Skip to content

Commit 644dca4

Browse files
MrTornado24MrTornado24
authored
Merge pull request #50 from farmmanic/main
automatic security update
2 parents 773266c + 4b40f1a commit 644dca4

File tree

7 files changed

+266
-0
lines changed

7 files changed

+266
-0
lines changed

‎.github/workflows/anchore.yml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, builds an image, performs a container image
7+
# vulnerability scan with Anchore's Grype tool, and integrates the results with GitHub Advanced Security
8+
# code scanning feature. For more information on the Anchore scan action usage
9+
# and parameters, see https://github.com/anchore/scan-action. For more
10+
# information on Anchore's container image scanning tool Grype, see
11+
# https://github.com/anchore/grype
12+
name: Anchore Grype vulnerability scan
13+
14+
on:
15+
push:
16+
branches: [ "main" ]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [ "main" ]
20+
schedule:
21+
- cron: '42 8 * * 2'
22+
23+
permissions:
24+
contents: read
25+
26+
jobs:
27+
Anchore-Build-Scan:
28+
permissions:
29+
contents: read # for actions/checkout to fetch code
30+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
31+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
32+
runs-on: ubuntu-latest
33+
steps:
34+
- name: Check out the code
35+
uses: actions/checkout@v3
36+
- name: Build the Docker image
37+
run: docker build . --file Dockerfile --tag localbuild/testimage:latest
38+
- name: Run the Anchore Grype scan action
39+
uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
40+
id: scan
41+
with:
42+
image: "localbuild/testimage:latest"
43+
fail-build: true
44+
severity-cutoff: critical
45+
- name: Upload vulnerability report
46+
uses: github/codeql-action/upload-sarif@v2
47+
with:
48+
sarif_file: ${{ steps.scan.outputs.sarif }}

‎.github/workflows/codacy.yml

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow checks out code, performs a Codacy security scan
7+
# and integrates the results with the
8+
# GitHub Advanced Security code scanning feature. For more information on
9+
# the Codacy security scan action usage and parameters, see
10+
# https://github.com/codacy/codacy-analysis-cli-action.
11+
# For more information on Codacy Analysis CLI in general, see
12+
# https://github.com/codacy/codacy-analysis-cli.
13+
14+
name: Codacy Security Scan
15+
16+
on:
17+
push:
18+
branches: [ "main" ]
19+
pull_request:
20+
# The branches below must be a subset of the branches above
21+
branches: [ "main" ]
22+
schedule:
23+
- cron: '25 4 * * 1'
24+
25+
permissions:
26+
contents: read
27+
28+
jobs:
29+
codacy-security-scan:
30+
permissions:
31+
contents: read # for actions/checkout to fetch code
32+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
33+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
34+
name: Codacy Security Scan
35+
runs-on: ubuntu-latest
36+
steps:
37+
# Checkout the repository to the GitHub Actions runner
38+
- name: Checkout code
39+
uses: actions/checkout@v3
40+
41+
# Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis
42+
- name: Run Codacy Analysis CLI
43+
uses: codacy/codacy-analysis-cli-action@d840f886c4bd4edc059706d09c6a1586111c540b
44+
with:
45+
# Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository
46+
# You can also omit the token and run the tools that support default configurations
47+
project-token: ${{ secrets.CODACY_PROJECT_TOKEN }}
48+
verbose: true
49+
output: results.sarif
50+
format: sarif
51+
# Adjust severity of non-security issues
52+
gh-code-scanning-compat: true
53+
# Force 0 exit code to allow SARIF file generation
54+
# This will handover control about PR rejection to the GitHub side
55+
max-allowed-issues: 2147483647
56+
57+
# Upload the SARIF file generated in the previous step
58+
- name: Upload SARIF results file
59+
uses: github/codeql-action/upload-sarif@v2
60+
with:
61+
sarif_file: results.sarif

