Skip to content

Commit d4b6304

Browse files
thogue12thogue12
committed
updated workflow
1 parent 62566e8 commit d4b6304

10 files changed

Lines changed: 359 additions & 0 deletions

File tree

‎.DS_Store‎

6 KB
Binary file not shown.

‎.github/.DS_Store‎

6 KB
Binary file not shown.

‎.github/workflows/bringing-it-together.yml‎

Whitespace-only changes.

‎.github/workflows/build-image.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Build Docker Image
2+
on:
3+
workflow_dispatch:
4+
5+
permissions:
6+
contents: read
7+
security-events: write
8+
actions: read
9+
10+
jobs:
11+
# Build Docker Image
12+
build:
13+
name: Build Docker Image
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Build Docker Image
21+
run: |
22+
docker build -t awesome-fastapi:${{ github.sha }} .

‎.github/workflows/lint-format.yml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Linting and Formating checks
2+
on:
3+
workflow_dispatch:
4+
5+
permissions:
6+
contents: read
7+
security-events: write
8+
actions: read
9+
10+
jobs:
11+
# Run Pylint and Black formatter
12+
lint_format:
13+
name: Run lint and formatting checks with pylint and black
14+
runs-on: ubuntu-latest
15+
strategy:
16+
matrix:
17+
python-version: ["3.12.5"]
18+
19+
steps:
20+
- uses: actions/checkout@v4
21+
- name: 'Setup Python ${{ matrix.python-version}}'
22+
uses: actions/setup-python@v3
23+
with:
24+
python-version: '${{ matrix.python-version}}'
25+
26+
- name: Install dependencies
27+
run: |
28+
python -m pip install --upgrade pip
29+
pip install pylint
30+
pip install pylint black
31+
32+
- name: Run pylint
33+
run: pylint $(git ls-files '*.py')
34+
35+
- name: Run black
36+
run: black --check .

‎.github/workflows/main.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Main Workflow
2+
on:
3+
push:
4+
branches:
5+
- main
6+
7+
permissions:
8+
contents: read
9+
security-events: write
10+
actions: read
11+
12+
jobs:
13+
build-image:
14+
uses: ./.github/workflows/build-image.yml
15+
16+
lint-format:
17+
uses: ./.github/workflows/lint-format.yml
18+
needs: build-image
19+
20+
unit-sec-scan:
21+
uses: ./.github/workflows/unit-sec-test.yml
22+
needs: lint-format

‎.github/workflows/pr.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: PR Workflow
2+
on:
3+
pull_request_target:
4+
types:
5+
- opened
6+
- edited
7+
- synchronize
8+
- reopened
9+
10+
permissions:
11+
contents: read
12+
security-events: write
13+
actions: read
14+
15+
jobs:
16+
build-image:
17+
uses: ./.github/workflows/build-image.yml
18+
19+
lint-format:
20+
uses: ./.github/workflows/lint-format.yml
21+
needs: build-image
22+
23+
unit-sec-scan:
24+
uses: ./.github/workflows/unit-sec-test.yml
25+
needs: lint-format

‎.github/workflows/push-image.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Push Contianer to Docker Hub
2+
on:
3+
workflow_dispatch:
4+
5+
permissions:
6+
contents: read
7+
security-events: write
8+
actions: read
9+
10+
jobs:
11+
12+
docker:
13+
runs-on: ubuntu-latest
14+
steps:
15+
-
16+
name: login to Docker Hub
17+
uses: docker/login-action@v3
18+
with:
19+
username: ${{ secrets.DOCKERHUB_USERNAME }}
20+
password: ${{ secrets.DOCKERHUB_TOKEN }}
21+
-
22+
name: Set up QEMU
23+
uses: docker/setup-buildx-action@v3
24+
-
25+
name: Set up Docker Buildx
26+
uses: docker/setup-buildx-action@v3
27+
-
28+
name: Build and Push
29+
uses: docker/build-push-action@v6
30+
with:
31+
push: true
32+
tags: user/app:latest
33+

