Skip to content

Commit b6f6feb

Browse files
author
Harika
committed
adding code scan file
1 parent e5e9e86 commit b6f6feb

1 file changed

Lines changed: 167 additions & 0 deletions

File tree

‎.github/workflows/code-scans.yaml‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
name: SDLE Scans
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
PR_number:
7+
description: 'Pull request number'
8+
required: true
9+
push:
10+
branches: [ main ]
11+
pull_request:
12+
types: [opened, synchronize, reopened, ready_for_review]
13+
14+
concurrency:
15+
group: sdle-${{ github.event.inputs.PR_number || github.event.pull_request.number || github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
actions: read
21+
22+
jobs:
23+
24+
# -----------------------------
25+
# 1) Trivy Scan
26+
# -----------------------------
27+
trivy_scan:
28+
name: Trivy Vulnerability Scan
29+
runs-on: self-hosted
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
34+
35+
- name: Create report directory
36+
run: mkdir -p trivy-reports
37+
38+
- name: Run Trivy FS Scan
39+
uses: aquasecurity/trivy-action@0.28.0
40+
continue-on-error: true
41+
with:
42+
scan-type: 'fs'
43+
scan-ref: '.'
44+
scanners: 'vuln,misconfig,secret'
45+
severity: 'CRITICAL,HIGH'
46+
format: 'table'
47+
output: 'trivy-reports/trivy_scan_report.txt'
48+
49+
- name: Run Trivy Image Scan - vllm-cpu
50+
uses: aquasecurity/trivy-action@0.28.0
51+
continue-on-error: true
52+
with:
53+
scan-type: 'image'
54+
image-ref: 'public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2'
55+
severity: 'HIGH,CRITICAL'
56+
format: 'table'
57+
output: 'trivy-reports/trivy-vllm-cpu.txt'
58+
59+
- name: Upload Trivy Reports
60+
if: always()
61+
uses: actions/upload-artifact@v4
62+
with:
63+
name: trivy-reports
64+
path: trivy-reports/
65+
66+
- name: Show Trivy FS Report in Logs
67+
if: always()
68+
run: |
69+
echo "========= TRIVY FS SCAN FINDINGS ========="
70+
cat trivy-reports/trivy_scan_report.txt || echo "No FS scan report found"
71+
echo "=========================================="
72+
73+
# -----------------------------
74+
# 2) Bandit Scan
75+
# -----------------------------
76+
bandit_scan:
77+
name: Bandit security scan
78+
runs-on: self-hosted
79+
steps:
80+
- name: Checkout
81+
uses: actions/checkout@v4
82+
with:
83+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
84+
submodules: 'recursive'
85+
fetch-depth: 0
86+
- uses: actions/setup-python@v5
87+
with:
88+
python-version: "3.x"
89+
- name: Install Bandit
90+
run: pip install bandit
91+
- name: Create Bandit configuration
92+
run: |
93+
cat > .bandit << 'EOF'
94+
[bandit]
95+
exclude_dirs = tests,test,venv,.venv,node_modules
96+
skips = B101
97+
EOF
98+
shell: bash
99+
- name: Run Bandit scan
100+
run: |
101+
bandit -r . -ll -iii -f screen
102+
bandit -r . -ll -iii -f html -o bandit-report.html
103+
- name: Upload Bandit Report
104+
uses: actions/upload-artifact@v4
105+
with:
106+
name: bandit-report
107+
path: bandit-report.html
108+
retention-days: 30
109+
# -----------------------------
110+
# 3) ShellCheck Scan
111+
# -----------------------------
112+
shellcheck_scan:
113+
name: ShellCheck script analysis
114+
runs-on: self-hosted
115+
steps:
116+
- uses: actions/checkout@v4
117+
with:
118+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
119+
120+
- name: Create report directory
121+
run: mkdir -p shellcheck-reports
122+
123+
- name: Install ShellCheck
124+
run: |
125+
# Check if shellcheck is already installed
126+
if ! command -v shellcheck &> /dev/null; then
127+
wget -qO- "https://github.com/koalaman/shellcheck/releases/download/stable/shellcheck-stable.linux.x86_64.tar.xz" | tar -xJv
128+
sudo cp shellcheck-stable/shellcheck /usr/local/bin/
129+
rm -rf shellcheck-stable
130+
fi
131+
shellcheck --version
132+
133+
- name: Find shell scripts
134+
id: find_scripts
135+
run: |
136+
SCRIPT_COUNT=$(find . -type f -name "*.sh" ! -path "./.git/*" | wc -l)
137+
echo "Shell scripts found: $SCRIPT_COUNT"
138+
echo "script_count=$SCRIPT_COUNT" >> $GITHUB_OUTPUT
139+
140+
- name: Run ShellCheck
141+
if: steps.find_scripts.outputs.script_count > 0
142+
continue-on-error: true
143+
run: |
144+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
145+
echo "==========================" >> shellcheck-reports/shellcheck-report.txt
146+
echo "" >> shellcheck-reports/shellcheck-report.txt
147+
148+
find . -type f -name "*.sh" ! -path "./.git/*" | while read -r script; do
149+
echo "Checking: $script" >> shellcheck-reports/shellcheck-report.txt
150+
shellcheck -f gcc "$script" >> shellcheck-reports/shellcheck-report.txt 2>&1 || true
151+
echo "" >> shellcheck-reports/shellcheck-report.txt
152+
done
153+
154+
cat shellcheck-reports/shellcheck-report.txt
155+
156+
- name: Create empty report if no scripts
157+
if: steps.find_scripts.outputs.script_count == 0
158+
run: |
159+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
160+
echo "No shell scripts found to analyze." >> shellcheck-reports/shellcheck-report.txt
161+
162+
- name: Upload ShellCheck Report
163+
if: always()
164+
uses: actions/upload-artifact@v4
165+
with:
166+
name: shellcheck-report
167+
path: shellcheck-reports/shellcheck-report.txt

0 commit comments

Comments
 (0)