‎.github/workflows/devskim.yml

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
name: DevSkim
7+
8+
on:
9+
push:
10+
branches: [ "main" ]
11+
pull_request:
12+
branches: [ "main" ]
13+
schedule:
14+
- cron: '24 11 * * 0'
15+
16+
jobs:
17+
lint:
18+
name: DevSkim
19+
runs-on: ubuntu-20.04
20+
permissions:
21+
actions: read
22+
contents: read
23+
security-events: write
24+
steps:
25+
- name: Checkout code
26+
uses: actions/checkout@v3
27+
28+
- name: Run DevSkim scanner
29+
uses: microsoft/DevSkim-Action@v1
30+
31+
- name: Upload DevSkim scan results to GitHub Security tab
32+
uses: github/codeql-action/upload-sarif@v2
33+
with:
34+
sarif_file: devskim-results.sarif

‎.github/workflows/pylint.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Pylint
2+
3+
on: [push]
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
strategy:
9+
matrix:
10+
python-version: ["3.8", "3.9", "3.10"]
11+
steps:
12+
- uses: actions/checkout@v3
13+
- name: Set up Python ${{ matrix.python-version }}
14+
uses: actions/setup-python@v3
15+
with:
16+
python-version: ${{ matrix.python-version }}
17+
- name: Install dependencies
18+
run: |
19+
python -m pip install --upgrade pip
20+
pip install pylint
21+
- name: Analysing the code with pylint
22+
run: |
23+
pylint $(git ls-files '*.py')

‎.github/workflows/pysa.yml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow integrates Python Static Analyzer (Pysa) with
7+
# GitHub's Code Scanning feature.
8+
#
9+
# Python Static Analyzer (Pysa) is a security-focused static
10+
# analysis tool that tracks flows of data from where they
11+
# originate to where they terminate in a dangerous location.
12+
#
13+
# See https://pyre-check.org/docs/pysa-basics/
14+
15+
name: Pysa
16+
17+
on:
18+
workflow_dispatch:
19+
push:
20+
branches: [ "main" ]
21+
pull_request:
22+
branches: [ "main" ]
23+
schedule:
24+
- cron: '39 15 * * 0'
25+
26+
permissions:
27+
contents: read
28+
29+
jobs:
30+
pysa:
31+
permissions:
32+
actions: read
33+
contents: read
34+
security-events: write
35+
36+
runs-on: ubuntu-latest
37+
steps:
38+
- uses: actions/checkout@v3
39+
with:
40+
submodules: true
41+
42+
- name: Run Pysa
43+
uses: facebook/pysa-action@f46a63777e59268613bd6e2ff4e29f144ca9e88b
44+
with:
45+
# To customize these inputs:
46+
# See https://github.com/facebook/pysa-action#inputs
47+
repo-directory: './'
48+
requirements-path: 'requirements.txt'
49+
infer-types: true
50+
include-default-sapp-filters: true

‎.github/workflows/semgrep.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
# This workflow file requires a free account on Semgrep.dev to
7+
# manage rules, file ignores, notifications, and more.
8+
#
9+
# See https://semgrep.dev/docs
10+
11+
name: Semgrep
12+
13+
on:
14+
push:
15+
branches: [ "main" ]
16+
pull_request:
17+
# The branches below must be a subset of the branches above
18+
branches: [ "main" ]
19+
schedule:
20+
- cron: '22 9 * * 3'
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
semgrep:
27+
permissions:
28+
contents: read # for actions/checkout to fetch code
29+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
30+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
31+
name: Scan
32+
runs-on: ubuntu-latest
33+
steps:
34+
# Checkout project source
35+
- uses: actions/checkout@v3
36+
37+
# Scan code using project's configuration on https://semgrep.dev/manage
38+
- uses: returntocorp/semgrep-action@fcd5ab7459e8d91cb1777481980d1b18b4fc6735
39+
with:
40+
publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}
41+
publishDeployment: ${{ secrets.SEMGREP_DEPLOYMENT_ID }}
42+
generateSarif: "1"
43+
44+
# Upload SARIF file generated in previous step
45+
- name: Upload SARIF file
46+
uses: github/codeql-action/upload-sarif@v2
47+
with:
48+
sarif_file: semgrep.sarif
49+
if: always()

‎requirements.txt

+1
Original file line numberDiff line numberDiff line change
@@ -33,3 +33,4 @@ taming-transformers-rom1504
3333

3434
#controlnet
3535
controlnet_aux
36+
numpy>=1.22.2 # not directly required, pinned by Snyk to avoid a vulnerability

0 commit comments

Comments
 (0)