Repository navigation
ci: add permissions block and make security checks blocking - #145
Conversation
- Add permissions: contents: read to ci.yml (least-privilege GITHUB_TOKEN) - Replace safety with pip-audit (open-source, uses OSV database) - Split security checks into separate blocking steps (remove || true) - Upload bandit report with if: always() for visibility on failures Part of EOPF-Explorer/coordination#239 Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
| continue-on-error: true | ||
|
|
||
| - name: Run pip-audit (dependency vulnerability scan) | ||
| run: pip-audit -f json -o pip-audit-report.json |
There was a problem hiding this comment.
which dependencies is this auditing? Because I don't think the package is installed at this point in the workflow, so maybe you need to point this at a lockfile? or install the package first.
There was a problem hiding this comment.
thank you! a key issue indeed! will raise a fix to make sure we export the list from the lockfile
There was a problem hiding this comment.
it should be fixed now @d-v-b What do you think? I am using uv export --no-dev --no-emit-project --format requirements-txt to export the dependencies of the project
| return bool(high) | ||
|
|
||
|
|
||
| def check_pip_audit() -> bool: |
There was a problem hiding this comment.
can we use https://github.com/pypa/gh-action-pip-audit instead of this custom script?
There was a problem hiding this comment.
I looked but it can't replicate fixable-only blocking.
| from pathlib import Path | ||
|
|
||
|
|
||
| def check_bandit() -> bool: |
There was a problem hiding this comment.
There was a problem hiding this comment.
it would be great but they are not supporting full-length commit SHAs yet. I raised an issue 🤞
There was a problem hiding this comment.
Issue is here: PyCQA/bandit-action#28 . I created a fork with the fix. It's the action I pinned. Is it acceptable? @d-v-b , I can maybe open an issue on the repo to keep track of this?
There was a problem hiding this comment.
I am in the process of creating an action for this. I think it will be better so it can easily be reuse in various project. Will update the project with the dependencies when it is done. I may ask also to get it transfered to developmentseed org
Use the official PyCQA/bandit-action (v1.0.1, pinned to SHA) instead of running bandit manually and post-processing JSON output. Setting level: high preserves the existing policy (only HIGH severity blocks CI); MEDIUM/LOW findings now appear in the GitHub Security tab via SARIF instead of the PR comment. pip-audit and its fixable-only blocking logic are unchanged, as gh-action-pip-audit cannot replicate that behaviour natively. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
Summary
Part of the supply-chain security hardening tracked in EOPF-Explorer/coordination#239.
eopf_geozarr/(missingsrc/prefix), producing empty reportscontinue-on-error: trueso pip-audit is never skipped when bandit finds issuespip-audit -f json -o pip-audit-report.jsonfor structured parsinggh apito avoid duplicate comments); shows HIGH issues in a detail table, directs to artifact for lower-severity findings.github/scripts/security_summary.pyand.github/scripts/security_check.pyfor linting and formattingpull-requests: writepermission added to thesecurityjob (job-level, not workflow-level)security-reportsartifact (bandit + pip-audit)Test plan
src/eopf_geozarr/correctly — no more empty report errorbandit-report.jsonandpip-audit-report.json🤖 Generated with Claude Code