Skip to content

Commit f59c481

Browse files
Ibraheem OlasupoIbraheem Olasupo
Ibraheem Olasupo
authored and
Ibraheem Olasupo
committed
Implement milestone 11 developer security enablement
1 parent 5b9fbba commit f59c481

123 files changed

Lines changed: 4416 additions & 475 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/ISSUE_TEMPLATE/config.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
blank_issues_enabled: true
2+
contact_links:
3+
- name: Security policy
4+
url: https://github.com/
5+
about: Use the repository SECURITY.md guidance. Do not include real secrets or exploit details in public issues.
6+

‎.github/ISSUE_TEMPLATE/security-finding.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Security finding
2+
description: Record a local repository security finding without external ticketing automation.
3+
title: "[Security Finding]: "
4+
labels: ["security"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: "Do not paste real secrets, raw tokens, private keys, patient data, cloud account identifiers or exploit payloads."
9+
- type: input
10+
id: source
11+
attributes:
12+
label: Source
13+
description: Scanner, test, review or evidence source.
14+
validations:
15+
required: true
16+
- type: textarea
17+
id: summary
18+
attributes:
19+
label: Summary
20+
description: Concise description without sensitive values.
21+
validations:
22+
required: true
23+
- type: textarea
24+
id: evidence
25+
attributes:
26+
label: Evidence references
27+
description: Link to local paths such as reports or finding IDs, not raw scanner logs.
28+
validations:
29+
required: true
30+
- type: dropdown
31+
id: lifecycle
32+
attributes:
33+
label: Expected lifecycle action
34+
options:
35+
- triage
36+
- remediate
37+
- verify
38+
- time-bound exception review
39+
- false-positive review
40+
validations:
41+
required: true
42+

‎.github/ISSUE_TEMPLATE/security-improvement.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Security improvement
2+
description: Suggest an improvement to local controls, guidance or evidence.
3+
title: "[Security Improvement]: "
4+
labels: ["security", "improvement"]
5+
body:
6+
- type: markdown
7+
attributes:
8+
value: "This template is for local repository improvements only. It does not create external tickets or deployment work."
9+
- type: textarea
10+
id: improvement
11+
attributes:
12+
label: Improvement
13+
description: Describe the control, workflow or documentation improvement.
14+
validations:
15+
required: true
16+
- type: textarea
17+
id: controls
18+
attributes:
19+
label: Related controls
20+
description: List threat IDs, requirement IDs, Make targets or reports if known.
21+
- type: textarea
22+
id: validation
23+
attributes:
24+
label: Suggested validation
25+
description: Mention local commands such as make quality or make developer-enablement-full.
26+

‎.github/pull_request_template.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
## Summary
2+
3+
Describe the change and the repository area affected.
4+
5+
## Security Impact
6+
7+
- [ ] Threat-model impact reviewed.
8+
- [ ] Authentication changes reviewed.
9+
- [ ] Authorisation changes reviewed.
10+
- [ ] Object-level access reviewed.
11+
- [ ] Input validation reviewed.
12+
- [ ] Logging reviewed.
13+
- [ ] Secret handling reviewed.
14+
- [ ] Dependency changes reviewed.
15+
- [ ] Terraform changes reviewed.
16+
- [ ] Docker changes reviewed.
17+
- [ ] New endpoints reviewed.
18+
- [ ] New data flows reviewed.
19+
- [ ] New external dependencies reviewed.
20+
- [ ] New suppressions reviewed.
21+
- [ ] New exceptions reviewed.
22+
- [ ] Evidence regeneration completed where required.
23+
- [ ] Release-gate impact reviewed.
24+
25+
## Tests Run
26+
27+
List commands such as `make quality`, `make appsec-fast`, `make dynamic-full`, `make findings-full`, `make release-full`, `make lifecycle-full`, `make evidence-full` or `make developer-enablement-full`.
28+
29+
## Findings Introduced or Remediated
30+
31+
Summarise finding IDs and outcomes. Do not paste raw scanner output.
32+
33+
## Suppression or Exception Changes
34+
35+
Explain any scanner suppression or formal exception change, including rationale, owner, expiry and release impact.
36+
37+
## Release-Gate Result
38+
39+
State the current local release-gate decision from `outputs/security/release/release-gate-decision.json`.
40+
41+
## Evidence Updated
42+
43+
List generated evidence paths that changed. Do not paste secrets, raw tokens or private keys.
44+
45+
## Rollback Considerations
46+
47+
Describe how to revert safely if the change causes a regression.
48+
49+
## Reviewers Required
50+
51+
Identify product security, platform, application or risk-owner review needs.
52+

