Made SSL verification configurable and added code scans

Signed-off-by: arpannookala-12 <ganesh.arpan.nookala@cloud2labs.com>

Author: arpannookala-12

.github/workflows/code-scans.yaml

@@ -0,0 +1,98 @@
+name: SDLE Scans
+
+on:
+  workflow_dispatch:
+    inputs:
+      PR_number:
+        description: 'Pull request number'
+        required: true
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: sdle-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+# -----------------------------
+# 1) Trivy Scan (fixed)
+# -----------------------------
+  trivy_scan:
+    name: Trivy Vulnerability Scan
+    runs-on: ubuntu-latest
+    env:
+      TRIVY_REPORT_FORMAT: table
+      TRIVY_SCAN_TYPE: fs
+      TRIVY_SCAN_PATH: .
+      TRIVY_EXIT_CODE: '1'
+      TRIVY_VULN_TYPE: os,library
+      TRIVY_SEVERITY: CRITICAL,HIGH
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Create report directory
+        run: mkdir -p trivy-reports
+        
+      - name: Run Trivy FS Scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          scanners: 'vuln,misconfig,secret,license'
+          ignore-unfixed: true
+          format: 'table'
+          exit-code: '1'
+          output: 'trivy-reports/trivy_scan_report.txt'
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Upload Trivy Report
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-report
+          path: trivy-reports/trivy_scan_report.txt
+      - name: Show Trivy Report in Logs
+        if: failure()
+        run: |
+          echo "========= TRIVY FINDINGS ========="
+          cat trivy-reports/trivy_scan_report.txt
+          echo "================================="
+
+# -----------------------------
+# 2) Bandit Scan
+# -----------------------------
+  bandit_scan:
+    name: Bandit security scan
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        submodules: 'recursive'
+        fetch-depth: 0
+    - uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+    - name: Install Bandit
+      run: pip install bandit
+    - name: Create Bandit configuration
+      run: |
+        cat > .bandit << 'EOF'
+        [bandit]
+        exclude_dirs = tests,test,venv,.venv,node_modules
+        skips = B101
+        EOF
+      shell: bash
+    - name: Run Bandit scan
+      run: |
+        bandit -r . -ll -iii -f screen
+        bandit -r . -ll -iii -f html -o bandit-report.html
+    - name: Upload Bandit Report
+      uses: actions/upload-artifact@v4
+      with:
+        name: bandit-report
+        path: bandit-report.html
+        retention-days: 30

sample_solutions/DocSummarization/backend/.env.example

@@ -33,3 +33,7 @@ LOG_LEVEL=INFO
 MAX_FILE_SIZE=524288000
 MAX_PDF_SIZE=52428800
 MAX_PDF_PAGES=100
+
+# SSL Verification Settings
+# Set to false only for dev with self-signed certs
+VERIFY_SSL=true

sample_solutions/DocSummarization/backend/api_client.py

@@ -14,7 +14,7 @@ class APIClient:
     def __init__(self):
         self.base_url = config.INFERENCE_API_ENDPOINT
         self.token = config.INFERENCE_API_TOKEN
-        self.http_client = httpx.Client() if self.token else None
+        self.http_client = httpx.Client(verify=config.VERIFY_SSL) if self.token else None
         logger.info(f"✓ API Client initialized with endpoint: {self.base_url}")
 
     def get_inference_client(self):

sample_solutions/DocSummarization/backend/config.py

@@ -43,6 +43,9 @@
 MAX_PDF_PAGES = int(os.getenv("MAX_PDF_PAGES", "100"))  # Maximum pages to process from PDF
 WARN_PDF_PAGES = 50  # Warn user if PDF has more than this many pages
 
+# SSL Verification Settings
+VERIFY_SSL = os.getenv("VERIFY_SSL", "true").lower() == "true"
+
 # CORS Settings
 CORS_ALLOW_ORIGINS = ["*"]  # Update with specific origins in production
 CORS_ALLOW_CREDENTIALS = True