Skip to content

Commit fc3bfc3

Browse files
ntkatholentkathole
committed
feat: Added CodeQL SAST scanning and detect-secrets pre-commit hook
Signed-off-by: ntkathole <nikhilkathole2683@gmail.com>
1 parent 7de3db1 commit fc3bfc3

File tree

2 files changed

+75
-0
lines changed

2 files changed

+75
-0
lines changed

‎.github/workflows/security.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: "Security"
2+
3+
on:
4+
push:
5+
branches: [master]
6+
pull_request:
7+
branches: [master]
8+
schedule:
9+
- cron: "0 6 * * 1"
10+
11+
jobs:
12+
codeql:
13+
name: CodeQL Analysis
14+
runs-on: ubuntu-latest
15+
timeout-minutes: 30
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
language: ["python", "javascript-typescript"]
25+
26+
steps:
27+
- name: Checkout repository
28+
uses: actions/checkout@v4
29+
30+
- name: Initialize CodeQL
31+
uses: github/codeql-action/init@v3
32+
with:
33+
languages: ${{ matrix.language }}
34+
35+
- name: Autobuild
36+
uses: github/codeql-action/autobuild@v3
37+
38+
- name: Perform CodeQL Analysis
39+
uses: github/codeql-action/analyze@v3
40+
with:
41+
category: "/language:${{ matrix.language }}"
42+
43+
safety:
44+
name: Dependency Security Scan
45+
runs-on: ubuntu-latest
46+
47+
steps:
48+
- name: Checkout repository
49+
uses: actions/checkout@v4
50+
51+
- name: Set up Python
52+
uses: actions/setup-python@v5
53+
with:
54+
python-version: "3.12"
55+
cache: "pip"
56+
57+
- name: Install project dependencies and safety
58+
run: |
59+
pip install safety
60+
pip install -e ".[ci]" || pip install -e .
61+
62+
- name: Run safety check
63+
run: safety check --output json || true

‎.pre-commit-config.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,15 @@ repos:
3131
files: ^infra/templates/|\.jinja2$|^docs/roadmap\.md$
3232
entry: make build-templates
3333
pass_filenames: false
34+
35+
- repo: https://github.com/Yelp/detect-secrets
36+
rev: v1.5.0
37+
hooks:
38+
- id: detect-secrets
39+
exclude: |
40+
(?x)^(
41+
.*\.lock|
42+
.*requirements.*\.txt|
43+
.*\.svg|
44+
.*\.html
45+
)$

0 commit comments

Comments
 (0)