Skip to content

Commit ef35f46

Browse files
crivetimihaicrivetimihai
authored
Merge pull request #17 from IBM/makefile-and-linting-updates
Makefile and linting updates
2 parents 00877ad + e0400a8 commit ef35f46

File tree

11 files changed

+572
-540
lines changed

11 files changed

+572
-540
lines changed

‎.github/workflows/bandit.yml

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -17,44 +17,44 @@ name: Bandit
1717

1818
on:
1919
push:
20-
branches: [ "main" ]
20+
branches: ["main"]
2121
pull_request:
22-
branches: [ "main" ] # must be a subset of the push branches
22+
branches: ["main"] # must be a subset of the push branches
2323
schedule:
24-
- cron: '26 11 * * 6' # Saturday @ 11:26 UTC – catch new CVEs
24+
- cron: "26 11 * * 6" # Saturday @ 11:26 UTC – catch new CVEs
2525

2626
jobs:
2727
bandit:
2828
permissions:
29-
contents: read # required by actions/checkout
30-
security-events: write # upload SARIF to “Code scanning”
31-
actions: read # needed only for private repos
29+
contents: read # required by actions/checkout
30+
security-events: write # upload SARIF to “Code scanning”
31+
actions: read # needed only for private repos
3232

3333
runs-on: ubuntu-latest
3434

3535
steps:
36-
# -----------------------------------------------------------
37-
# 0️⃣ Check out the repository
38-
# -----------------------------------------------------------
39-
- name: ⬇️ Checkout code
40-
uses: actions/checkout@v4
41-
42-
# -----------------------------------------------------------
43-
# 1️⃣ Run Bandit with custom filters
44-
# -----------------------------------------------------------
45-
- name: 🔍 Bandit scan (medium / high-conf)
46-
uses: shundor/python-bandit-scan@ab1d87dfccc5a0ffab88be3aaac6ffe35c10d6cd
47-
with:
48-
# Fail **softly** so devs can triage before gating the build
49-
exit_zero: true
50-
51-
# Built-in GitHub token (no extra secrets needed)
52-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
53-
54-
# ──────────────── Customised CLI flags ────────────────
55-
path: mcpgateway # recurse into package
56-
level: MEDIUM # MEDIUM and HIGH severities
57-
confidence: HIGH # HIGH-confidence findings only
58-
# excluded_paths: DEFAULT # inherit Bandit defaults
59-
# skips: DEFAULT # inherit Bandit defaults
60-
# ini_path: "" # not using a .bandit config
36+
# -----------------------------------------------------------
37+
# 0️⃣ Check out the repository
38+
# -----------------------------------------------------------
39+
- name: ⬇️ Checkout code
40+
uses: actions/checkout@v4
41+
42+
# -----------------------------------------------------------
43+
# 1️⃣ Run Bandit with custom filters
44+
# -----------------------------------------------------------
45+
- name: 🔍 Bandit scan (medium / high-conf)
46+
uses: shundor/python-bandit-scan@ab1d87dfccc5a0ffab88be3aaac6ffe35c10d6cd
47+
with:
48+
# Fail **softly** so devs can triage before gating the build
49+
exit_zero: true
50+
51+
# Built-in GitHub token (no extra secrets needed)
52+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
53+
54+
# ──────────────── Customised CLI flags ────────────────
55+
path: mcpgateway # recurse into package
56+
level: MEDIUM # MEDIUM and HIGH severities
57+
confidence: HIGH # HIGH-confidence findings only
58+
# excluded_paths: DEFAULT # inherit Bandit defaults
59+
# skips: DEFAULT # inherit Bandit defaults
60+
# ini_path: "" # not using a .bandit config

‎.github/workflows/codeql.yml

Lines changed: 54 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -15,23 +15,23 @@ name: CodeQL Advanced
1515

1616
on:
1717
push:
18-
branches: [ "main" ]
18+
branches: ["main"]
1919
paths-ignore:
20-
- '**/tests/**'
21-
- '**/docs/**'
20+
- "**/tests/**"
21+
- "**/docs/**"
2222
pull_request:
23-
branches: [ "main" ]
23+
branches: ["main"]
2424
paths-ignore:
25-
- '**/tests/**'
26-
- '**/docs/**'
25+
- "**/tests/**"
26+
- "**/docs/**"
2727
# schedule:
2828
# - cron: '15 21 * * 3' # Weekly on Wednesday at 21:15 UTC
2929

