Update deploy scripts

Author: DataWizual

.env

@@ -0,0 +1 @@
+DATABASE_PASSWORD='super_secret_password_123'

.github/workflows/sentinel.yml

@@ -0,0 +1,43 @@
+name: Sentinel Security Gate
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  security-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      - name: Install Sentinel
+        env:
+          INSTALL_TOKEN: ${{ secrets.SENTINEL_INSTALL_TOKEN }}
+        run: |
+          python -m pip install --upgrade pip
+          # Admin must replace placeholder with their private repo
+          pip install git+https://x-access-token:${INSTALL_TOKEN}@github.com/[YOUR_ORG/YOUR_SENTINEL_REPO].git@main
+      
+      - name: Execute Security Scan
+        id: scan_step
+        env:
+          # Automatically binds reporting to the client's repository
+          SENTINEL_AUTHORIZED_REPO: ${{ github.repository }}
+          SENTINEL_ALERT_TOKEN: ${{ secrets.SENTINEL_ALERT_TOKEN }}
+        run: sentinel scan . --report
+        continue-on-error: true
+
+      - name: Upload Security Report
+        if: steps.scan_step.outcome == 'failure'
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08
+        with:
+          name: sentinel-security-report
+          path: sentinel_report.html
+          retention-days: 7
+
+      - name: Terminate on Failure
+        if: steps.scan_step.outcome == 'failure'
+        run: exit 1

.gitignore

@@ -0,0 +1,32 @@
+# English technical comments for the repository protection
+
+# Virtual environments (Do not track local Python copies)
+venv/
+.venv/
+env/
+
+# Python byte-code and runtime cache
+__pycache__/
+*.py[cod]
+*$py.class
+
+# Distribution and Build artifacts (Generated by setup.py)
+dist/
+build/
+*.egg-info/
+*.zip
+*.tar.gz
+
+# Sentinel dynamic reports (Reports should be generated fresh each time)
+sentinel_report.html
+
+# IDE and Editor settings (Local development configs)
+.vscode/
+.idea/
+*.swp
+.DS_Store
+
+# Testing and Coverage
+.pytest_cache/
+.coverage
+htmlcov/

Dockerfile

@@ -0,0 +1 @@
+FROM node:latest

hack_test.py

@@ -0,0 +1 @@
+DB_PASS = '1234567890'

requirements.txt

@@ -0,0 +1,6 @@
+# Project-level dependencies for Sentinel Core
+# These versions are pinned for production stability
+
+click==8.1.7
+pyyaml==6.0.1
+requests==2.31.0

secrets.py

@@ -0,0 +1 @@
+aws_key = 'AKIAIMNO789012345678'

sentinel.yaml

@@ -0,0 +1,11 @@
+ignore:
+- venv/*
+- .git/*
+- node_modules/*
+- sentinel/rules/secrets/*
+- sentinel_report.html
+overrides: []
+severity:
+  INFRA-001: BLOCK
+  SEC-001: BLOCK
+  SUPPLY-001: BLOCK

temp_check.py

@@ -0,0 +1 @@
+ADMIN_PASSWORD = 'password12345'

test_infra.tf

@@ -0,0 +1,8 @@
+resource "aws_security_group" "bad_example" {
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"] # Это вызовет срабатывание правила INFRA-002
+  }
+}