Skip to content

Commit 4fd2d45

Browse files
tmikula-devtmikula-dev
authored
Trivy Scanning tool pilot implementation (#72)
* Trivy Scanning tool pilot implementation
1 parent 4af9f10 commit 4fd2d45

10 files changed

Lines changed: 495 additions & 179 deletions

File tree

‎.github/workflows/check_docker.yml‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# TODO: Trivy scan for Dockerfile will be enabled in the upcoming issue: https://github.com/AbsaOSS/EventGate/issues/74
2+
#name: Docker Check
3+
#
4+
#on:
5+
# pull_request:
6+
# types: [ opened, synchronize, reopened ]
7+
# push:
8+
# branches: [ master ]
9+
# workflow_dispatch:
10+
#
11+
#concurrency:
12+
# group: static-docker-check-${{ github.ref }}
13+
# cancel-in-progress: true
14+
#
15+
#permissions:
16+
# contents: read
17+
# security-events: write
18+
#
19+
#jobs:
20+
# detect:
21+
# name: Docker Changes Detection
22+
# runs-on: ubuntu-latest
23+
# outputs:
24+
# docker_changed: ${{ steps.changes.outputs.docker_changed }}
25+
# steps:
26+
# - name: Checkout repository
27+
# uses: actions/checkout@v5
28+
# with:
29+
# persist-credentials: false
30+
# fetch-depth: 0
31+
#
32+
# - name: Check if docker file changed
33+
# id: changes
34+
# shell: bash
35+
# run: |
36+
# if [[ "${{ github.event_name }}" == "pull_request" ]]; then
37+
# RANGE="${{ github.event.pull_request.base.sha }}...${{ github.sha }}"
38+
# else
39+
# RANGE="${{ github.sha }}~1...${{ github.sha }}"
40+
# fi
41+
# if git diff --name-only "$RANGE" | grep -qE '^Dockerfile$'; then
42+
# echo "docker_changed=true" >> "$GITHUB_OUTPUT"
43+
# else
44+
# echo "docker_changed=false" >> "$GITHUB_OUTPUT"
45+
# fi
46+
#
47+
# trivy-docker:
48+
# name: Trivy Security Scan
49+
# needs: detect
50+
# if: needs.detect.outputs.docker_changed == 'true'
51+
# runs-on: ubuntu-latest
52+
# steps:
53+
# - name: Checkout repository
54+
# uses: actions/checkout@v5
55+
# with:
56+
# persist-credentials: false
57+
# fetch-depth: 0
58+
#
59+
# - name: Setup Trivy
60+
# uses: aquasecurity/setup-trivy@v0.2.4
61+
#
62+
# - name: Trivy security scan
63+
# run: |
64+
# trivy config Dockerfile \
65+
# --format sarif \
66+
# --output $GITHUB_WORKSPACE/trivy_dockerfile.sarif
67+
#
68+
# - name: Upload Dockerfile SARIF
69+
# uses: github/codeql-action/upload-sarif@v4
70+
# with:
71+
# sarif_file: ${{ github.workspace }}/trivy_dockerfile.sarif
72+
#
73+
# noop:
74+
# name: No Operation
75+
# needs: detect
76+
# if: needs.detect.outputs.docker_changed != 'true'
77+
# runs-on: ubuntu-latest
78+
# steps:
79+
# - run: echo "No changes in the Dockerfile — passing."

‎.github/workflows/check_pr_release_notes.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Check PR Release Notes in Description
1+
name: Check PR Release Notes
22

33
on:
44
pull_request:
@@ -7,6 +7,7 @@ on:
77

88
jobs:
99
check-release-notes:
10+
name: Check PR Release Notes
1011
runs-on: ubuntu-latest
1112

1213
steps:

