Skip to content

Commit 6774feb

Browse files
vhpintelvhpintel
authored
PR workflow for SDLE scans (#60)
* Create code-scans.yaml Workflow to scan the code for Security vulnerabilities and Code quality issues * Updated the co-pilot review * Update code-scans.yaml Updated Trivy scan with latest stable version
1 parent 7ef7125 commit 6774feb

1 file changed

Lines changed: 169 additions & 0 deletions

File tree

‎.github/workflows/code-scans.yaml‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
name: SDLE Scans
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
PR_number:
7+
description: 'Pull request number'
8+
required: true
9+
push:
10+
branches: [ main, dev ]
11+
pull_request:
12+
types: [opened, synchronize, reopened, ready_for_review]
13+
14+
concurrency:
15+
group: sdle-${{ github.event.inputs.PR_number || github.event.pull_request.number || github.ref }}
16+
cancel-in-progress: true
17+
18+
permissions:
19+
contents: read
20+
actions: read
21+
22+
jobs:
23+
24+
# -----------------------------
25+
# 1) Trivy Scan
26+
# -----------------------------
27+
trivy_scan:
28+
name: Trivy Vulnerability Scan
29+
runs-on: self-hosted
30+
steps:
31+
- uses: actions/checkout@v4
32+
with:
33+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
34+
35+
- name: Create report directory
36+
run: mkdir -p trivy-reports
37+
38+
- name: Run Trivy FS Scan
39+
uses: aquasecurity/trivy-action@v0.35.0
40+
continue-on-error: true
41+
with:
42+
scan-type: 'fs'
43+
scan-ref: '.'
44+
scanners: 'vuln,misconfig,secret'
45+
severity: 'CRITICAL,HIGH'
46+
format: 'table'
47+
exit-code: 0
48+
output: 'trivy-reports/trivy_scan_report.txt'
49+
50+
- name: Run Trivy Image Scan - vllm-cpu
51+
uses: aquasecurity/trivy-action@v0.35.0
52+
continue-on-error: true
53+
with:
54+
scan-type: 'image'
55+
image-ref: 'public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2'
56+
severity: 'HIGH,CRITICAL'
57+
exit-code: 0
58+
format: 'table'
59+
output: 'trivy-reports/trivy-vllm-cpu.txt'
60+
61+
- name: Upload Trivy Reports
62+
if: always()
63+
uses: actions/upload-artifact@v4
64+
with:
65+
name: trivy-reports
66+
path: trivy-reports/
67+
68+
- name: Show Trivy FS Report in Logs
69+
if: always()
70+
run: |
71+
echo "========= TRIVY FS SCAN FINDINGS ========="
72+
cat trivy-reports/trivy_scan_report.txt || echo "No FS scan report found"
73+
echo "=========================================="
74+
75+
# -----------------------------
76+
# 2) Bandit Scan
77+
# -----------------------------
78+
bandit_scan:
79+
name: Bandit security scan
80+
runs-on: self-hosted
81+
steps:
82+
- name: Checkout
83+
uses: actions/checkout@v4
84+
with:
85+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
86+
submodules: 'recursive'
87+
fetch-depth: 0
88+
- uses: actions/setup-python@v5
89+
with:
90+
python-version: "3.x"
91+
- name: Install Bandit
92+
run: pip install bandit
93+
- name: Create Bandit configuration
94+
run: |
95+
cat > .bandit << 'EOF'
96+
[bandit]
97+
exclude_dirs = tests,test,venv,.venv,node_modules
98+
skips = B101
99+
EOF
100+
shell: bash
101+
- name: Run Bandit scan
102+
run: |
103+
bandit -r . -ll -iii -f screen
104+
bandit -r . -ll -iii -f html -o bandit-report.html
105+
- name: Upload Bandit Report
106+
uses: actions/upload-artifact@v4
107+
with:
108+
name: bandit-report
109+
path: bandit-report.html
110+
retention-days: 30
111+
# -----------------------------
112+
# 3) ShellCheck Scan
113+
# -----------------------------
114+
shellcheck_scan:
115+
name: ShellCheck script analysis
116+
runs-on: self-hosted
117+
steps:
118+
- uses: actions/checkout@v4
119+
with:
120+
ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }}
121+
122+
- name: Create report directory
123+
run: mkdir -p shellcheck-reports
124+
125+
- name: Install ShellCheck
126+
run: |
127+
# Check if shellcheck is already installed
128+
if ! command -v shellcheck &> /dev/null; then
129+
wget -qO- "https://github.com/koalaman/shellcheck/releases/download/stable/shellcheck-stable.linux.x86_64.tar.xz" | tar -xJv
130+
sudo cp shellcheck-stable/shellcheck /usr/local/bin/
131+
rm -rf shellcheck-stable
132+
fi
133+
shellcheck --version
134+
135+
- name: Find shell scripts
136+
id: find_scripts
137+
run: |
138+
SCRIPT_COUNT=$(find . -type f -name "*.sh" ! -path "./.git/*" | wc -l)
139+
echo "Shell scripts found: $SCRIPT_COUNT"
140+
echo "script_count=$SCRIPT_COUNT" >> $GITHUB_OUTPUT
141+
142+
- name: Run ShellCheck
143+
if: steps.find_scripts.outputs.script_count > 0
144+
continue-on-error: true
145+
run: |
146+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
147+
echo "==========================" >> shellcheck-reports/shellcheck-report.txt
148+
echo "" >> shellcheck-reports/shellcheck-report.txt
149+
150+
find . -type f -name "*.sh" ! -path "./.git/*" | while read -r script; do
151+
echo "Checking: $script" >> shellcheck-reports/shellcheck-report.txt
152+
shellcheck -f gcc "$script" >> shellcheck-reports/shellcheck-report.txt 2>&1 || true
153+
echo "" >> shellcheck-reports/shellcheck-report.txt
154+
done
155+
156+
cat shellcheck-reports/shellcheck-report.txt
157+
158+
- name: Create empty report if no scripts
159+
if: steps.find_scripts.outputs.script_count == 0
160+
run: |
161+
echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt
162+
echo "No shell scripts found to analyze." >> shellcheck-reports/shellcheck-report.txt
163+
164+
- name: Upload ShellCheck Report
165+
if: always()
166+
uses: actions/upload-artifact@v4
167+
with:
168+
name: shellcheck-report
169+
path: shellcheck-reports/shellcheck-report.txt

0 commit comments

Comments
 (0)