Skip to content

Security Scan

Security Scan #2

Workflow file for this run

name: Security Scan
on:
schedule:
- cron: "0 6 * * 1" # Every Monday at 06:00 UTC
workflow_dispatch:
permissions:
contents: read
security-events: write
jobs:
trivy-containers:
name: Trivy Container Scan
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
component:
- inference-monitor
- training-monitor
- correlation-engine
- audit-ledger
steps:
- uses: actions/checkout@v4
- name: Determine build context
id: ctx
run: |
# Rust components use repo-root context; Python components use their own dir
case "${{ matrix.component }}" in
correlation-engine|audit-ledger) echo "dir=." >> "$GITHUB_OUTPUT" ;;
*) echo "dir=${{ matrix.component }}" >> "$GITHUB_OUTPUT" ;;
esac
- name: Build image
run: |
docker build -t sentinel-${{ matrix.component }}:scan \
-f ${{ matrix.component }}/packaging/Dockerfile \
${{ steps.ctx.outputs.dir }}/
continue-on-error: true
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: sentinel-${{ matrix.component }}:scan
format: sarif
output: trivy-${{ matrix.component }}.sarif
severity: CRITICAL,HIGH
exit-code: 0
- name: Upload Trivy scan results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: trivy-${{ matrix.component }}.sarif
category: trivy-${{ matrix.component }}
cargo-audit:
name: Cargo Audit
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4
- name: Install cargo-audit
run: cargo install cargo-audit
- name: Audit correlation-engine
working-directory: correlation-engine
run: cargo audit --json | tee audit-correlation.json
continue-on-error: true
- name: Audit audit-ledger
working-directory: audit-ledger
run: cargo audit --json | tee audit-ledger.json
continue-on-error: true
- name: Upload audit results
uses: actions/upload-artifact@v4
with:
name: cargo-audit-results
path: |
correlation-engine/audit-correlation.json
audit-ledger/audit-ledger.json
pip-audit:
name: pip-audit
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
component:
- inference-monitor
- training-monitor
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
- name: Install pip-audit
run: pip install pip-audit
- name: Install component dependencies
working-directory: ${{ matrix.component }}
run: pip install -e .
- name: Run pip-audit
working-directory: ${{ matrix.component }}
run: pip-audit --format=json --output=pip-audit.json
continue-on-error: true
- name: Upload audit results
uses: actions/upload-artifact@v4
with:
name: pip-audit-${{ matrix.component }}
path: ${{ matrix.component }}/pip-audit.json
codeql:
name: CodeQL Analysis
runs-on: ubuntu-22.04
strategy:
fail-fast: false
matrix:
language: [python]
steps:
- uses: actions/checkout@v4
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
- name: Autobuild
uses: github/codeql-action/autobuild@v3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: codeql-${{ matrix.language }}
dependency-review:
name: Dependency Review
runs-on: ubuntu-22.04
if: github.event_name == 'pull_request'
steps:
- uses: actions/checkout@v4
- uses: actions/dependency-review-action@v3
with:
fail-on-severity: critical