Global Security #1451
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Global Security | |
| on: | |
| push: | |
| branches: ["master"] | |
| pull_request: | |
| branches: ["master"] | |
| schedule: | |
| - cron: "30 03 * * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: global-security-${{ github.event_name == 'pull_request' && format('{0}-{1}', github.workflow, github.event.pull_request.number) || github.workflow_ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Audit (${{ matrix.service }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - service: aimer-web | |
| path: services/aimer-web | |
| - service: MAGE | |
| path: services/MAGE | |
| - service: FARM | |
| path: services/FARM | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| with: | |
| enable-cache: true | |
| - name: Install Python 3.13 | |
| run: uv python install 3.13 | |
| - name: Export locked runtime requirements | |
| working-directory: ${{ matrix.path }} | |
| run: uv export --locked --no-dev --format requirements-txt --output-file "${RUNNER_TEMP}/${{ matrix.service }}-requirements.txt" | |
| - name: Audit locked dependencies | |
| run: | | |
| # Current upstream constraints: | |
| # - openrag 0.4.1 pins litellm 1.83.3 and python-dotenv 1.0.1. | |
| # - fastapi currently keeps starlette below the audited fixed release. | |
| # - torch has no fixed version published for PYSEC-2026-139. | |
| # Exception ownership and review dates are tracked in: | |
| # docs/operations/VULNERABILITY_EXCEPTIONS.md | |
| uvx pip-audit \ | |
| -r "${RUNNER_TEMP}/${{ matrix.service }}-requirements.txt" \ | |
| --no-deps \ | |
| --disable-pip \ | |
| --vulnerability-service osv \ | |
| --ignore-vuln CVE-2026-42208 \ | |
| --ignore-vuln CVE-2026-42271 \ | |
| --ignore-vuln CVE-2026-40217 \ | |
| --ignore-vuln CVE-2026-42203 \ | |
| --ignore-vuln CVE-2026-28684 \ | |
| --ignore-vuln PYSEC-2026-161 \ | |
| --ignore-vuln PYSEC-2026-139 | |
| bandit: | |
| name: Bandit (${{ matrix.service }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - service: aimer-web | |
| scan-paths: services/aimer-web/AIMER services/aimer-web/auth services/aimer-web/website services/aimer-web/RAG | |
| - service: MAGE | |
| scan-paths: services/MAGE/api services/MAGE/info.py | |
| - service: FARM | |
| scan-paths: services/FARM/FARM services/FARM/info.py | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| - name: Run Bandit high-confidence scan | |
| run: uvx bandit -q -r ${{ matrix.scan-paths }} --severity-level high --confidence-level high | |
| secret-leaks: | |
| name: Secret Leaks | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Secret scanning | |
| uses: trufflesecurity/trufflehog@bcfcf73aaf4759d4dadc2783177c245a02792318 | |
| with: | |
| path: ./ | |
| extra_args: --only-verified |