tests fixed and cleanup.yaml too #25
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scanning | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Run weekly security scans on Sundays at 2 AM UTC | |
| - cron: '0 2 * * 0' | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| env: | |
| AWS_REGION: eu-west-1 | |
| jobs: | |
| dependency-security-scan: | |
| name: Dependency Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| continue-on-error: true | |
| - name: Set up Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: "3.9" | |
| continue-on-error: true | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install safety bandit | |
| continue-on-error: true | |
| - name: Run Safety check for known vulnerabilities | |
| run: | | |
| echo "## 🔍 Dependency Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if safety check --json --output safety-report.json; then | |
| echo "✅ No known vulnerabilities found in dependencies" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "⚠️ Vulnerabilities found in dependencies" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Safety Report:" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| safety check --output text >> $GITHUB_STEP_SUMMARY || true | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| continue-on-error: true | |
| - name: Run Bandit security linter | |
| run: | | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## 🛡️ Static Code Security Analysis" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| if bandit -r src/ -f json -o bandit-report.json; then | |
| echo "✅ No security issues found in code" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "⚠️ Potential security issues found" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Bandit Report:" >> $GITHUB_STEP_SUMMARY | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| bandit -r src/ -f txt >> $GITHUB_STEP_SUMMARY || true | |
| echo "\`\`\`" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| continue-on-error: true | |
| - name: Upload security scan artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: security-reports | |
| path: | | |
| safety-report.json | |
| bandit-report.json | |
| retention-days: 30 | |
| continue-on-error: true | |
| secrets-scan: | |
| name: Secrets Detection | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Fetch full history for comprehensive scan | |
| continue-on-error: true | |
| - name: Run TruffleHog secrets scan | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| path: ./ | |
| base: main | |
| head: HEAD | |
| extra_args: --debug --only-verified | |
| continue-on-error: true | |
| docker-security-scan: | |
| name: Docker Image Security Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| continue-on-error: true | |
| - name: Build Docker image for scanning | |
| run: | | |
| docker build -t document-categoriser:security-scan . | |
| continue-on-error: true | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'document-categoriser:security-scan' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Upload Trivy scan results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| continue-on-error: true | |
| - name: Run Trivy for human-readable output | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'document-categoriser:security-scan' | |
| format: 'table' | |
| severity: 'CRITICAL,HIGH' | |
| exit-code: '1' # Fail the build if critical/high vulnerabilities found | |
| continue-on-error: true | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'python', 'javascript' ] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| continue-on-error: true | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| queries: security-extended,security-and-quality | |
| continue-on-error: true | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| continue-on-error: true | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| continue-on-error: true | |
| security-summary: | |
| name: Security Scan Summary | |
| runs-on: ubuntu-latest | |
| needs: [dependency-security-scan, secrets-scan, docker-security-scan, codeql-analysis] | |
| if: always() | |
| steps: | |
| - name: Create security summary | |
| run: | | |
| echo "# 🔒 Security Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## Scan Status Overview" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "| Scan Type | Status |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-----------|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| Dependency Security | ${{ needs.dependency-security-scan.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Secrets Detection | ${{ needs.secrets-scan.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| Docker Security | ${{ needs.docker-security-scan.result == 'success' && '✅ Passed' || (needs.docker-security-scan.result == 'failure' && '❌ Failed') || '⏭️ Skipped' }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "| CodeQL Analysis | ${{ needs.codeql-analysis.result == 'success' && '✅ Passed' || '❌ Failed' }} |" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| # Determine overall security status | |
| if [[ "${{ needs.dependency-security-scan.result }}" == "success" && \ | |
| "${{ needs.secrets-scan.result }}" == "success" && \ | |
| ("${{ needs.docker-security-scan.result }}" == "success" || "${{ needs.docker-security-scan.result }}" == "skipped") && \ | |
| "${{ needs.codeql-analysis.result }}" == "success" ]]; then | |
| echo "## ✅ Overall Security Status: PASSED" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "All security scans completed successfully. No critical issues detected." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "## ⚠️ Overall Security Status: ATTENTION REQUIRED" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "One or more security scans detected issues that require attention." >> $GITHUB_STEP_SUMMARY | |
| echo "Please review the scan results and address any critical or high-severity findings." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "## 📋 Next Steps" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "1. Review detailed scan results in the Security tab" >> $GITHUB_STEP_SUMMARY | |
| echo "2. Address any critical or high-severity vulnerabilities" >> $GITHUB_STEP_SUMMARY | |
| echo "3. Update dependencies if necessary" >> $GITHUB_STEP_SUMMARY | |
| echo "4. Re-run scans after making fixes" >> $GITHUB_STEP_SUMMARY | |
| continue-on-error: true |