‎.github/workflows/developer-enablement.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: Developer Enablement
2+
3+
on:
4+
pull_request:
5+
branches: ["main"]
6+
push:
7+
branches: ["main"]
8+
9+
permissions:
10+
contents: read
11+
12+
concurrency:
13+
group: developer-enablement-${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
developer-enablement:
18+
runs-on: ubuntu-24.04
19+
timeout-minutes: 15
20+
steps:
21+
# actions/checkout v4.2.2
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
23+
24+
# actions/setup-python v5.6.0
25+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
26+
with:
27+
python-version: "3.11"
28+
cache: "pip"
29+
30+
- name: Install dependencies
31+
run: |
32+
python -m pip install --upgrade pip==25.1.1
33+
python -m pip install -e ".[dev]"
34+
35+
- name: Enablement tests
36+
run: pytest tests/security/test_developer_enablement.py -q
37+
38+
- name: Developer enablement workflow
39+
run: make developer-enablement-full
40+
41+
- name: Upload developer enablement artifacts
42+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32
43+
with:
44+
name: developer-enablement
45+
path: |
46+
outputs/security/developer-enablement/
47+
reports/security/developer-*.md
48+
reports/security/pull-request-security-report.md
49+
reports/security/security-tooling-readiness-report.md
50+
retention-days: 14
51+

‎.github/workflows/reusable-appsec.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
name: Reusable AppSec
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
appsec:
11+
runs-on: ubuntu-24.04
12+
timeout-minutes: 25
13+
steps:
14+
# actions/checkout v4.2.2
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
16+
17+
# actions/setup-python v5.6.0
18+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
19+
with:
20+
python-version: "3.11"
21+
cache: "pip"
22+
23+
- name: Install dependencies
24+
run: |
25+
python -m pip install --upgrade pip==25.1.1
26+
python -m pip install -e ".[dev,security]"
27+
28+
- name: Fast AppSec
29+
run: make appsec-fast
30+
31+
- name: AppSec evidence
32+
run: make appsec-evidence verify-appsec-evidence appsec-report
33+

‎.github/workflows/reusable-quality.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Reusable Quality
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
quality:
11+
runs-on: ubuntu-24.04
12+
timeout-minutes: 20
13+
steps:
14+
# actions/checkout v4.2.2
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
16+
17+
# actions/setup-python v5.6.0
18+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
19+
with:
20+
python-version: "3.11"
21+
cache: "pip"
22+
23+
- name: Install dependencies
24+
run: |
25+
python -m pip install --upgrade pip==25.1.1
26+
python -m pip install -e ".[dev]"
27+
28+
- name: Quality
29+
run: make quality
30+

‎.github/workflows/reusable-security-evidence.yml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Reusable Security Evidence
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
evidence:
11+
runs-on: ubuntu-24.04
12+
timeout-minutes: 20
13+
steps:
14+
# actions/checkout v4.2.2
15+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
16+
17+
# actions/setup-python v5.6.0
18+
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
19+
with:
20+
python-version: "3.11"
21+
cache: "pip"
22+
23+
- name: Install dependencies
24+
run: |
25+
python -m pip install --upgrade pip==25.1.1
26+
python -m pip install -e ".[dev]"
27+
28+
- name: Consolidated evidence
29+
run: make evidence-full
30+

‎.pre-commit-config.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v4.6.0
4+
hooks:
5+
- id: check-yaml
6+
- id: end-of-file-fixer
7+
- id: trailing-whitespace
8+
exclude: "^(outputs/security/dynamic/raw/|reports/security/)"
29
- repo: https://github.com/astral-sh/ruff-pre-commit
310
rev: v0.12.2
411
hooks:

‎CONTRIBUTING.md‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ make findings-full
1414
make release-full
1515
make lifecycle-full
1616
make evidence-full
17+
make developer-enablement-full
1718
```
1819

1920
Use deterministic synthetic data only. Do not add real patient, NHS, genomic, credential, or cloud account data.
@@ -31,3 +32,9 @@ Use deterministic synthetic data only. Do not add real patient, NHS, genomic, cr
3132
- Keep release-gate evidence deterministic. Use `make release-gate-enforce` only when you intentionally want enforcement exit codes; evidence-mode release targets must still run for block and conditional decisions.
3233
- Keep lifecycle evidence deterministic. Scanner suppressions may inform lifecycle records, but only security exceptions under `config/lifecycle/` and `outputs/security/lifecycle/` may support risk acceptance or deferral.
3334
- Keep consolidated evidence deterministic. Update `config/evidence/source-registry.yaml` when adding a source domain, and do not add reports with manually maintained counts.
35+
- Use `docs/developer-security/README.md` for the secure development workflow, command tiers, pull-request expectations and troubleshooting.
36+
- Complete `.github/pull_request_template.md` for every pull request. Do not paste real secrets, raw tokens, private keys or raw scanner logs.
37+
- Run `make security-doctor` when Docker, Terraform, Gitleaks, Trivy, ZAP or local dynamic checks fail locally.
38+
- Keep scanner suppressions narrow, owned and expiring. Use formal lifecycle exceptions only for time-bound accepted risk or deferral with rationale and approval.
39+
- Regenerate findings, release, lifecycle, consolidated evidence and developer enablement evidence when the corresponding source material changes.
40+
- Commits should preserve milestone boundaries. Do not add deployment, AWS execution, dashboards, external ticketing or Security Champions workflow before their roadmap milestone.

0 commit comments

Comments
 (0)