Skip to content

Commit b79f596

Browse files
hsri-pf9hsri-pf9
committed
added action file for soc2 scan report
1 parent e80b01f commit b79f596

File tree

1 file changed

+172
-0
lines changed

1 file changed

+172
-0
lines changed

‎.github/workflows/security-scan.yml‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
name: Python Security scan
2+
'on':
3+
push:
4+
branches:
5+
- main
6+
- private/harsh/soc2-scan
7+
pull_request:
8+
9+
jobs:
10+
setup:
11+
name: Shared Setup
12+
runs-on: ubuntu-latest
13+
outputs:
14+
python-version: '3.10'
15+
steps:
16+
- name: Checkout Code
17+
uses: actions/checkout@v3
18+
- name: Export Python Version
19+
run: echo "python-version=3.10" >> $GITHUB_OUTPUT
20+
21+
bandit_scan:
22+
name: Bandit Security Scan (Full)
23+
needs: setup
24+
runs-on: ubuntu-latest
25+
outputs:
26+
bandit-high-found: ${{ steps.scan.outputs.bandit_high_found }}
27+
permissions:
28+
contents: write
29+
pull-requests: write
30+
steps:
31+
- name: Checkout Code
32+
uses: actions/checkout@v3
33+
- name: Set up Python
34+
uses: actions/setup-python@v4
35+
with:
36+
python-version: '${{ needs.setup.outputs.python-version }}'
37+
- name: Install Bandit
38+
run: pip install bandit jq
39+
- name: Sanitize branch name
40+
run: echo "SAFE_REF_NAME=${GITHUB_REF_NAME//\//-}" >> $GITHUB_ENV
41+
- name: Run Full Bandit Scan
42+
id: scan
43+
run: |
44+
echo "Running full Bandit scan..."
45+
mkdir -p tmp
46+
bandit -r . --severity-level medium -f json -o tmp/bandit_output.json || true
47+
echo -e "\nHuman-readable Bandit output:\n"
48+
bandit -r . --severity-level medium || true
49+
cat tmp/bandit_output.json || echo "{}"
50+
count=$(jq '.results | map(select(.issue_severity == "HIGH")) | length' tmp/bandit_output.json || echo 0)
51+
52+
if [[ "$count" -gt 0 ]]; then
53+
echo "bandit_high_found=true" >> "$GITHUB_OUTPUT"
54+
else
55+
echo "bandit_high_found=false" >> "$GITHUB_OUTPUT"
56+
fi
57+
58+
- name: Upload Bandit Report
59+
uses: actions/upload-artifact@v4
60+
with:
61+
name: bandit-json-${{ env.SAFE_REF_NAME }}
62+
path: tmp/bandit_output.json
63+
64+
- name: Generate PR Body (if vulnerabilities found)
65+
if: ${{ steps.scan.outputs.bandit_high_found == 'true' }}
66+
run: |
67+
echo "# Bandit Scan Report for branch \`${GITHUB_REF_NAME}\`" > tmp/pr-body.md
68+
jq -r '.results[]
69+
| select(.issue_severity == "HIGH")
70+
| "* File: \(.filename)\n • Line: \(.line_number)\n • Severity: \(.issue_severity)\n • Confidence: \(.issue_confidence)\n • Issue: \(.issue_text)\n"' \
71+
tmp/bandit_output.json >> tmp/pr-body.md
72+
73+
- name: Create Pull Request (if vulnerabilities found)
74+
if: ${{ steps.scan.outputs.bandit_high_found == 'true' }}
75+
uses: peter-evans/create-pull-request@v5
76+
with:
77+
commit-message: 'chore: issues detected by Bandit (HIGH)'
78+
title: 'Bandit Vulnerability Report for branch ${{ github.ref_name }}'
79+
body-path: tmp/pr-body.md
80+
branch: auto/bandit-scan/${{ env.SAFE_REF_NAME }}
81+
base: ${{ github.ref_name }}
82+
delete-branch: true
83+
84+
- name: Fail Job If Vulnerabilities Found
85+
if: ${{ steps.scan.outputs.bandit_high_found == 'true' }}