‎.github/workflows/check_python.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
name: Python Check
2+
3+
on:
4+
pull_request:
5+
types: [ opened, synchronize, reopened ]
6+
push:
7+
branches: [ master ]
8+
workflow_dispatch:
9+
10+
concurrency:
11+
group: static-python-check-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
permissions:
15+
contents: read
16+
security-events: write
17+
18+
jobs:
19+
detect:
20+
name: Python Changes Detection
21+
runs-on: ubuntu-latest
22+
outputs:
23+
python_changed: ${{ steps.changes.outputs.python_changed }}
24+
steps:
25+
- name: Checkout repository
26+
uses: actions/checkout@v5
27+
with:
28+
persist-credentials: false
29+
fetch-depth: 0
30+
31+
- name: Check if Python files changed
32+
id: changes
33+
shell: bash
34+
run: |
35+
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
36+
RANGE="${{ github.event.pull_request.base.sha }}...${{ github.sha }}"
37+
else
38+
RANGE="${{ github.sha }}~1...${{ github.sha }}"
39+
fi
40+
if git diff --name-only "$RANGE" -- '*.py' | grep -q .; then
41+
echo "python_changed=true" >> "$GITHUB_OUTPUT"
42+
else
43+
echo "python_changed=false" >> "$GITHUB_OUTPUT"
44+
fi
45+
46+
pylint-analysis:
47+
name: Pylint Static Code Analysis
48+
needs: detect
49+
if: needs.detect.outputs.python_changed == 'true'
50+
runs-on: ubuntu-latest
51+
steps:
52+
- name: Checkout repository
53+
uses: actions/checkout@v5
54+
with:
55+
persist-credentials: false
56+
fetch-depth: 0
57+
58+
- name: Set up Python
59+
uses: actions/setup-python@v6
60+
with:
61+
python-version: '3.13'
62+
cache: 'pip'
63+
64+
- name: Install dependencies
65+
run: pip install -r requirements.txt
66+
67+
- name: Analyze code with Pylint
68+
id: analyze-code
69+
run: |
70+
pylint_score=$(pylint $(git ls-files '*.py')| grep 'rated at' | awk '{print $7}' | cut -d'/' -f1)
71+
echo "PYLINT_SCORE=$pylint_score" >> $GITHUB_ENV
72+
73+
- name: Check Pylint score
74+
run: |
75+
if (( $(echo "$PYLINT_SCORE < 9.5" | bc -l) )); then
76+
echo "Failure: Pylint score is below 9.5 (project score: $PYLINT_SCORE)."
77+
exit 1
78+
else
79+
echo "Success: Pylint score is above 9.5 (project score: $PYLINT_SCORE)."
80+
fi
81+
82+
black-check:
83+
name: Black Format Check
84+
needs: detect
85+
if: needs.detect.outputs.python_changed == 'true'
86+
runs-on: ubuntu-latest
87+
steps:
88+
- name: Checkout repository
89+
uses: actions/checkout@v5
90+
with:
91+
persist-credentials: false
92+
fetch-depth: 0
93+
94+
- name: Set up Python
95+
uses: actions/setup-python@v6
96+
with:
97+
python-version: '3.13'
98+
cache: 'pip'
99+
100+
- name: Install dependencies
101+
run: pip install -r requirements.txt
102+
103+
- name: Check code format with Black
104+
id: check-format
105+
run: black --check $(git ls-files '*.py')
106+
107+
pytest-test:
108+
name: Pytest Unit Tests with Coverage
109+
needs: detect
110+
if: needs.detect.outputs.python_changed == 'true'
111+
runs-on: ubuntu-latest
112+
steps:
113+
- name: Checkout repository
114+
uses: actions/checkout@v5
115+
with:
116+
persist-credentials: false
117+
fetch-depth: 0
118+
119+
- uses: actions/setup-python@v6
120+
with:
121+
python-version: '3.13'
122+
cache: 'pip'
123+
124+
- name: Install Python dependencies
125+
run: pip install -r requirements.txt
126+
127+
- name: Check code coverage with Pytest
128+
run: pytest --cov=. -v tests/ --cov-fail-under=80
129+
130+
mypy-check:
131+
name: Mypy Type Check
132+
needs: detect
133+
if: needs.detect.outputs.python_changed == 'true'
134+
runs-on: ubuntu-latest
135+
steps:
136+
- name: Checkout repository
137+
uses: actions/checkout@v5
138+
with:
139+
persist-credentials: false
140+
fetch-depth: 0
141+
142+
- name: Set up Python
143+
uses: actions/setup-python@v6
144+
with:
145+
python-version: '3.13'
146+
cache: 'pip'
147+
148+
- name: Install dependencies
149+
run: pip install -r requirements.txt
150+
151+
- name: Check types with Mypy
152+
id: check-types
153+
run: mypy .
154+
155+
noop:
156+
name: No Operation
157+
needs: detect
158+
if: needs.detect.outputs.python_changed != 'true'
159+
runs-on: ubuntu-latest
160+
steps:
161+
- run: echo "No changes in the *.py files — passing."

0 commit comments

Comments
 (0)