Skip to content

Commit a6d5795

Browse files
AlexanderBarabanovAlexanderBarabanov
authored
Security scan pipeline update (#4177)
* codeql settings update * codeql fix * update trivy * update bandit * trivy fix * trivy fix * trivy fix * json output * trivy fix * trivy spdx * codeql added * bandit update * remove bandit B320 * remove bandit B410 * remove workflow_dispatch * revert trivy yaml * fix format
1 parent 528141d commit a6d5795

File tree

4 files changed

+143
-36
lines changed

4 files changed

+143
-36
lines changed

‎.ci/ipas_default.config‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
# B317 : xml_bad_sax
4141
# B318 : xml_bad_minidom
4242
# B319 : xml_bad_pulldom
43-
# B320 : xml_bad_etree
43+
# B320 : xml_bad_etree - removed https://github.com/PyCQA/bandit/commit/e4da0b351f89a82b5de8dd791cbdd963476b5a11
4444
# B321 : ftplib
4545
# B323 : unverified_context
4646
# B324 : hashlib_new_insecure_functions
@@ -53,7 +53,7 @@
5353
# B407 : import_xml_expat
5454
# B408 : import_xml_minidom
5555
# B409 : import_xml_pulldom
56-
# B410 : import_lxml
56+
# B410 : import_lxml - removed https://github.com/PyCQA/bandit/commit/e4da0b351f89a82b5de8dd791cbdd963476b5a11
5757
# B411 : import_xmlrpclib
5858
# B412 : import_httpoxy
5959
# B413 : import_pycrypto
@@ -83,7 +83,7 @@
8383
# IPAS Required Checkers. Do not disable these
8484
# Additional checkers may be added if desired
8585
tests:
86-
[ 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B308', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B320', 'B321', 'B323', 'B324', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B410', 'B411', 'B412', 'B413']
86+
[ 'B301', 'B302', 'B303', 'B304', 'B305', 'B306', 'B308', 'B310', 'B311', 'B312', 'B313', 'B314', 'B315', 'B316', 'B317', 'B318', 'B319', 'B321', 'B323', 'B324', 'B401', 'B402', 'B403', 'B404', 'B405', 'B406', 'B407', 'B408', 'B409', 'B411', 'B412', 'B413']
8787

8888
# (optional) list skipped test IDs here, eg '[B101, B406]':
8989
# The following checkers are not required but be added to tests list if desired

‎.github/workflows/code_scan.yaml‎

Lines changed: 119 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,11 @@ on:
1010
# every UTC 6PM from Mon to Fri
1111
- cron: "0 18 * * 1-5"
1212

13-
# Declare default permissions as read only.
14-
permissions: read-all
13+
permissions: {}
1514

1615
jobs:
17-
Trivy-scan:
18-
runs-on: ubuntu-latest
16+
Trivy:
17+
runs-on: ubuntu-22.04
1918
steps:
2019
- name: Checkout code
2120
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -27,27 +26,52 @@ jobs:
2726
run: python -m pip install --require-hashes --no-deps -r .ci/requirements.txt
2827
- name: Freeze dependencies
2928
run: pip-compile --extra=docs,base,mmlab,anomaly -o requirements.txt pyproject.toml
30-
- name: Trivy Scanning (spdx.json)
31-
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
29+
30+
- name: Run Trivy Scan (vuln)
31+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
3232
with:
33-
trivy-config: ".ci/trivy-json.yaml"
34-
scan-type: "fs"
33+
scan-type: fs
34+
scan-ref: requirements.txt
35+
scanners: vuln
36+
output: trivy-results-vuln.txt
37+
38+
- name: Run Trivy Scan (dockerfile and secrets)
39+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
40+
with:
41+
scan-type: fs
3542
scan-ref: .
36-
- name: Trivy Scanning
43+
scanners: misconfig,secret
44+
output: trivy-results-misconfig.txt
45+
skip-setup-trivy: true
46+
47+
- name: Trivy Scanning (spdx)
3748
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
3849
with:
39-
trivy-config: ".ci/trivy.yaml"
40-
scan-type: "fs"
50+
scan-type: fs
4151
scan-ref: .
52+
format: spdx-json
53+
output: trivy-results-spdx.json
54+
skip-setup-trivy: true
55+
4256
- name: Upload Trivy results artifact
4357
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
4458
with:
4559
name: trivy-results
46-
path: "${{ github.workspace }}/trivy-results.*"
60+
path: "${{ github.workspace }}/trivy-results-*"
61+
retention-days: 7
4762
# Use always() to always run this step to publish scan results when there are test failures
4863
if: ${{ always() }}
64+
65+
- name: Upload deps list
66+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
67+
if: always()
68+
with:
69+
name: python-deps-list
70+
path: "${{ github.workspace }}/requirements.txt"
71+
retention-days: 7
72+
4973
Bandit:
50-
runs-on: ubuntu-latest
74+
runs-on: ubuntu-22.04
5175
steps:
5276
- name: Checkout repository
5377
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
@@ -66,7 +90,87 @@ jobs:
6690
- name: Upload Bandit artifact
6791
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
6892
with:
69-
name: bandit-report
70-
path: .tox/bandit-report.txt
93+
name: bandit-results
94+
path: .tox/bandit-results.txt
95+
retention-days: 7
7196
# Use always() to always run this step to publish scan results when there are test failures
7297
if: ${{ always() }}
98+
99+
CodeQL:
100+
name: Analyze (${{ matrix.language }})
101+
runs-on: ubuntu-22.04
102+
permissions:
103+
# required for all workflows
104+
security-events: write
105+
106+
strategy:
107+
fail-fast: false
108+
matrix:
109+
include:
110+
- language: python
111+
build-mode: none
112+
- language: actions # to scan workflows
113+
build-mode: none
114+
steps:
115+
- name: Checkout repository
116+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
117+
118+
# Initializes the CodeQL tools for scanning.
119+
- name: Initialize CodeQL
120+
uses: github/codeql-action/init@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
121+
with:
122+
languages: ${{ matrix.language }}
123+
build-mode: ${{ matrix.build-mode }}
124+
125+
- name: Perform CodeQL Analysis
126+
uses: github/codeql-action/analyze@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0
127+
with:
128+
category: "/language:${{matrix.language}}"
129+
130+
- name: Generate CodeQL Report
131+
uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d # v3.0.4
132+
with:
133+
token: ${{ secrets.GITHUB_TOKEN }}
134+
template: report
135+
outputDir: codeql-${{ matrix.language }}
136+
137+
- name: Rename Report
138+
shell: bash
139+
continue-on-error: true
140+
run: |
141+
cd codeql-${{ matrix.language }}
142+
mv "report.pdf" "codeql-${{ matrix.language }}.pdf"
143+
144+
- name: Upload Report
145+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
146+
with:
147+
name: codeql-${{ matrix.language }}-results
148+
path: codeql-${{ matrix.language }}/*.pdf
149+
retention-days: 7
150+
151+
Summarize:
152+
needs: [Trivy, Bandit, CodeQL]
153+
if: always()
154+
runs-on: ubuntu-22.04
155+
steps:
156+
# Create directory first
157+
- name: Create results directory
158+
run: mkdir -p all-results
159+
160+
# Download artifacts with error handling
161+
- name: Download all results
162+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
163+
continue-on-error: true # Don't fail if some tools didn't generate results
164+
with:
165+
pattern: "*-results"
166+
merge-multiple: true
167+
path: all-results
168+
169+
# Only upload if there are files
170+
- name: Upload combined results
171+
if: hashFiles('all-results/**/*') != ''
172+
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
173+
with:
174+
name: security-scan-results
175+
path: all-results
176+
retention-days: 7

