Weekly Security Scan #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Weekly Security Scan | |
| on: | |
| schedule: | |
| # Run every Monday at 9:00 AM UTC | |
| - cron: '0 9 * * 1' | |
| workflow_dispatch: # Allow manual trigger | |
| jobs: | |
| security-audit: | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Cache pip dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~\AppData\Local\pip\Cache | |
| key: pip-security-${{ runner.os }} | |
| restore-keys: pip-security-${{ runner.os }} | |
| - name: Install security tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| pip install safety bandit pip-audit | |
| - name: Run Safety (dependency CVE scan) | |
| run: | | |
| echo "=== Safety Scan - Dependency Vulnerabilities ===" | |
| safety scan --output screen | |
| safety scan --output json > safety-report.json | |
| continue-on-error: true | |
| - name: Run pip-audit (alternative dependency scan) | |
| run: | | |
| echo "=== pip-audit - Alternative Dependency Scan ===" | |
| pip-audit --format json > pip-audit-report.json | |
| pip-audit --format columns | |
| continue-on-error: true | |
| - name: Run Bandit (code security scan) | |
| run: | | |
| echo "=== Bandit Scan - Code Security Issues ===" | |
| bandit -r api/ services/ -c .bandit -ll --format screen | |
| bandit -r api/ services/ -c .bandit -ll --format json -o bandit-report.json | |
| continue-on-error: true | |
| - name: Upload security reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: weekly-security-reports-${{ github.run_number }} | |
| path: | | |
| safety-report.json | |
| pip-audit-report.json | |
| bandit-report.json | |
| retention-days: 90 | |
| - name: Create issue if vulnerabilities found | |
| if: failure() | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: '🔒 Weekly Security Scan - Vulnerabilities Detected', | |
| body: `Weekly security scan has detected potential vulnerabilities.\n\nPlease review the artifacts from workflow run #${{ github.run_number }}.\n\n**Action Required:**\n- Review safety-report.json\n- Review pip-audit-report.json\n- Review bandit-report.json\n\n[View Workflow Run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})`, | |
| labels: ['security', 'automated'] | |
| }) |