Include SAST and SCA - #173
Conversation
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
|
Do you want to bump dependencies on this PR too or do it in a different PR. I think it's safe to bump packages now. The one SQL Injection thing probably just needs to use a SQLAlchemy function. We should also lock workflows to only run the ones on main, not from the PR now |
There was a problem hiding this comment.
Pull request overview
Adds automated security maintenance and scanning to the repository by introducing a GitHub Actions workflow for SAST/SCA and enabling Dependabot updates for both Python (uv) dependencies and GitHub Actions.
Changes:
- Add a scheduled/on-PR “Security” workflow that runs OpenGrep (SAST) and Trivy (SCA) and stores reports as CI artifacts.
- Add Dependabot configuration for
uvandgithub-actionsecosystems with weekly grouped updates.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/security.yml | Introduces SAST (OpenGrep) and SCA (Trivy) CI jobs that run on PRs, main pushes, and a weekly schedule. |
| .github/dependabot.yml | Enables weekly Dependabot updates for uv-managed Python dependencies and GitHub Actions versions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| - name: Upload Opengrep report | ||
| if: always() | ||
| uses: actions/upload-artifact@v7.0.1 | ||
| with: | ||
| name: opengrep-sarif | ||
| path: reports/opengrep.sarif | ||
| if-no-files-found: error | ||
| retention-days: 14 |
| - name: Upload Trivy reports | ||
| if: always() | ||
| uses: actions/upload-artifact@v7.0.1 | ||
| with: | ||
| name: trivy-reports | ||
| path: | | ||
| reports/trivy.sarif | ||
| reports/sbom.cdx.json | ||
| if-no-files-found: error | ||
| retention-days: 14 |
| curl --fail --location --silent --show-error \ | ||
| "https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_manylinux_x86" \ | ||
| --output "$RUNNER_TEMP/opengrep" | ||
| chmod 0555 "$RUNNER_TEMP/opengrep" | ||
| "$RUNNER_TEMP/opengrep" --version |
| permissions: | ||
| contents: read |
jbriones1
left a comment
jbriones1
left a comment
There was a problem hiding this comment.
I think we need to pin commit SHAs if we're using scanning tools, just to ensure we're not vulnerable to compromised new versions.
| branches: | ||
| - main | ||
| schedule: | ||
| - cron: "17 9 * * 1" |
There was a problem hiding this comment.
Kind of a random time to scan, but I guess it doesn't really matter.
There was a problem hiding this comment.
Oh it's Monday 2 minutes after Opengrep work
There was a problem hiding this comment.
Yeah supply chain exist, but pinning commit SHA will be hard for devs?
There was a problem hiding this comment.
Oh it's Monday 2 minutes after Opengrep work
Wouldn't this run at at 9:17 AM UTC, not 9:00 AM America/Vancouver? Isn't this the cron job for Opengrep? I wasn't sure, because dependabot runs at 9:15AM America/Vancouver, but this runs UTC.
There was a problem hiding this comment.
Yeah supply chain exist, but pinning commit SHA will be hard for devs?
Yeah, I guess.
- removed `google-api-python-client` since we don't have Google integration, but module still remains - bump FastAPI to 139.2
- mako: 1.3.11 -> 1.4.1 - starlette: 1.0.0 -> 1.6.0
This is a pull request to make sure the libraries and up to date so it's not vulnerable and codebase does not contain vulnerable coding pattern.