Security Scanning #23
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main, develop] | |
| schedule: | |
| # Run weekly on Sundays at 2 AM UTC | |
| - cron: "0 2 * * 0" | |
| jobs: | |
| bandit: | |
| name: Security Scan with Bandit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install bandit | |
| run: | | |
| uv tool install bandit[toml] | |
| - name: Run Bandit security scan | |
| run: | | |
| uv tool run bandit -r src/ --skip B101 --quiet -f json -o bandit-report.json || true | |
| uv tool run bandit -r src/ --skip B101 --quiet -f txt | |
| - name: Upload Bandit report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: bandit-security-report | |
| path: bandit-report.json | |
| safety: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v4 | |
| with: | |
| version: "latest" | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies with uv | |
| run: | | |
| uv sync --group test --no-dev | |
| - name: Install security tools | |
| run: | | |
| uv tool install safety | |
| uv tool install pip-audit | |
| - name: Run Safety check | |
| run: | | |
| uv export --no-dev | uv tool run safety check --json --output safety-report.json || true | |
| uv export --no-dev | uv tool run safety check | |
| - name: Run pip-audit | |
| run: | | |
| uv tool run pip-audit --format=json --output=pip-audit-report.json . || true | |
| uv tool run pip-audit . | |
| - name: Upload Security reports | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: security-reports | |
| path: | | |
| safety-report.json | |
| pip-audit-report.json |