3030
permissions:
31-
contents: read # For checking out the code
32-
security-events: write # Required to upload SARIF results
33-
actions: read # Required in private repositories
34-
packages: read # Required to download CodeQL packs
31+
contents: read # For checking out the code
32+
security-events: write # Required to upload SARIF results
33+
actions: read # Required in private repositories
34+
packages: read # Required to download CodeQL packs
3535

3636
jobs:
3737
analyze:
@@ -50,52 +50,52 @@ jobs:
5050
build: none
5151

5252
steps:
53-
# -------------------------------------------------------------
54-
# 0️⃣ Checkout source
55-
# -------------------------------------------------------------
56-
- name: ⬇️ Checkout code
57-
uses: actions/checkout@v4
53+
# -------------------------------------------------------------
54+
# 0️⃣ Checkout source
55+
# -------------------------------------------------------------
56+
- name: ⬇️ Checkout code
57+
uses: actions/checkout@v4
5858

59-
# -------------------------------------------------------------
60-
# 1️⃣ Optional setup – runtimes for specific languages
61-
# -------------------------------------------------------------
62-
- name: 🐍 Setup Python
63-
if: matrix.language == 'python'
64-
uses: actions/setup-python@v5
65-
with:
66-
python-version: '3.x'
59+
# -------------------------------------------------------------
60+
# 1️⃣ Optional setup – runtimes for specific languages
61+
# -------------------------------------------------------------
62+
- name: 🐍 Setup Python
63+
if: matrix.language == 'python'
64+
uses: actions/setup-python@v5
65+
with:
66+
python-version: "3.x"
6767

68-
- name: 🟢 Setup Node.js
69-
if: matrix.language == 'javascript-typescript'
70-
uses: actions/setup-node@v4
71-
with:
72-
node-version: '20'
68+
- name: 🟢 Setup Node.js
69+
if: matrix.language == 'javascript-typescript'
70+
uses: actions/setup-node@v4
71+
with:
72+
node-version: "20"
7373

74-
# -------------------------------------------------------------
75-
# 2️⃣ Initialize CodeQL
76-
# -------------------------------------------------------------
77-
- name: 🛠️ Initialize CodeQL
78-
uses: github/codeql-action/init@v3
79-
with:
80-
languages: ${{ matrix.language }}
81-
dependency-caching: true
82-
config-file: ./.github/codeql-config.yml
74+
# -------------------------------------------------------------
75+
# 2️⃣ Initialize CodeQL
76+
# -------------------------------------------------------------
77+
- name: 🛠️ Initialize CodeQL
78+
uses: github/codeql-action/init@v3
79+
with:
80+
languages: ${{ matrix.language }}
81+
dependency-caching: true
82+
config-file: ./.github/codeql-config.yml
8383

84-
# -------------------------------------------------------------
85-
# 3️⃣ Manual build step (not needed for JS/Python/Actions)
86-
# -------------------------------------------------------------
87-
- if: matrix.build == 'manual'
88-
name: ⚙️ Manual build (placeholder)
89-
shell: bash
90-
run: |
91-
echo "Add manual build commands here if needed."
92-
exit 1
84+
# -------------------------------------------------------------
85+
# 3️⃣ Manual build step (not needed for JS/Python/Actions)
86+
# -------------------------------------------------------------
87+
- if: matrix.build == 'manual'
88+
name: ⚙️ Manual build (placeholder)
89+
shell: bash
90+
run: |
91+
echo "Add manual build commands here if needed."
92+
exit 1
9393
94-
# -------------------------------------------------------------
95-
# 4️⃣ Perform CodeQL analysis
96-
# -------------------------------------------------------------
97-
- name: 🔬 Perform CodeQL analysis
98-
uses: github/codeql-action/analyze@v3
99-
with:
100-
category: "/language:${{ matrix.language }}"
101-
upload: false
94+
# -------------------------------------------------------------
95+
# 4️⃣ Perform CodeQL analysis
96+
# -------------------------------------------------------------
97+
- name: 🔬 Perform CodeQL analysis
98+
uses: github/codeql-action/analyze@v3
99+
with:
100+
category: "/language:${{ matrix.language }}"
101+
upload: false

‎.github/workflows/dependency-review.yml

Lines changed: 42 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -25,64 +25,63 @@ name: Dependency Review
2525

