mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-09 05:24:49 +09:00
Juan Denis
9604e1ea66
- Add .github/workflows/security-scan.yml with Bandit SAST and Safety dependency scanning (requires SAFETY_API_KEY secret) - Add backend/.bandit config to skip expected noise (B404, B603, B607) - Update vulnerable dependencies: gunicorn 21.2.0 → 22.0.0 (CVE-2024-1135 HTTP smuggling) gevent 23.9.1 → 25.4.2 (HTTP smuggling + race condition) python-socketio 5.10.0 → 5.14.0 (CVE-2025-61765 deserialization) cryptography 42.0.0 → 44.0.3 (multiple CVEs) requests 2.31.0 → 2.32.5 (vulnerability fixes) Flask-Cors 4.0.0 → 5.0.1, Flask-SocketIO 5.3.6 → 5.4.1 python-engineio 4.8.1 → 4.11.2 - Pin previously unpinned deps: schedule, passlib, bcrypt
71 lines
2.5 KiB
YAML
71 lines
2.5 KiB
YAML
name: Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [dev]
|
|
paths:
|
|
- 'backend/**'
|
|
- '.github/workflows/security-scan.yml'
|
|
pull_request:
|
|
branches: [main, dev]
|
|
paths:
|
|
- 'backend/**'
|
|
- '.github/workflows/security-scan.yml'
|
|
|
|
jobs:
|
|
# ──────────────────────────────────────────────────────────────────
|
|
# Job 1: Bandit — static analysis for Python security issues
|
|
# ──────────────────────────────────────────────────────────────────
|
|
bandit:
|
|
name: Bandit SAST
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install Bandit
|
|
run: pip install bandit
|
|
|
|
- name: Run Bandit scan
|
|
working-directory: backend
|
|
run: |
|
|
echo "## Full report (MEDIUM+ severity, MEDIUM+ confidence)"
|
|
echo ""
|
|
bandit -r app/ \
|
|
--severity-level medium \
|
|
--confidence-level medium \
|
|
-f txt \
|
|
--exit-zero
|
|
echo ""
|
|
echo "---"
|
|
echo ""
|
|
echo "## Strict gate (HIGH severity, HIGH confidence, new issues only)"
|
|
echo "Known accepts: B602 (shell=True for build/deploy scripts),"
|
|
echo " B402/B321 (FTP management feature), B202 (tarfile for backups)"
|
|
echo ""
|
|
bandit -r app/ \
|
|
--severity-level high \
|
|
--confidence-level high \
|
|
--skip B602,B402,B321,B202 \
|
|
-f txt
|
|
|
|
# ──────────────────────────────────────────────────────────────────
|
|
# Job 2: Safety — dependency vulnerability scanning
|
|
# ──────────────────────────────────────────────────────────────────
|
|
safety:
|
|
name: Safety Dependency Scan
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Run Safety CLI to check for vulnerabilities
|
|
uses: pyupio/safety-action@v1
|
|
with:
|
|
api-key: ${{ secrets.SAFETY_API_KEY }}
|
|
args: --full-report
|