fix(self-knowledge): told to check her registry, she reported it empty #4118
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Gates | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| sast: | |
| name: Static Analysis (CodeQL) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: python | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| dependency-audit: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: | | |
| pip install pip-audit | |
| pip install -r requirements/core.txt | |
| - name: pip-audit | |
| run: pip-audit --strict --desc | |
| - name: OSV Scanner | |
| uses: google/osv-scanner-action/osv-scanner-action@v2.3.8 | |
| with: | |
| scan-args: |- | |
| --lockfile=requirements_lock.txt | |
| secret-scan: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: TruffleHog Secret Scan | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| extra_args: --only-verified | |
| container-scan: | |
| name: Container Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Build container | |
| run: docker build -t aura:scan . | |
| - name: Trivy container scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'aura:scan' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| license-scan: | |
| name: Dependency License Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install and scan licenses | |
| run: | | |
| pip install pip-licenses | |
| pip install -r requirements/core.txt | |
| pip-licenses --format=json --output-file=license_report.json | |
| pip-licenses --allow-only="MIT;BSD;Apache Software License;ISC;Python Software Foundation License;BSD License" || echo "⚠️ License review needed" | |
| - name: Upload license report | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: license-report | |
| path: license_report.json | |
| sbom: | |
| name: SBOM Generation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Generate SBOM | |
| run: | | |
| pip install cyclonedx-bom | |
| pip install -r requirements/core.txt | |
| cyclonedx-py environment --output-format json -o sbom.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: sbom | |
| path: sbom.json | |
| governance-lint: | |
| name: Governance Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: pip install -r requirements/core.txt | |
| - name: Run governance lint | |
| run: python tools/lint_governance.py | |
| security-scan: | |
| name: Local Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: pip install -r requirements/core.txt | |
| - name: Run security scan | |
| run: python tools/security_scan.py |