‎.github/workflows/codeql.yaml‎

Lines changed: 20 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,20 +12,11 @@
1212
name: "CodeQL"
1313

1414
on:
15-
push:
16-
branches:
17-
- develop
18-
- releases/**
1915
pull_request:
2016
types:
2117
- opened
2218
- reopened
2319
- synchronize
24-
schedule:
25-
- cron: "0 0 * * 0"
26-
27-
permissions:
28-
contents: read
2920

3021
jobs:
3122
analyze:
@@ -35,20 +26,20 @@ jobs:
3526
# - https://gh.io/supported-runners-and-hardware-resources
3627
# - https://gh.io/using-larger-runners
3728
# Consider using larger runners for possible analysis time improvements.
38-
runs-on: ubuntu-latest
29+
runs-on: ubuntu-22.04
3930
timeout-minutes: 60
4031
permissions:
4132
# required for all workflows
4233
security-events: write
4334

44-
# only required for workflows in private repositories
45-
actions: read
46-
contents: read
47-
4835
strategy:
4936
fail-fast: false
5037
matrix:
51-
language: ["python"]
38+
include:
39+
- language: python
40+
build-mode: none
41+
- language: actions # to scan workflows
42+
build-mode: none
5243
# CodeQL supports [ 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'swift' ]
5344
# Use only 'java-kotlin' to analyze code written in Java, Kotlin or both
5445
# Use only 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
@@ -63,6 +54,7 @@ jobs:
6354
uses: github/codeql-action/init@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
6455
with:
6556
languages: ${{ matrix.language }}
57+
build-mode: ${{ matrix.build-mode }}
6658
# If you wish to specify custom queries, you can do so here or in a config file.
6759
# By default, queries listed here will override any specified in a config file.
6860
# Prefix the list here with "+" to use these queries and those in the config file.
@@ -74,13 +66,24 @@ jobs:
7466
uses: github/codeql-action/analyze@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9
7567
with:
7668
category: "/language:${{matrix.language}}"
69+
7770
- name: Generate Security Report
7871
uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d # v3.0.4
7972
with:
8073
template: report
8174
token: ${{ secrets.GITHUB_TOKEN }}
75+
outputDir: codeql-${{ matrix.language }}
76+
77+
- name: Rename Report
78+
shell: bash
79+
continue-on-error: true
80+
run: |
81+
cd codeql-${{ matrix.language }}
82+
mv "report.pdf" "codeql-${{ matrix.language }}.pdf"
83+
8284
- name: GitHub Upload Release Artifacts
8385
uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
8486
with:
85-
name: codeql-report
86-
path: "./report.pdf"
87+
name: codeql-${{ matrix.language }}-results
88+
path: codeql-${{ matrix.language }}/*.pdf
89+
retention-days: 7

‎tox.ini‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ deps =
9999
allowlist_externals =
100100
bandit
101101
commands =
102-
- bandit -r -c .ci/ipas_default.config {toxinidir}/ -f txt -o {toxworkdir}/bandit-report.txt
102+
- bandit -r -c .ci/ipas_default.config -f txt -o {toxworkdir}/bandit-results.txt .
103103

104104

105105
[testenv:fuzzing]

0 commit comments

Comments
 (0)