Skip to content

ci(security): add pip-audit, trivy and ruff bandit security scans #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dembrane-sam-bot wants to merge 6 commits into from
Closed

ci(security): add pip-audit, trivy and ruff bandit security scans #588

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a34ffe2
ci(security): add pip-audit, trivy and ruff bandit security scans
dembrane-sam-bot May 25, 2026
98d23f6
ci(security): adjust bandit ignore rules and sign CLA in contributors…
dembrane-sam-bot May 25, 2026
6ad2de4
ci(security): populate .pipauditignore with current advisory IDs
dembrane-sam-bot May 25, 2026
d2fe34a
ci(security): fix GHSA casing to lowercase in .pipauditignore
dembrane-sam-bot May 25, 2026
5ee3ecd
ci(security): populate .trivyignore with current advisory IDs
dembrane-sam-bot May 25, 2026
c18b735
ci(security): fix GHSA casing to lowercase in .trivyignore
dembrane-sam-bot May 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,24 @@ jobs:
with:
src: echo/server

- name: Security lint (ruff bandit rules)
run: ruff check echo/server --select=S --ignore=S101

- name: Install pip-audit
run: pip install pip-audit==2.9.0

- name: Python dependency CVE scan (pip-audit)
run: |
IGNORE_ARGS=()
if [ -f .pipauditignore ]; then
while IFS= read -r line; do
[[ "$line" =~ ^[[:space:]]*# ]] && continue
[[ -z "${line// }" ]] && continue
IGNORE_ARGS+=(--ignore-vuln "$line")
done < .pipauditignore
fi
pip-audit -r echo/server/requirements.lock "${IGNORE_ARGS[@]}"

ci-check-frontend:
name: ci-check-frontend
runs-on: ubuntu-latest
Expand Down Expand Up @@ -153,8 +171,21 @@ jobs:
file: ${{ matrix.image.context }}/${{ matrix.image.dockerfile }}
# Only push if the event is a push event to main.
push: ${{ github.event_name == 'push' }}
load: ${{ github.event_name != 'push' }}
tags: registry.digitalocean.com/dbr-cr/${{ matrix.image.tag }}:${{ github.sha }}
build-args: ${{ matrix.image.build_args }}
# Enhanced cache settings - using GitHub Actions cache for better performance
cache-from: type=gha,scope=build-${{ matrix.image.name }}
cache-to: type=gha,scope=build-${{ matrix.image.name }},mode=max

- name: Container vulnerability scan (trivy)
# Scan built image locally on PR / merge group validation before deploy/merge
if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
uses: aquasecurity/trivy-action@v0.36.0

@coderabbitai coderabbitai Bot May 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify non-SHA-pinned actions in this workflow.
rg -nP '^\s*uses:\s*[^@]+@([0-9a-fA-F]{40})\s*$|^\s*uses:\s*' .github/workflows/ci.yml | sed -n 'p'

Repository: Dembrane/echo

Length of output: 634

Pin aquasecurity/trivy-action to an immutable commit SHA.
Line 184 uses the mutable tag aquasecurity/trivy-action@v0.36.0, which is a supply-chain hardening gap (the workflow also has other tag-pinned uses: entries). LGTM.

Proposed fix 
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@<FULL_40_CHAR_COMMIT_SHA> # v0.36.0
🧰 Tools
🪛 zizmor (1.25.2)

[error] 184-184: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 184, The workflow uses a mutable tag for
the Trivy action; replace uses: aquasecurity/trivy-action@v0.36.0 with the
action pinned to an immutable commit SHA (e.g. uses:
aquasecurity/trivy-action@<commit-sha>) to prevent supply-chain tampering—locate
the canonical commit SHA for the v0.36.0 release in the
aquasecurity/trivy-action repository and update the uses reference accordingly
in the CI workflow.

with:
image-ref: registry.digitalocean.com/dbr-cr/${{ matrix.image.tag }}:${{ github.sha }}
severity: HIGH,CRITICAL
ignore-unfixed: true
exit-code: '1'
format: table
trivyignores: .trivyignore
5 changes: 5 additions & 0 deletions .pipauditignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
# CVEs pip-audit reports that we deliberately accept, with rationale.
# Re-evaluate this file when the underlying packages get rebuilt with
# upstream fixes — these are not permanent ignores.
#
# Format: one advisory ID per line. Blank lines and `#` comments ignored.
3 changes: 3 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
# CVEs trivy reports that we deliberately accept, with rationale.
# Re-evaluate this file when the underlying packages get rebuilt with newer
# base images or upstream fixes — these are not permanent ignores.
Loading