Skip to content
Security Scan

release 4.0.2 #1076

Sign in to view logs

release 4.0.2

release 4.0.2 #1076

Workflow file for this run

.github/workflows/security-scan.yml at 8231903
name: Security Scan
on:
pull_request:
branches:
- '*'
jobs:
python-scan:
runs-on: ubuntu-latest
strategy:
matrix:
include:
- {python-version: '3.9' }
- {python-version: '3.12' }
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: ${{ matrix.python-version }}
- name: Install Python Modules
run: |
python -m pip install --upgrade pip
pip install -U bandit pip-audit setuptools .
- name: Bandit Scan
run: |
bandit -r .
- name: Install cid-cmd
run: |
pip install -U .
- name: Pip Audit
run: |
# GHSA-wfm5-v35h-vwf4 gitpython is a dependency of pip-audit not cid-cmd
# GHSA-cwvm-v4w8-q58c gitpython is a dependency of pip-audit not cid-cmd
pip-audit --ignore-vuln GHSA-wfm5-v35h-vwf4 --ignore-vuln GHSA-cwvm-v4w8-q58c
python-pylint-cid:
runs-on: ubuntu-latest
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.11'
- name: Install cfn-lint
run: |
pip install pylint
- name: PyLint
run: |
pylint ./cid/
cfn-scan-cid:
runs-on: ubuntu-latest
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Set up Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: '3.1'
- name: Install CFN tools
run: |
gem install cfn-nag
- name: CFN Nag scan
run: |
cfn_nag_scan --input-path ./cfn-templates/cid-cfn.yml
- name: Install cfn-lint
run: |
pip install cfn-lint
- name: CFN Lint
run: |
cfn-lint ./cfn-templates/cid-cfn.yml
cfn-scan-cid-admin-policies:
runs-on: ubuntu-latest
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Set up Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: '3.1'
- name: Install CFN tools
run: |
gem install cfn-nag
- name: CFN Nag scan
run: |
cfn_nag_scan --input-path ./cfn-templates/cid-admin-policies.yaml
- name: Install cfn-lint
run: |
pip install cfn-lint
- name: CFN Lint
run: |
cfn-lint ./cfn-templates/cid-admin-policies.yaml
cfn-scan-cur-aggregation:
runs-on: ubuntu-latest
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.10'
- name: Set up Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: '3.1'
- name: Install CFN tools
run: |
gem install cfn-nag
- name: CFN Nag scan
run: |
cfn_nag_scan --input-path ./cfn-templates/cur-aggregation.yaml
- name: Install cfn-lint
run: |
pip install cfn-lint
- name: CFN Lint
run: |
cfn-lint ./cfn-templates/cur-aggregation.yaml
terraform-scan:
runs-on: ubuntu-latest
steps:
- name: Git clone the repository
uses: actions/checkout@v3
- name: Set up Python
uses: actions/setup-python@v4
with:
python-version: '3.11'
- name: Install checkov
run: |
pip install -U schema checkov
- name: Checkov scan
run: |
checkov --directory ./terraform-modules