Skip to content

Commit 7a944c1

Browse files
mukul975mukul975
authored
Update security.yml
1 parent 79bd5f6 commit 7a944c1

File tree

1 file changed

+162
-71
lines changed

1 file changed

+162
-71
lines changed

‎.github/workflows/security.yml

Lines changed: 162 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -1,119 +1,210 @@
1-
name: Security Scan
1+
name: 🛡️ Security Scan
22

33
on:
44
push:
5-
branches: [ main, develop ]
5+
branches: [ "master", "main", "develop" ]
66
pull_request:
7-
branches: [ main ]
7+
branches: [ "master", "main" ]
88
schedule:
9-
# Run weekly security scans on Sundays at 2 AM UTC
10-
- cron: '0 2 * * 0'
9+
# Run security scan daily at 2 AM UTC
10+
- cron: '0 2 * * *'
11+
workflow_dispatch: # Allow manual trigger
1112

1213
jobs:
13-
security:
14+
security-scan:
15+
name: 🔍 Security Vulnerability Scan
1416
runs-on: ubuntu-latest
15-
name: Security Analysis
16-
1717
permissions:
1818
actions: read
1919
contents: read
2020
security-events: write
2121

22+
strategy:
23+
matrix:
24+
python-version: ["3.10", "3.11", "3.12"]
25+
2226
steps:
23-
- name: Checkout code
27+
- name: 📥 Checkout repository
2428
uses: actions/checkout@v4
25-
26-
- name: Set up Python
29+
with:
30+
fetch-depth: 0
31+
32+
- name: 🐍 Set up Python ${{ matrix.python-version }}
2733
uses: actions/setup-python@v4
2834
with:
29-
python-version: '3.9'
30-
31-
- name: Install dependencies
35+
python-version: ${{ matrix.python-version }}
36+
cache: 'pip'
37+
cache-dependency-path: 'requirements.txt'
38+
timeout-minutes: 10
39+
40+
- name: ✅ Verify Python Version (Must be 3.10+)
41+
run: |
42+
python_version=$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
43+
echo "Python version detected: $python_version"
44+
if [[ "$python_version" < "3.10" ]]; then
45+
echo "❌ ERROR: This workflow requires Python 3.10+ but found $python_version"
46+
echo "This indicates an old workflow is running. Please cancel old workflow runs."
47+
exit 1
48+
fi
49+
echo "✅ Python version $python_version is compatible with MCP library"
50+
51+
- name: 📦 Install dependencies
52+
timeout-minutes: 15
3253
run: |
3354
python -m pip install --upgrade pip
34-
pip install -r requirements.txt
35-
pip install bandit safety semgrep
55+
# Install dependencies, skipping Windows-specific packages on Linux
56+
if [[ "$RUNNER_OS" == "Linux" ]]; then
57+
# Create temp requirements file without Windows-specific packages for Linux
58+
grep -v "platform_system==\"Windows\"" requirements.txt > temp-requirements.txt
59+
echo "Installing filtered requirements for Linux:"
60+
cat temp-requirements.txt
61+
pip install -r temp-requirements.txt --timeout 300
62+
else
63+
pip install -r requirements.txt --timeout 300
64+
fi
65+
pip install safety bandit semgrep --timeout 300
3666
37-
- name: Run Bandit Security Linter
38-
run: |
39-
bandit -r . -f json -o bandit-report.json || true
40-
bandit -r . -f txt
41-
continue-on-error: true
42-
43-
- name: Run Safety Check
67+
- name: 🔍 Run Safety - Check for known vulnerabilities
4468
run: |
69+
echo "## 🛡️ Safety - Known Vulnerabilities Check" >> $GITHUB_STEP_SUMMARY
4570
safety check --json --output safety-report.json || true
46-
safety check
47-
continue-on-error: true
48-
49-
- name: Run Semgrep
71+
if [ -f safety-report.json ]; then
72+
echo "### Safety Report Results:" >> $GITHUB_STEP_SUMMARY
73+
python -c "import json; data=json.load(open('safety-report.json')); print('- Total vulnerabilities found:', len(data.get('vulnerabilities', [])))" >> $GITHUB_STEP_SUMMARY
