Pr 52

.github/workflows/code-scans.yaml

@@ -0,0 +1,98 @@
+name: SDLE Scans
+
+on:
+  workflow_dispatch:
+    inputs:
+      PR_number:
+        description: 'Pull request number'
+        required: true
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: sdle-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+
+# -----------------------------
+# 1) Trivy Scan (fixed)
+# -----------------------------
+  trivy_scan:
+    name: Trivy Vulnerability Scan
+    runs-on: ubuntu-latest
+    env:
+      TRIVY_REPORT_FORMAT: table
+      TRIVY_SCAN_TYPE: fs
+      TRIVY_SCAN_PATH: .
+      TRIVY_EXIT_CODE: '1'
+      TRIVY_VULN_TYPE: os,library
+      TRIVY_SEVERITY: CRITICAL,HIGH
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Create report directory
+        run: mkdir -p trivy-reports
+
+      - name: Run Trivy FS Scan
+        uses: aquasecurity/trivy-action@0.24.0
+        with:
+          scan-type: 'fs'
+          scan-ref: '.'
+          scanners: 'vuln,misconfig,secret,license'
+          ignore-unfixed: true
+          format: 'table'
+          exit-code: '1'
+          output: 'trivy-reports/trivy_scan_report.txt'
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Upload Trivy Report
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-report
+          path: trivy-reports/trivy_scan_report.txt
+      - name: Show Trivy Report in Logs
+        if: failure()
+        run: |
+          echo "========= TRIVY FINDINGS ========="
+          cat trivy-reports/trivy_scan_report.txt
+          echo "================================="
+
+# -----------------------------
+# 2) Bandit Scan
+# -----------------------------
+  bandit_scan:
+    name: Bandit security scan
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        submodules: 'recursive'
+        fetch-depth: 0
+    - uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+    - name: Install Bandit
+      run: pip install bandit
+    - name: Create Bandit configuration
+      run: |
+        cat > .bandit << 'EOF'
+        [bandit]
+        exclude_dirs = tests,test,venv,.venv,node_modules
+        skips = B101
+        EOF
+      shell: bash
+    - name: Run Bandit scan
+      run: |
+        bandit -r . -ll -iii -f screen
+        bandit -r . -ll -iii -f html -o bandit-report.html
+    - name: Upload Bandit Report
+      uses: actions/upload-artifact@v4
+      with:
+        name: bandit-report
+        path: bandit-report.html
+        retention-days: 30

core/helm-charts/observability/habana-exporter/habana-metrics.yml

@@ -25,7 +25,7 @@ spec:
         operator: "Exists"
         effect: "NoSchedule"
       # Required for network monitoring
-      hostNetwork: true
+      hostNetwork: false
       containers:
       - name: metric-exporter
         image: vault.habana.ai/gaudi-metric-exporter/metric-exporter:1.20.1-97
@@ -34,7 +34,8 @@ spec:
         - name: LD_LIBRARY_PATH
           value: "/usr/lib/habanalabs"
         securityContext:
-          privileged: true
+          privileged: false
+          readOnlyRootFilesystem: true
         volumeMounts:
           - name: pod-resources
             mountPath: /var/lib/kubelet/pod-resources

sample_solutions/PDFToPodcast/.env.example

@@ -0,0 +1,20 @@
+# Backend Configuration
+CORS_ORIGINS=http://localhost:3000
+
+# Service URLs (for local development)
+PDF_SERVICE_URL=http://pdf-service:8001
+LLM_SERVICE_URL=http://llm-service:8002
+TTS_SERVICE_URL=http://tts-service:8003
+BACKEND_API_URL=http://localhost:8000
+
+# File Upload Configuration
+MAX_FILE_SIZE=10485760  # 10MB in bytes
+
+# Environment
+NODE_ENV=development
+PYTHON_ENV=development
+
+# Local URL Endpoint (only needed for non-public domains)
+# If using a local domain like api.example.com mapped to localhost, set to the domain without https://
+# Otherwise, set to: not-needed
+LOCAL_URL_ENDPOINT=not-needed

sample_solutions/PDFToPodcast/.gitignore

@@ -0,0 +1,79 @@
+# Environment variables
+.env
+.env.local
+.env.*.local
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+venv/
+env/
+ENV/
+.venv
+
+# Node
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+.pnpm-debug.log*
+dist/
+dist-ssr/
+*.local
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+.DS_Store
+
+# Docker
+*.log
+
+# Uploads and outputs
+uploads/
+outputs/
+*.mp3
+*.wav
+microservices/tts-service/static/audio/
+
+# Exception: Allow voice sample files
+!ui/public/voice-samples/*.mp3
+
+# Database
+*.db
+*.sqlite
+*.sqlite3
+
+# Testing
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+
+# Misc
+.cache/
+*.bak
+*.tmp

sample_solutions/PDFToPodcast/Dockerfile

@@ -0,0 +1,22 @@
+FROM python:3.10-slim
+
+# Set the working directory in the container
+WORKDIR /app
+
+# Copy the requirements file first to leverage Docker layer caching
+COPY requirements.txt .
+
+RUN pip install -r requirements.txt
+
+# Copy the rest of the application files into the container
+COPY simple_backend.py .
+
+RUN groupadd -r appuser && useradd -r -g appuser appuser
+RUN chown -R appuser:appuser /app
+USER appuser
+
+# Expose the port the service runs on
+EXPOSE 8000
+
+# Command to run the application
+CMD ["python", "-m", "uvicorn", "simple_backend:app", "--host", "0.0.0.0", "--port", "8000"]