2626
on:
2727
push:
28-
branches: [ "main" ]
28+
branches: ["main"]
2929
pull_request:
30-
branches: [ "main" ]
30+
branches: ["main"]
3131
# Weekly safety-net run — useful for catching newly-disclosed CVEs
3232
# or upstream license changes even when no PR is open.
3333
schedule:
34-
- cron: '31 12 * * 6' # Saturday @ 12:31 UTC
34+
- cron: "31 12 * * 6" # Saturday @ 12:31 UTC
3535

3636
# -----------------------------------------------------------------
3737
# Minimal permissions – principle of least privilege
3838
# -----------------------------------------------------------------
3939
permissions:
40-
contents: read # for actions/checkout
41-
security-events: write # upload SARIF results
42-
pull-requests: write # post / overwrite PR comment
40+
contents: read # for actions/checkout
41+
security-events: write # upload SARIF results
42+
pull-requests: write # post / overwrite PR comment
4343

4444
jobs:
4545
dependency-review:
4646
runs-on: ubuntu-latest
4747

4848
steps:
49-
# -----------------------------------------------------------
50-
# 0️⃣ Check out the repository
51-
# -----------------------------------------------------------
52-
- name: ⬇️ Checkout code
53-
uses: actions/checkout@v4
49+
# -----------------------------------------------------------
50+
# 0️⃣ Check out the repository
51+
# -----------------------------------------------------------
52+
- name: ⬇️ Checkout code
53+
uses: actions/checkout@v4
5454

55-
# -----------------------------------------------------------
56-
# 1️⃣ Dependency & License gate
57-
# -----------------------------------------------------------
58-
- name: 🔍 Dependency Review
59-
id: dep-scan
60-
uses: actions/dependency-review-action@v4
61-
with:
62-
# ───────── Vulnerability policy ─────────
63-
fail-on-severity: moderate # MODERATE, HIGH, CRITICAL ⇒ ❌
64-
vulnerability-check: true # (default)
55+
# -----------------------------------------------------------
56+
# 1️⃣ Dependency & License gate
57+
# -----------------------------------------------------------
58+
- name: 🔍 Dependency Review
59+
id: dep-scan
60+
uses: actions/dependency-review-action@v4
61+
with:
62+
# ───────── Vulnerability policy ─────────
63+
fail-on-severity: moderate # MODERATE, HIGH, CRITICAL ⇒ ❌
64+
vulnerability-check: true # (default)
6565

66-
# ───────── License policy ─────────
67-
# Hard-deny strong- or service-copyleft licenses that would
68-
# "infect" an Apache-2.0 project. (LGPL/MPL/EPL are *not*
69-
# listed — they’re weak/file-level copyleft. Add them here
70-
# if your org chooses to forbid them outright.)
71-
deny-licenses: >
72-
GPL-1.0, GPL-2.0, GPL-3.0,
73-
AGPL-3.0,
74-
SSPL-1.0,
75-
RPL-1.5,
76-
OSL-3.0,
77-
CPAL-1.0
78-
license-check: true # (default)
66+
# ───────── License policy ─────────
67+
# Hard-deny strong- or service-copyleft licenses that would
68+
# "infect" an Apache-2.0 project. (LGPL/MPL/EPL are *not*
69+
# listed — they’re weak/file-level copyleft. Add them here
70+
# if your org chooses to forbid them outright.)
71+
deny-licenses: >
72+
GPL-1.0, GPL-2.0, GPL-3.0,
73+
AGPL-3.0,
74+
SSPL-1.0,
75+
RPL-1.5,
76+
OSL-3.0,
77+
CPAL-1.0
78+
license-check: true # (default)
79+
# ───────── UX tweaks ─────────
80+
warn-only: false # actually fail the workflow
81+
comment-summary-in-pr: on-failure
7982

80-
# ───────── UX tweaks ─────────
81-
warn-only: false # actually fail the workflow
82-
comment-summary-in-pr: on-failure
83-
84-
# ───────── Refs for non-PR events ─────────
85-
# These are ignored on pull_request events but allow the
86-
# scheduled run to compare HEAD against `main`.
87-
base-ref: main
88-
head-ref: ${{ github.sha }}
83+
# ───────── Refs for non-PR events ─────────
84+
# These are ignored on pull_request events but allow the
85+
# scheduled run to compare HEAD against `main`.
86+
base-ref: main
87+
head-ref: ${{ github.sha }}

0 commit comments

Comments
 (0)