Security #320
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Run daily at midnight UTC | |
| - cron: '0 0 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| PYTHON_VERSION: "3.12" | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ env.PYTHON_VERSION }} | |
| cache: pip | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v7 | |
| with: | |
| enable-cache: true | |
| - name: Install dependencies | |
| run: | | |
| uv sync --dev | |
| uv pip install pip-audit | |
| - name: Run pip-audit | |
| run: | | |
| uv run pip-audit --progress-spinner off || true | |
| - name: Generate pip-audit report | |
| if: always() | |
| run: | | |
| uv run pip-audit --format markdown > audit-results.md 2>/dev/null || true | |
| echo "## Dependency Audit Results" >> $GITHUB_STEP_SUMMARY | |
| cat audit-results.md >> $GITHUB_STEP_SUMMARY || echo "No vulnerabilities found" >> $GITHUB_STEP_SUMMARY | |
| npm-audit: | |
| name: NPM Audit (ormai-ts) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| cache-dependency-path: ormai-ts/package-lock.json | |
| - name: Install dependencies | |
| working-directory: ormai-ts | |
| run: npm install | |
| - name: Run npm audit | |
| working-directory: ormai-ts | |
| run: npm audit --audit-level=high | |
| - name: Generate npm audit report | |
| if: always() | |
| working-directory: ormai-ts | |
| run: | | |
| npm audit --json > npm-audit-results.json 2>/dev/null || true | |
| echo "## NPM Audit Results" >> $GITHUB_STEP_SUMMARY | |
| npm audit 2>/dev/null >> $GITHUB_STEP_SUMMARY || echo "No vulnerabilities found" >> $GITHUB_STEP_SUMMARY | |
| codeql-analysis: | |
| name: CodeQL Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| security-events: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v4 | |
| with: | |
| languages: python, javascript-typescript | |
| queries: security-and-quality | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v4 | |
| secrets-scan: | |
| name: Secrets Scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'HEAD~1' || 'main' }} | |
| head: HEAD | |
| extra_args: --debug --only-verified | |
| security-report: | |
| name: Security Report | |
| runs-on: ubuntu-latest | |
| needs: [dependency-audit, npm-audit, codeql-analysis, secrets-scan] | |
| if: always() | |
| steps: | |
| - name: Check security scan results | |
| run: | | |
| echo "## Security Scan Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if [ "${{ needs.dependency-audit.result }}" == "success" ]; then | |
| echo "- Dependency Audit: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "- Dependency Audit: Failed/Skipped" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| if [ "${{ needs.npm-audit.result }}" == "success" ]; then | |
| echo "- NPM Audit: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "- NPM Audit: Failed/Skipped" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| if [ "${{ needs.codeql-analysis.result }}" == "success" ]; then | |
| echo "- CodeQL Analysis: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "- CodeQL Analysis: Failed/Skipped" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| if [ "${{ needs.secrets-scan.result }}" == "success" ]; then | |
| echo "- Secrets Scan: Passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "- Secrets Scan: Failed/Skipped" >> $GITHUB_STEP_SUMMARY | |
| fi |