Security Scan #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # Every Monday at 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| trivy-containers: | |
| name: Trivy Container Scan | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| component: | |
| - inference-monitor | |
| - training-monitor | |
| - correlation-engine | |
| - audit-ledger | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Determine build context | |
| id: ctx | |
| run: | | |
| # Rust components use repo-root context; Python components use their own dir | |
| case "${{ matrix.component }}" in | |
| correlation-engine|audit-ledger) echo "dir=." >> "$GITHUB_OUTPUT" ;; | |
| *) echo "dir=${{ matrix.component }}" >> "$GITHUB_OUTPUT" ;; | |
| esac | |
| - name: Build image | |
| run: | | |
| docker build -t sentinel-${{ matrix.component }}:scan \ | |
| -f ${{ matrix.component }}/packaging/Dockerfile \ | |
| ${{ steps.ctx.outputs.dir }}/ | |
| continue-on-error: true | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: sentinel-${{ matrix.component }}:scan | |
| format: sarif | |
| output: trivy-${{ matrix.component }}.sarif | |
| severity: CRITICAL,HIGH | |
| exit-code: 0 | |
| - name: Upload Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: trivy-${{ matrix.component }}.sarif | |
| category: trivy-${{ matrix.component }} | |
| cargo-audit: | |
| name: Cargo Audit | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Audit correlation-engine | |
| working-directory: correlation-engine | |
| run: cargo audit --json | tee audit-correlation.json | |
| continue-on-error: true | |
| - name: Audit audit-ledger | |
| working-directory: audit-ledger | |
| run: cargo audit --json | tee audit-ledger.json | |
| continue-on-error: true | |
| - name: Upload audit results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: cargo-audit-results | |
| path: | | |
| correlation-engine/audit-correlation.json | |
| audit-ledger/audit-ledger.json | |
| pip-audit: | |
| name: pip-audit | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| component: | |
| - inference-monitor | |
| - training-monitor | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install pip-audit | |
| run: pip install pip-audit | |
| - name: Install component dependencies | |
| working-directory: ${{ matrix.component }} | |
| run: pip install -e . | |
| - name: Run pip-audit | |
| working-directory: ${{ matrix.component }} | |
| run: pip-audit --format=json --output=pip-audit.json | |
| continue-on-error: true | |
| - name: Upload audit results | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: pip-audit-${{ matrix.component }} | |
| path: ${{ matrix.component }}/pip-audit.json | |
| codeql: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [python] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: codeql-${{ matrix.language }} | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-22.04 | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/dependency-review-action@v3 | |
| with: | |
| fail-on-severity: critical |