Hiten Shah
68 lines
2.2 KiB
YAML
68 lines
2.2 KiB
YAML
name: Security
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
dependency-audit:
|
|
name: Dependency audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v5
|
|
|
|
- name: Set up Python
|
|
run: uv python install 3.12
|
|
|
|
- name: Export locked dependency set
|
|
run: |
|
|
uv export \
|
|
--locked \
|
|
--all-groups \
|
|
--no-hashes \
|
|
--format requirements.txt \
|
|
--output-file /tmp/last30days-requirements.txt
|
|
|
|
# Advisory-first: visibility before enforcement. This repo handles API keys,
|
|
# cookies, browser tokens, and local env files, so dependency CVEs should be
|
|
# visible in CI logs even before the project has a clean blocking baseline.
|
|
# Set continue-on-error: false once a clean baseline run is confirmed.
|
|
- name: Run pip-audit against locked dependencies
|
|
continue-on-error: true
|
|
run: uvx --python 3.12 pip-audit -r /tmp/last30days-requirements.txt --progress-spinner=off
|
|
|
|
secret-scan:
|
|
name: Secret scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout full history for diff-aware scanning
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
# Advisory-first: this reports verified secrets in pull requests and pushes to
|
|
# main, but does not block merges until maintainers confirm a clean baseline.
|
|
# The TruffleHog action automatically scans the PR range for pull_request
|
|
# events and the pushed commit range for push events.
|
|
# Set continue-on-error: false once a clean baseline run is confirmed.
|
|
# Contributor policy: never commit real secrets in fixtures, tests, docs, or
|
|
# examples; use obvious dummy values and env-based auth patterns instead.
|
|
- name: Run TruffleHog OSS secret scan
|
|
if: github.event_name == 'pull_request' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'
|
|
uses: trufflesecurity/trufflehog@v3.95.2
|
|
continue-on-error: true
|
|
with:
|
|
path: ./
|
|
version: v3.95.2
|
|
extra_args: --only-verified
|