74+
if [ $(python -c "import json; data=json.load(open('safety-report.json')); print(len(data.get('vulnerabilities', [])))") -gt 0 ]; then
75+
echo "❌ Vulnerabilities detected! See full report in artifacts." >> $GITHUB_STEP_SUMMARY
76+
exit 1
77+
else
78+
echo "✅ No known vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
79+
fi
80+
fi
81+
82+
- name: 🔒 Run Bandit - Security linter for Python
5083
run: |
51-
semgrep --config=auto --json --output=semgrep-report.json . || true
52-
semgrep --config=auto .
53-
continue-on-error: true
54-
55-
- name: Upload Bandit Results to GitHub Security
56-
uses: github/codeql-action/upload-sarif@v2
57-
if: always()
58-
with:
59-
sarif_file: bandit-report.json
60-
continue-on-error: true
84+
echo "## 🔒 Bandit - Python Security Linter" >> $GITHUB_STEP_SUMMARY
85+
bandit -r . -f json -o bandit-report.json || true
86+
if [ -f bandit-report.json ]; then
87+
echo "### Bandit Report Results:" >> $GITHUB_STEP_SUMMARY
88+
python -c "import json; data=json.load(open('bandit-report.json')); print('- Total issues found:', len(data.get('results', [])))" >> $GITHUB_STEP_SUMMARY
89+
python -c "import json; data=json.load(open('bandit-report.json')); high=[r for r in data.get('results',[]) if r.get('issue_severity')=='HIGH']; medium=[r for r in data.get('results',[]) if r.get('issue_severity')=='MEDIUM']; print(f'- High severity: {len(high)}'); print(f'- Medium severity: {len(medium)}')" >> $GITHUB_STEP_SUMMARY
90+
fi
6191
62-
- name: Archive security reports
63-
uses: actions/upload-artifact@v3
92+
- name: ⚡ Run Semgrep - Static analysis
93+
run: |
94+
echo "## ⚡ Semgrep - Static Code Analysis" >> $GITHUB_STEP_SUMMARY
95+
semgrep --config=auto --json --output=semgrep-report.json . || true
96+
if [ -f semgrep-report.json ]; then
97+
echo "### Semgrep Report Results:" >> $GITHUB_STEP_SUMMARY
98+
python -c "import json; data=json.load(open('semgrep-report.json')); results=data.get('results',[]); print('- Total findings:', len(results)); critical=[r for r in results if r.get('extra',{}).get('severity')=='ERROR']; warning=[r for r in results if r.get('extra',{}).get('severity')=='WARNING']; print(f'- Critical: {len(critical)}'); print(f'- Warnings: {len(warning)}')" >> $GITHUB_STEP_SUMMARY
99+
fi
100+
101+
- name: 📊 Generate Security Report
102+
run: |
103+
echo "## 📊 Security Scan Summary" >> $GITHUB_STEP_SUMMARY
104+
echo "### Scan Details:" >> $GITHUB_STEP_SUMMARY
105+
echo "- Python Version: ${{ matrix.python-version }}" >> $GITHUB_STEP_SUMMARY
106+
echo "- Scan Date: $(date)" >> $GITHUB_STEP_SUMMARY
107+
echo "- Repository: ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY
108+
echo "- Branch: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
109+
110+
- name: 📤 Upload Security Reports
111+
uses: actions/upload-artifact@v4
64112
if: always()
65113
with:
66-
name: security-reports
114+
name: security-reports-py${{ matrix.python-version }}
67115
path: |
68-
bandit-report.json
69116
safety-report.json
117+
bandit-report.json
70118
semgrep-report.json
119+
retention-days: 30
71120

72-
dependency-check:
121+
dependency-review:
122+
name: 🔍 Dependency Review
73123
runs-on: ubuntu-latest
74-
name: Dependency Vulnerability Check
75-
124+
if: github.event_name == 'pull_request'
76125
steps:
77-
- name: Checkout code
126+
- name: 📥 Checkout repository
78127
uses: actions/checkout@v4
79128

