
runs-on: ubuntu-latest
76+
permissions:
77+
contents: read
78+
steps:
79+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
80+
81+
- name: Run Bandit Scan
82+
uses: open-edge-platform/orch-ci/.github/actions/security/bandit@27276444a9bcf247a27369406686b689933bd1ff
83+
id: bandit
84+
with:
85+
scan-scope: "all"
86+
output-format: "txt"
87+
fail-on-findings: "false"
88+
paths: "metro-ai-suite/smart-nvr/"
89+
report_suffix: "-CT161"
90+
91+
- name: Upload Report
92+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
93+
with:
94+
name: bandit-report
95+
path: bandit-report-*.txt
96+
97+
98+
clamav-scan:
99+
runs-on: ubuntu-latest
100+
permissions:
101+
contents: read
102+
steps:
103+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
104+
105+
- name: Run ClamAV Scan
106+
uses: open-edge-platform/orch-ci/.github/actions/security/clamav@27276444a9bcf247a27369406686b689933bd1ff
107+
id: clamav
108+
with:
109+
scan-scope: "all"
110+
output-format: "txt"
111+
fail-on-findings: "false"
112+
paths: "metro-ai-suite/smart-nvr/"
113+
exclude_dirs: ".git,node_modules,venv,ui/test"
114+
115+
- name: Upload Report
116+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
117+
with:
118+
name: clamav-report
119+
path: security-results/clamav*
120+
121+
# GitLeaks scanning job - matching your existing pattern
122+
gitleaks-scan:
123+
runs-on: ubuntu-latest
124+
permissions:
125+
contents: read
126+
steps:
127+
- name: Checkout code
128+
uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
129+
with:
130+
persist-credentials: false
131+
132+
- name: Install gitleaks
133+
uses: open-edge-platform/orch-ci/.github/actions/bootstrap@5f1c7f544b235db6ded508b6b4c6a2d3a78a38be
134+
with:
135+
bootstrap_tools: "gitleaks"
136+
137+
- name: Get current timestamp
138+
id: timestamp
139+
run: echo "time=$(date +%s)" >> "$GITHUB_OUTPUT"
140+
141+
- name: Clone CI repo
142+
uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
143+
with:
144+
repository: open-edge-platform/orch-ci
145+
path: ci
146+
persist-credentials: false
147+
148+
- name: Scan for secrets
149+
run: |
150+
gitleaks dir "metro-ai-suite/smart-nvr/" -v -c ci/.gitleaks.toml --baseline-path ci/gitleaks_baselines/gitleaks-smart-nvr.json -r gitleaks-smart-nvr.json || true
151+
152+
- name: Upload Gitleaks Report
153+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
154+
with:
155+
name: gitleaks-report-smart-nvr-${{ steps.timestamp.outputs.time }}
156+
path: gitleaks-smart-nvr.json
157+
158+
# Python linting with pylint
159+
pylint-scan:
160+
runs-on: ubuntu-latest
161+
permissions:
162+
contents: read
163+
steps:
164+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
165+
166+
- name: Setup Python
167+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
168+
with:
169+
python-version: '3.12'
170+
171+
- name: Install dependencies and pylint
172+
run: |
173+
pip install pylint
174+
# Install project dependencies if requirements.txt exists
175+
if [ -f "metro-ai-suite/smart-nvr/requirements.txt" ]; then
176+
pip install -r metro-ai-suite/smart-nvr/requirements.txt || true
177+
fi
178+
179+
- name: Run pylint
180+
run: |
181+
mkdir -p security-results
182+
echo "=== Pylint Scan Results ===" > security-results/pylint-report-smart-nvr.txt
183+
echo "Scan Date: $(date)" >> security-results/pylint-report-smart-nvr.txt
184+
echo "" >> security-results/pylint-report-smart-nvr.txt
185+
186+
# Create a basic pylint config
187+
cat > .pylintrc << EOF
188+
[MESSAGES CONTROL]
189+
disable=C0111,C0103,R0903,R0913,W0613,W0622,R0801,R0902,R0914,R0915,R0912,C0301,C0302
190+
191+
[FORMAT]
192+
max-line-length=120
193+
194+
[REPORTS]
195+
output-format=text
196+
reports=yes
197+
EOF
198+
199+
# Find all Python files and lint them
200+
find metro-ai-suite/smart-nvr/ -type f -name "*.py" -exec pylint --rcfile=.pylintrc {} + >> security-results/pylint-report-smart-nvr.txt 2>&1 || true
201+
202+
echo "Pylint scan completed"
203+
204+
- name: Upload pylint Report
205+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
206+
with:
207+
name: pylint-report
208+
path: security-results/pylint-report-smart-nvr.txt
209+
210+
# ShellCheck scanning job
211+
shellcheck-scan:
212+
runs-on: ubuntu-latest
213+
permissions:
214+
contents: read
215+
steps:
216+
- uses: actions/checkout@8edcb1bdb4e267140fa742c62e395cd74f332709
217+
218+
- name: Setup environment with shellcheck
219+
uses: open-edge-platform/orch-ci/.github/actions/bootstrap@5f1c7f544b235db6ded508b6b4c6a2d3a78a38be
220+
with:
221+
bootstrap_tools: "shellcheck"
222+
223+
- name: Run ShellCheck
224+
run: |
225+
mkdir -p security-results
226+
echo "=== ShellCheck Scan Results ===" > security-results/shellcheck-report-smart-nvr.txt
227+
echo "Scan Date: $(date)" >> security-results/shellcheck-report-smart-nvr.txt
228+
echo "" >> security-results/shellcheck-report-smart-nvr.txt
229+
230+
# Find all shell scripts and check them
231+
find metro-ai-suite/smart-nvr/ -type f \( -name "*.sh" -o -name "*.bash" \) -print0 | while IFS= read -r -d '' file; do
232+
echo "Checking: $file" >> security-results/shellcheck-report-smart-nvr.txt
233+
shellcheck "$file" >> security-results/shellcheck-report-smart-nvr.txt 2>&1 || true
234+
echo "---" >> security-results/shellcheck-report-smart-nvr.txt
235+
done
236+
237+
echo "ShellCheck scan completed"
238+
239+
- name: Upload ShellCheck Report
240+
uses: actions/upload-artifact@de65e23aa2b7e23d713bb51fbfcb6d502f8667d8
241+
with:
242+
name: shellcheck-report
243+
path: security-results/shellcheck-report-smart-nvr.txt

0 commit comments

Comments
 (0)