Skip to content
Security and Tests

fix: (security) 1/ Setup APIGW API Key as a password encrypted discovery_credential in SNOW, and then use that in BusinessRule/Outbound REST messages to publish events from SNOW to Security IR; 2/ Replace SNOW Client Secret being stored in SSM with SecretsManager; 3/ Reduce the wildcard permissions to specific resources, and actions in the cdk; (documentation) 1/ Added a note for the users to expect 2-4 mins delay for new incidents sync between Security-IR and SNOW #302

Sign in to view logs

fix: (security) 1/ Setup APIGW API Key as a password encrypted discovery_credential in SNOW, and then use that in BusinessRule/Outbound REST messages to publish events from SNOW to Security IR; 2/ Replace SNOW Client Secret being stored in SSM with SecretsManager; 3/ Reduce the wildcard permissions to specific resources, and actions in the cdk; (documentation) 1/ Added a note for the users to expect 2-4 mins delay for new incidents sync between Security-IR and SNOW

fix: (security) 1/ Setup APIGW API Key as a password encrypted discovery_credential in SNOW, and then use that in BusinessRule/Outbound REST messages to publish events from SNOW to Security IR; 2/ Replace SNOW Client Secret being stored in SSM with SecretsManager; 3/ Reduce the wildcard permissions to specific resources, and actions in the cdk; (documentation) 1/ Added a note for the users to expect 2-4 mins delay for new incidents sync between Security-IR and SNOW #302

Workflow file for this run

.github/workflows/security-and-tests.yml at abf252b
name: Security and Tests
env:
UV_SYSTEM_PYTHON: 1
permissions:
contents: read
pull-requests: write
issues: write
on:
pull_request:
branches: [ main, v3/service-now-integration, v4/slack-integration ]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.9'
cache: 'pip'
- name: Install uv
uses: astral-sh/setup-uv@v7
with:
enable-cache: true
- name: Install dependencies
run: |
python -m pip install --upgrade pip
uv pip install -r requirements-dev.txt
- name: Run Bandit
run: bandit -r . -x ./tests,./venv --skip B113,B108,B404
- name: Run detect-secrets
run: detect-secrets scan --baseline .secrets.baseline
- name: Install Syft & Grype
uses: anchore/sbom-action@v0
with:
syft-version: latest
grype-version: latest
- name: Run Syft (SBOM Generator)
uses: anchore/sbom-action@v0
with:
format: spdx-json
output-file: "${{ github.event.repository.name }}-sbom.spdx.json"
- name: Run Grype (Scan SBOM)
uses: anchore/scan-action@v7
with:
sbom: "${{ github.event.repository.name }}-sbom.spdx.json"
fail-build: true
severity-cutoff: critical
cdk-nag:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Set up Node.js
uses: actions/setup-node@v6
with:
node-version: '20'
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.9'
cache: 'pip'
- name: Install dependencies
run: |
curl -LsSf https://astral.sh/uv/install.sh | sh
python -m pip install --upgrade pip
uv pip install -r requirements.txt
- name: Run CDK Nag
run: |
# TODO: use the renamed app_jira.py in the following command once the Service Now integration implementation is complete
# TODO: see https://app.asana.com/1/8442528107068/project/1209571477232011/task/1210524326651427?focus=true
npx cdk synth --app "python app.py"
npx cdk synth --app "python app_service_now.py"
# CDK Nag is integrated into the CDK app, so it will run during synthesis
tests:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
issues: write
steps:
- name: Checkout code
uses: actions/checkout@v6
- name: Set up Python
uses: actions/setup-python@v6
with:
python-version: '3.9'
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -r requirements.txt
pip install -r requirements-dev.txt
- name: Run pytest with coverage
run: |
# Run all tests with coverage (tests that need to be skipped use @pytest.mark.skip)
pytest tests/ -v --cov=. --cov-report=xml --cov-report=term
- name: Code Coverage Report
uses: irongut/CodeCoverageSummary@v1.3.0
with:
filename: coverage.xml
badge: true
fail_below_min: true
format: markdown
hide_branch_rate: false
hide_complexity: true
indicators: true
output: both
thresholds: '1 80'