‎.github/workflows/unit-sec-test.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Unit and Security Testing
2+
on:
3+
workflow_dispatch:
4+
5+
6+
permissions:
7+
contents: read
8+
security-events: write
9+
actions: read
10+
11+
jobs:
12+
# Run unit test cases for the Docker image
13+
testing_phase:
14+
name: Run unit test
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout repository
19+
uses: actions/checkout@v4
20+
21+
- name: Install dependencies
22+
run: pip install -r requirements.txt
23+
24+
- name: Run tests
25+
run: pytest tests/
26+
27+
28+
# Run snyk code scanning for vulnerabilities
29+
snyk_scan:
30+
permissions:
31+
contents: read
32+
security-events: write
33+
actions: read
34+
runs-on: ubuntu-latest
35+
steps:
36+
- uses: actions/checkout@v4
37+
- name: Set up Python
38+
uses: actions/setup-python@v4
39+
with:
40+
python-version: "3.12.5"
41+
42+
43+
- name: Install dependencies
44+
run: pip install -r requirements.txt
45+
46+
- name: Install Snyk CLI
47+
uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
48+
49+
env:
50+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
51+
- name: Snyk Code test
52+
run: snyk code test --sarif > snyk-cide.sarif
53+
54+
- name: Snyk Test Dependencies
55+
run: snyk test
56+
57+
58+
# Scan the contianer and lists all security vulnerabilities
59+
trivy_scans:
60+
name: Run Trivy security scanner against the image
61+
runs-on: ubuntu-latest
62+
steps:
63+
- name: Checkout code
64+
uses: actions/checkout@v4
65+
66+
- name: Run Trivy vulnerability scanner
67+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
68+
with:
69+
image-ref: 'awesome-fastapi:${{ github.sha }}'
70+
format: 'template'
71+
template: '@/contrib/sarif.tpl'
72+
output: 'GitHub Actions/Trivy Automation'
73+
severity: 'CRITICAL,HIGH'
74+
75+
- name: Upload Trivy scan results to GitHub Security tab
76+
uses: github/codeql-action/upload-sarif@v3
77+
with:
78+
sarif_file: 'trivy-results.sarif'
79+
80+
owasp_zap_scan:
81+
runs-on: ubuntu-latest
82+
name: app scan
83+
steps:
84+
- name: Checkout
85+
uses: actions/checkout@v4
86+
with:
87+
ref: master
88+
89+
- name: zap scan
90+
uses: zaproxy/action-api-scan@v0.9.0
91+
with:
92+
token: ${{ secrets.GITHUB_TOKEN}}
93+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
94+
format: openapi
95+
target: '<fast-api-url>'
96+
rules_file_name: '.zap/rules.tsv'
97+
cmd_options: '-a'

‎DevSecOps-Pipeline.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: DevSecOps Pipeline
2+
on:
3+
pull_request:
4+
branches:
5+
- main
6+
7+
permissions:
8+
contents: read
9+
security-events: write
10+
actions: read
11+
12+
jobs:
13+
14+
# Build Docker Image
15+
build:
16+
name: Build Docker Image
17+
runs-on: ubuntu-latest
18+
19+
steps:
20+
- name: Checkout code
21+
uses: actions/checkout@v4
22+
23+
- name: Build Docker Image
24+
run: |
25+
docker build -t awesome-fastapi:${{ github.sha }} .
26+
27+
28+
# Run Pylint and Black formatter
29+
lint_format:
30+
name: Run lint and formatting checks with pylint and black
31+
runs-on: ubuntu-latest
32+
strategy:
33+
matrix:
34+
python-version: ["3.12", "3.13"]
35+
36+
steps:
37+
- uses: actions/checkout@v4
38+
- name: 'Setup Python ${{ matrix.python-version}}'
39+
uses: actions/setup-python@v3
40+
with:
41+
python-version: '${{ matrix.python-version}}'
42+
43+
- name: Install dependencies
44+
run: |
45+
python -m pip install --upgrade pip
46+
pip install pylint
47+
pip install pylint black
48+
49+
- name: Run pylint
50+
run: pylint $(git ls-files '*.py')
51+
52+
- name: Run black
53+
run: black --check .
54+
55+
56+
# Run unit test cases for the Docker image
57+
testing_phase:
58+
name: Run unit test
59+
runs-on: ubuntu-latest
60+
61+
steps:
62+
- name: Checkout repository
63+
uses: actions/checkout@v4
64+
65+
- name: Install dependencies
66+
run: pip install -r requirements.txt
67+
68+
- name: Run tests
69+
run: pytest
70+
71+
72+
# Run snyk code scanning for vulnerabilities
73+
snyk_scan:
74+
permissions:
75+
contents: read
76+
security-events: write
77+
actions: read
78+
runs-on: ubuntu-latest
79+
steps:
80+
- uses: actions/checkout@v4
81+
- name: Set up Python
82+
uses: actions/setup-python@v4
83+
with:
84+
python-version: ["3.12", "3.13"]
85+
86+
87+
- name: Install dependencies
88+
run: pip install -r requirements.txt
89+
90+
- name: Install Snyk CLI
91+
uses: snyk/actions/setup@806182742461562b67788a64410098c9d9b96adb
92+
93+
env:
94+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
95+
- name: Snyk Code test
96+
run: snyk code test --sarif > snyk-cide.sarif
97+
98+
- name: Snyk Test Dependencies
99+
run: snyk test
100+
101+
102+
# Scan the contianer and lists all security vulnerabilities
103+
trivy_scans:
104+
name: Run Trivy security scanner against the image
105+
runs-on: ubuntu-latest
106+
steps:
107+
- name: Checkout code
108+
uses: actions/checkout@v4
109+
110+
- name: Run Trivy vulnerability scanner
111+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
112+
with:
113+
image-ref: 'awesome-fastapi:${{ github.sha }}'
114+
format: 'template'
115+
template: '@/contrib/sarif.tpl'
116+
output: 'GitHub Actions/Trivy Automation'
117+
severity: 'CRITICAL,HIGH'
118+
119+
- name: Upload Trivy scan results to GitHub Security tab
120+
uses: github/codeql-action/upload-sarif@v3
121+
with:
122+
sarif_file: 'trivy-results.sarif'
123+
124+

0 commit comments

Comments
 (0)