80-
- name: Set up Python
81-
uses: actions/setup-python@v4
129+
- name: 🔍 Dependency Review
130+
uses: actions/dependency-review-action@v3
82131
with:
83-
python-version: '3.9'
84-
85-
- name: Install pip-audit
86-
run: |
87-
python -m pip install --upgrade pip
88-
pip install pip-audit
89-
90-
- name: Run pip-audit
91-
run: |
92-
pip-audit --desc --format=json --output=pip-audit-report.json || true
93-
pip-audit --desc
94-
continue-on-error: true
95-
96-
- name: Upload pip-audit results
97-
uses: actions/upload-artifact@v3
98-
if: always()
132+
fail-on-severity: moderate
133+
134+
codeql-analysis:
135+
name: 🕵️ CodeQL Analysis
136+
runs-on: ubuntu-latest
137+
permissions:
138+
actions: read
139+
contents: read
140+
security-events: write
141+
142+
strategy:
143+
fail-fast: false
144+
matrix:
145+
language: [ 'python' ]
146+
147+
steps:
148+
- name: 📥 Checkout repository
149+
uses: actions/checkout@v4
150+
151+
- name: 🔧 Initialize CodeQL
152+
uses: github/codeql-action/init@v2
99153
with:
100-
name: pip-audit-report
101-
path: pip-audit-report.json
154+
languages: ${{ matrix.language }}
155+
queries: security-extended,security-and-quality
102156

103-
secrets-scan:
157+
- name: 🏗️ Autobuild
158+
uses: github/codeql-action/autobuild@v2
159+
160+
- name: 🔍 Perform CodeQL Analysis
161+
uses: github/codeql-action/analyze@v2
162+
with:
163+
category: "/language:${{matrix.language}}"
164+
165+
secret-scan:
166+
name: 🔐 Secret Scanning
104167
runs-on: ubuntu-latest
105-
name: Secrets Detection
106-
107168
steps:
108-
- name: Checkout code
169+
- name: 📥 Checkout repository
109170
uses: actions/checkout@v4
110171
with:
111172
fetch-depth: 0
112-
113-
- name: Run TruffleHog
173+
174+
- name: 🔍 Run TruffleHog
114175
uses: trufflesecurity/trufflehog@main
115176
with:
116177
path: ./
117178
base: main
118179
head: HEAD
119180
extra_args: --debug --only-verified
181+
182+
security-audit:
183+
name: 🛡️ Security Audit
184+
runs-on: ubuntu-latest
185+
needs: [security-scan, codeql-analysis]
186+
if: always()
187+
steps:
188+
- name: 📥 Checkout repository
189+
uses: actions/checkout@v4
190+
191+
- name: 📊 Security Audit Summary
192+
run: |
193+
echo "# 🛡️ Security Audit Complete" >> $GITHUB_STEP_SUMMARY
194+
echo "" >> $GITHUB_STEP_SUMMARY
195+
echo "## 🔍 Scans Performed:" >> $GITHUB_STEP_SUMMARY
196+
echo "- ✅ Python Security Linting (Bandit)" >> $GITHUB_STEP_SUMMARY
197+
echo "- ✅ Known Vulnerability Check (Safety)" >> $GITHUB_STEP_SUMMARY
198+
echo "- ✅ Static Code Analysis (Semgrep)" >> $GITHUB_STEP_SUMMARY
199+
echo "- ✅ Advanced Code Analysis (CodeQL)" >> $GITHUB_STEP_SUMMARY
200+
echo "- ✅ Secret Detection (TruffleHog)" >> $GITHUB_STEP_SUMMARY
201+
echo "" >> $GITHUB_STEP_SUMMARY
202+
echo "## 📁 Artifacts Generated:" >> $GITHUB_STEP_SUMMARY
203+
echo "- Security reports available in workflow artifacts" >> $GITHUB_STEP_SUMMARY
204+
echo "- CodeQL results available in Security tab" >> $GITHUB_STEP_SUMMARY
205+
echo "" >> $GITHUB_STEP_SUMMARY
206+
echo "## 🚨 Next Steps:" >> $GITHUB_STEP_SUMMARY
207+
echo "1. Review all security findings" >> $GITHUB_STEP_SUMMARY
208+
echo "2. Address high-priority vulnerabilities" >> $GITHUB_STEP_SUMMARY
209+
echo "3. Update dependencies as needed" >> $GITHUB_STEP_SUMMARY
210+
echo "4. Document remediation actions" >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)