86+
run: exit 1
87+
88+
trivy_scan:
89+
name: Trivy Security Scan (Full)
90+
needs: setup
91+
runs-on: ubuntu-latest
92+
outputs:
93+
trivy_issues_found: ${{ steps.scan.outputs.trivy_issues_found }}
94+
permissions:
95+
contents: write
96+
pull-requests: write
97+
steps:
98+
- name: Checkout Code
99+
uses: actions/checkout@v3
100+
101+
- name: Install Trivy
102+
run: |
103+
sudo apt update
104+
sudo apt install wget -y
105+
wget -qO- https://aquasecurity.github.io/trivy-repo/deb/public.key | sudo tee /etc/apt/trusted.gpg.d/trivy.asc
106+
echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee /etc/apt/sources.list.d/trivy.list
107+
sudo apt update
108+
sudo apt install -y trivy jq
109+
110+
- name: Sanitize branch name
111+
run: echo "SAFE_REF_NAME=${GITHUB_REF_NAME//\//-}" >> $GITHUB_ENV
112+
113+
- name: Run Trivy Filesystem Scan
114+
id: scan
115+
run: |
116+
set -euo pipefail
117+
echo "Running Trivy scan (HIGH/CRITICAL)..."
118+
mkdir -p tmp
119+
trivy fs --format json --severity HIGH,CRITICAL --output tmp/trivy.json .
120+
[[ -f tmp/trivy.json ]] || echo '{"Results":[]}' > tmp/trivy.json
121+
if ! jq -e '.Results and (.Results | length > 0)' tmp/trivy.json >/dev/null; then
122+
echo "No scan results available — likely no supported files found."
123+
echo "trivy_issues_found=false" >> "$GITHUB_OUTPUT"
124+
exit 0
125+
fi
126+
count=$(jq -e '
127+
(.Results // [])
128+
| map(.Vulnerabilities? // [])
129+
| add
130+
| map(select(.Severity=="HIGH" or .Severity=="CRITICAL"))
131+
| length
132+
' tmp/trivy.json)
133+
if [[ "$count" -gt 0 ]]; then
134+
echo "trivy_issues_found=true" >> "$GITHUB_OUTPUT"
135+
else
136+
echo "trivy_issues_found=false" >> "$GITHUB_OUTPUT"
137+
fi
138+
139+
- name: Upload Trivy Report
140+
uses: actions/upload-artifact@v4
141+
with:
142+
name: trivy-json-${{ env.SAFE_REF_NAME }}
143+
path: tmp/trivy.json
144+
145+
- name: Generate PR Body (if vulnerabilities found)
146+
if: ${{ steps.scan.outputs.trivy_issues_found == 'true' }}
147+
run: |
148+
echo "# 🛡️ Trivy Scan Report for branch \`${GITHUB_REF_NAME}\`" > tmp/pr-body.md
149+
jq -r '
150+
(.Results // [])
151+
| .[]
152+
| .Target as $file
153+
| (.Vulnerabilities? // [])
154+
| map(select(.Severity=="HIGH" or .Severity=="CRITICAL"))
155+
| .[]
156+
| "* File: \($file)\n • Vulnerability ID: \(.VulnerabilityID)\n • Pkg: \(.PkgName) \(.InstalledVersion)\n • Severity: \(.Severity)\n • Title: \(.Title)\n"
157+
' tmp/trivy.json >> tmp/pr-body.md
158+
159+
- name: Create Pull Request (if vulnerabilities found)
160+
if: ${{ steps.scan.outputs.trivy_issues_found == 'true' }}
161+
uses: peter-evans/create-pull-request@v5
162+
with:
163+
commit-message: 'chore: vulnerabilities detected by Trivy (HIGH/CRITICAL)'
164+
title: 'Trivy Vulnerability Report for branch ${{ github.ref_name }}'
165+
body-path: tmp/pr-body.md
166+
branch: auto/trivy-scan/${{ env.SAFE_REF_NAME }}
167+
base: ${{ github.ref_name }}
168+
delete-branch: true
169+
170+
- name: Fail Job If Vulnerabilities Found
171+
if: ${{ steps.scan.outputs.trivy_issues_found == 'true' }}
172+
run: exit 1

0 commit comments

Comments
 (0)