Implement milestone 5 core AppSec pipeline

Author: Ibraheem Olasupo

.checkov.yml

@@ -3,7 +3,3 @@ directory:
 framework:
   - terraform
 quiet: true
-skip-check:
-  # Milestone 4 prepares configuration for later Checkov execution; scanner
-  # enforcement is intentionally deferred to Milestone 5.
-  - CKV_AWS_999

.coverage 2

@@ -0,0 +1,53 @@
+name: AppSec
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: appsec-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  application-security:
+    runs-on: ubuntu-24.04
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # actions/setup-python v5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[dev,security]"
+
+      - name: Scanner inventory
+        run: make security-tools
+
+      - name: Secret scanning
+        run: make secrets-scan
+
+      - name: Semgrep rule tests
+        run: make semgrep-test
+
+      - name: SAST
+        run: make sast
+
+      - name: Dependency audit
+        run: make dependency-audit
+
+      - name: SBOM
+        run: make sbom verify-sbom
+
+      - name: AppSec evidence
+        run: make appsec-evidence verify-appsec-evidence appsec-report

.github/workflows/appsec.yml

@@ -0,0 +1,41 @@
+name: Container Security
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: container-security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  container-security:
+    runs-on: ubuntu-24.04
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # actions/setup-python v5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[security]"
+
+      - name: Build image
+        run: make container-build-security
+
+      - name: Scan image
+        run: make container-scan
+
+      - name: Container evidence
+        run: make appsec-evidence verify-appsec-evidence appsec-report

.github/workflows/container-security.yml

@@ -0,0 +1,46 @@
+name: Terraform Security
+
+on:
+  pull_request:
+    branches: ["main"]
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: terraform-security-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  terraform-security:
+    runs-on: ubuntu-24.04
+    steps:
+      # actions/checkout v4.2.2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+
+      # actions/setup-python v5.6.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: "3.11"
+          cache: "pip"
+
+      # hashicorp/setup-terraform v3.1.2
+      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_version: "1.8.5"
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip==25.1.1
+          python -m pip install -e ".[dev,security]"
+
+      - name: Terraform validation
+        run: make terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test
+
+      - name: Checkov scan
+        run: make checkov-scan
+
+      - name: Infrastructure and AppSec evidence
+        run: make verify-infrastructure-evidence appsec-evidence verify-appsec-evidence appsec-report

.github/workflows/terraform-security.yml

@@ -0,0 +1,20 @@
+title = "Genomic Research Access API Gitleaks Configuration"
+
+[allowlist]
+description = "Narrow allow-list for approved synthetic local JWT test key fixture only."
+paths = [
+  '''^tests/fixtures/keys/dev_private_key\.pem$''',
+]
+
+[[rules]]
+id = "generic-api-token"
+description = "Generic API token assignment"
+regex = '''(?i)(api[_-]?token|secret[_-]?token|access[_-]?token)\s*[:=]\s*['"][A-Za-z0-9_\-]{20,}['"]'''
+entropy = 3.5
+keywords = ["api_token", "secret_token", "access_token"]
+
+[[rules]]
+id = "jwt-signing-material-outside-fixtures"
+description = "JWT signing material outside approved fixtures"
+regex = '''-----BEGIN (RSA |EC |OPENSSH )?PRIVATE KEY-----'''
+keywords = ["BEGIN", "PRIVATE KEY"]

.gitleaks.toml

@@ -0,0 +1,23 @@
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.12.2
+    hooks:
+      - id: ruff-format
+      - id: ruff
+        args: ["--fix"]
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.24.3
+    hooks:
+      - id: gitleaks
+        args: ["--config", ".gitleaks.toml"]
+  - repo: https://github.com/returntocorp/semgrep
+    rev: v1.78.0
+    hooks:
+      - id: semgrep
+        args: ["--config", "security/semgrep/rules"]
+        exclude: "^(security/fixtures|outputs)/"
+  - repo: https://github.com/PyCQA/bandit
+    rev: 1.7.10
+    hooks:
+      - id: bandit
+        args: ["-c", "security/bandit/bandit.yaml", "-r", "src", "scripts"]

.pre-commit-config.yaml

@@ -1,13 +1,14 @@
 # Contributing
 
-This portfolio repository is a local demonstration of a secure product foundation. Contributions should keep Milestone 1 focused on the FastAPI reference application and avoid adding later roadmap capabilities prematurely.
+This portfolio repository is a local demonstration of a secure product foundation. Contributions should preserve the delivered milestone boundaries and avoid adding cloud deployment, release gates or vulnerability-management operations before their roadmap milestone.
 
 ## Local Checks
 
 Run:
 
 ```bash
 make quality
+make appsec-fast
 ```
 
 Use deterministic synthetic data only. Do not add real patient, NHS, genomic, credential, or cloud account data.
@@ -18,4 +19,5 @@ Use deterministic synthetic data only. Do not add real patient, NHS, genomic, cr
 - Preserve stable JSON error structures.
 - Do not introduce wildcard CORS defaults.
 - Do not commit generated caches, local databases, logs, or environment files.
-- Keep future security tooling, AWS, Terraform, and production authentication out of Milestone 1 unless the roadmap milestone changes.
+- Run scanner targets after changing dependencies, Dockerfile, Terraform, authentication or request-handling code.
+- Do not add broad scanner suppressions. Use `security/config/suppressions.yaml` with an owner, expiry and exact path or rule scope.

