Skip to content

Commit b6e700a

Browse files
vhpintelvhpintel
authored
Create code-scans.yaml
Workflow to scan the code for Security vulnerabilities and Code quality issues
1 parent 0bd9e8f commit b6e700a

1 file changed

Lines changed: 167 additions & 0 deletions

File tree

‎.github/workflows/code-scans.yaml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
name: SDLE Scans
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
PR_number:
7+
description: 'Pull request number'
8+
required: true
9+
push:
10+
branches: [ main ]
11+
pull_request:
12+
types: [opened, synchronize, reopened, ready_for_review]
13+
14+
concurrency:
15+
group: sdle-${{ github.event.pull_request.number || github.ref }}
16+
cancel-in-progress: true
17+
18+
jobs:
19+
20+
# -----------------------------
21+
# 1) Trivy Scan
22+
# -----------------------------
23+
trivy_scan:
24+
name: Trivy Vulnerability Scan
25+
runs-on: self-hosted
26+
steps:
27+
- uses: actions/checkout@v4
28+
29+
- name: Create report directory
30+
run: mkdir -p trivy-reports
31+
32+
- name: Install Trivy
33+
run: |
34+
# Check if trivy is already installed
35+
if ! command -v trivy &> /dev/null; then
36+
wget -qO- https://github.com/aquasecurity/trivy/releases/download/v0.55.0/trivy_0.55.0_Linux-64bit.tar.gz | tar -xzv -C /tmp
37+
sudo mv /tmp/trivy /usr/local/bin/
38+
fi
39+
trivy --version
40+
41+
- name: Run Trivy FS Scan
42+
continue-on-error: true
43+
run: |
44+
trivy fs . \
45+
--scanners vuln,misconfig,secret \
46+
--severity CRITICAL,HIGH \
47+
--format table \
48+
--output trivy-reports/trivy_scan_report.txt
49+
50+
- name: Run Trivy Image Scan - vllm-cpu
51+
continue-on-error: true
52+
run: |
53+
trivy image \
54+
--severity HIGH,CRITICAL \
55+
--format table \
56+
--output trivy-reports/trivy-vllm-cpu.txt \
57+
public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2 || \
58+
echo "Image scan skipped - image not available locally" > trivy-reports/trivy-vllm-cpu.txt
59+
60+
- name: Upload Trivy Reports
61+
if: always()
62+
uses: actions/upload-artifact@v4
63+
with:
64+
name: trivy-reports
65+
path: trivy-reports/
66+
67+
- name: Show Trivy FS Report in Logs
68+
if: always()
69+
run: |
70+
echo "========= TRIVY FS SCAN FINDINGS ========="
71+
cat trivy-reports/trivy_scan_report.txt || echo "No FS scan report found"
72+
echo "=========================================="
73+
74+
# -----------------------------
75+
# 2) Bandit Scan
76+
# -----------------------------
77+
bandit_scan:
78+
name: Bandit security scan
79+
runs-on: self-hosted
80+
steps:
81+
- name: Checkout
82+
uses: actions/checkout@v4
83+
with:
84+
submodules: 'recursive'
85+
fetch-depth: 0
86+
- uses: actions/setup-python@v5
87+
with:
88+
python-version: "3.x"
89+
- name: Install Bandit
90+
run: pip install bandit
91+
- name: Create Bandit configuration
92+
run: |
93+
cat > .bandit << 'EOF'
94+
[bandit]
95+
exclude_dirs = tests,test,venv,.venv,node_modules
96+
skips = B101
97+
EOF
98+
shell: bash
99+
- name: Run Bandit scan
100+
run: |
101+
bandit -r . -ll -iii -f screen
102+
bandit -r . -ll -iii -f html -o bandit-report.html
103+
- name: Upload Bandit Report
104+
uses: actions/upload-artifact@v4
105+
with:
106+
name: bandit-report
107+
path: bandit-report.html
108+
retention-days: 30
109+
# -----------------------------
110+
# 3) ShellCheck Scan
111+
# -----------------------------
112+
shellcheck_scan:
113+
name: ShellCheck script analysis
114+
runs-on: self-hosted
115+
permissions:
116+
contents: read
117+
steps:
118+
- uses: actions/checkout@v4
119+
120+
- name: Create report directory
121+
run: mkdir -p shellcheck-reports
122+
123+
- name: Install ShellCheck
124+
run: |
125+
# Check if shellcheck is already installed
126+
if ! command -v shellcheck &> /dev/null; then
127+
wget -qO- "https://github.com/koalaman/shellcheck/releases/download/stable/shellcheck-stable.linux.x86_64.tar.xz" | tar -xJv
128+
sudo cp shellcheck-stable/shellcheck /usr/local/bin/
129+
rm -rf shellcheck-stable
130+
fi
131+
shellcheck --version
132+
133+
- name: Find shell scripts
134+
id: find_scripts
135+
run: |
136+
SCRIPT_COUNT=$(find . -type f -name "*.sh" ! -path "./.git/*" | wc -l)
137+
echo "Shell scripts found: $SCRIPT_COUNT"
138+
echo "script_count=$SCRIPT_COUNT" >> $GITHUB_OUTPUT
139+
140+
- name: Run ShellCheck
141+
if: steps.find_scripts.outputs.script_count > 0
142+
continue-on-error: true
143+
run: |
144+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
145+
echo "==========================" >> shellcheck-reports/shellcheck-report.txt
146+
echo "" >> shellcheck-reports/shellcheck-report.txt
147+
148+
find . -type f -name "*.sh" ! -path "./.git/*" | while read -r script; do
149+
echo "Checking: $script" >> shellcheck-reports/shellcheck-report.txt
150+
shellcheck -f gcc "$script" >> shellcheck-reports/shellcheck-report.txt 2>&1 || true
151+
echo "" >> shellcheck-reports/shellcheck-report.txt
152+
done
153+
154+
cat shellcheck-reports/shellcheck-report.txt
155+
156+
- name: Create empty report if no scripts
157+
if: steps.find_scripts.outputs.script_count == 0
158+
run: |
159+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
160+
echo "No shell scripts found to analyze." >> shellcheck-reports/shellcheck-report.txt
161+
162+
- name: Upload ShellCheck Report
163+
if: always()
164+
uses: actions/upload-artifact@v4
165+
with:
166+
name: shellcheck-report
167+
path: shellcheck-reports/shellcheck-report.txt

0 commit comments

Comments
 (0)