CONTRIBUTING.md

@@ -1,15 +1,18 @@
-FROM python:3.11.13-slim-bookworm AS builder
+FROM python:3.11.13-slim-trixie AS builder
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1
 
 WORKDIR /app
 COPY pyproject.toml README.md ./
 COPY src ./src
-RUN python -m pip install --upgrade pip==25.1.1 \
+RUN apt-get update \
+    && apt-get -y upgrade \
+    && rm -rf /var/lib/apt/lists/* \
+    && python -m pip install --upgrade pip==25.1.1 setuptools==80.9.0 wheel==0.46.2 \
     && python -m pip wheel --no-cache-dir --wheel-dir /wheels .
 
-FROM python:3.11.13-slim-bookworm AS runtime
+FROM python:3.11.13-slim-trixie AS runtime
 
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
@@ -20,8 +23,12 @@ RUN addgroup --system appuser \
 
 WORKDIR /app
 COPY --from=builder /wheels /wheels
-RUN python -m pip install --no-cache-dir --no-index --find-links=/wheels genomic-research-access-api==0.1.0 \
-    && rm -rf /wheels
+RUN apt-get update \
+    && apt-get -y upgrade \
+    && rm -rf /var/lib/apt/lists/* \
+    && python -m pip install --no-cache-dir --no-index --find-links=/wheels genomic-research-access-api==0.1.0 \
+    && python -m pip uninstall -y pip setuptools wheel \
+    && rm -rf /wheels /root/.cache/pip
 
 USER appuser
 EXPOSE 8000

Dockerfile

@@ -1,4 +1,4 @@
-.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
+.PHONY: setup install format format-check lint type-check test test-coverage auth-test api-security-test terraform-fmt terraform-fmt-check terraform-init terraform-validate terraform-test infrastructure-test infrastructure-evidence verify-infrastructure-evidence infrastructure-report security-tools secrets-scan sast sast-semgrep sast-bandit semgrep-test sca dependency-audit sbom verify-sbom iac-scan checkov-scan container-build-security container-scan appsec-fast appsec-full appsec-evidence verify-appsec-evidence appsec-report pre-commit-install pre-commit-run quality run docker-build docker-run threat-model-validate threat-model-evidence verify-threat-model-evidence threat-model-report api-security-evidence verify-api-security-evidence api-security-report dev-token-researcher dev-token-approver dev-token-auditor clean
 
 PYTHON ?= python3
 VENV ?= .venv
@@ -68,7 +68,66 @@ verify-infrastructure-evidence:
 infrastructure-report:
 	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.infrastructure.report
 
-quality: format-check lint type-check test-coverage auth-test api-security-test threat-model-validate verify-threat-model-evidence verify-api-security-evidence terraform-fmt-check infrastructure-test verify-infrastructure-evidence
+security-tools:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py security-tools
+
+secrets-scan:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py gitleaks
+
+sast-semgrep:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py semgrep
+
+semgrep-test:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py semgrep-test
+
+sast-bandit:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py bandit
+
+sast: sast-semgrep sast-bandit
+
+dependency-audit:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py dependency-audit
+
+sca: dependency-audit
+
+sbom:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py sbom
+
+verify-sbom:
+	PYTHONPATH=src $(PYTHON) -c "from genomic_research_access_api.security.appsec.parsers import validate_cyclonedx; from genomic_research_access_api.security.appsec.evidence import SBOM_PATH; validate_cyclonedx(SBOM_PATH)"
+
+checkov-scan:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py checkov
+
+iac-scan: checkov-scan
+
+container-build-security:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py container-build
+
+container-scan:
+	PYTHONPATH=src $(PYTHON) scripts/appsec_tools.py trivy
+
+appsec-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.appsec.evidence --timestamp 2026-01-01T00:00:00Z
+
+verify-appsec-evidence:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.appsec.evidence --verify
+
+appsec-report:
+	PYTHONPATH=src $(PYTHON) -m genomic_research_access_api.security.appsec.report
+
+appsec-fast: secrets-scan sast dependency-audit
+
+appsec-full: appsec-fast sbom verify-sbom checkov-scan container-build-security container-scan appsec-evidence verify-appsec-evidence appsec-report
+
+pre-commit-install:
+	$(PYTHON) -m pip install pre-commit==3.8.0
+	$(VENV)/bin/pre-commit install
+
+pre-commit-run:
+	$(VENV)/bin/pre-commit run --all-files
+
+quality: format-check lint type-check test-coverage auth-test api-security-test threat-model-validate verify-threat-model-evidence verify-api-security-evidence terraform-fmt-check infrastructure-test verify-infrastructure-evidence verify-appsec-evidence
 
 run:
 	PYTHONPATH=src $(UVICORN) genomic_research_access_api.main:app --host 127.0.0.1 --port 8000