feature/improve-postcode-matching #615
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Organisation ruleset: Python CI" | |
| on: | |
| push: | |
| branches-ignore: | |
| - main | |
| paths: | |
| - .github/workflows/org.python-ci.yml | |
| pull_request: | |
| types: [opened, edited, reopened, synchronize] | |
| branches: [main, master, dev] | |
| jobs: | |
| security-scan: | |
| # Bandit has its own GitHub Action; however, it always installs the latest version and does not allow version pinning. | |
| env: | |
| python-version: "3.13.9" | |
| bandit-version: "1.9.1" | |
| results-file: "results.sarif" | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| ############# Bandit ################## | |
| # TODO: Create an ad-hoc DBT Bandit Action | |
| - name: Set up Python | |
| uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 | |
| with: | |
| python-version: ${{env.python-version}} | |
| - name: Install Bandit | |
| shell: bash | |
| run: pip install 'bandit[sarif,toml]==${{env.bandit-version}}' | |
| - name: Checkout repository | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| - name: Run Bandit | |
| shell: bash | |
| run: | | |
| bandit -r . --confidence-level=high --severity-level=high -f sarif -o ${{env.results-file}} -x './.venv,./tests,./test' || true | |
| - name: Check for any failures | |
| id: check-failures | |
| shell: bash | |
| run: | | |
| has_errors=$( jq '.runs[0].results != []' ${{env.results-file}}) | |
| echo "Check failure result: $has_errors" | |
| echo "has_errors=$has_errors" >> $GITHUB_OUTPUT | |
| - name: Upload SARIF file | |
| if: ${{steps.check-failures.outputs.has_errors == 'true'}} | |
| uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 | |
| with: | |
| sarif_file: ${{env.results-file}} | |
| vulnerability-scan: | |
| # Checking for public, skipping private and internal | |
| if: ${{ github.event.repository.visibility == 'public' }} | |
| env: | |
| audit-dir: "audit-reports" | |
| permissions: | |
| contents: read | |
| issues: write | |
| pull-requests: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: "Git clone the repository" | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| - name: "Git clone the standards repository" | |
| uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 | |
| with: | |
| repository: "uktrade/github-standards" | |
| path: github-standards | |
| sparse-checkout: .github/actions # This appears misleading, it always checks out the entire repo contents | |
| - name: Python Runtime End of Life check | |
| if: github.event_name == 'pull_request' | |
| uses: ./github-standards/.github/actions/runtime-eol/python | |
| continue-on-error: true | |
| with: | |
| python-version: ${{ vars.PYTHON_VERSION }} | |
| - name: "Create audit directory" | |
| if: env.PYTHON_TOO_OLD != 'true' | |
| shell: bash | |
| run: mkdir -p "${{ env.audit-dir }}" | |
| continue-on-error: true | |
| - name: "Run Python audit (v${{ vars.PYTHON_VERSION }})" | |
| if: env.PYTHON_TOO_OLD != 'true' | |
| uses: ./github-standards/.github/actions/vulnerability-scan/python | |
| continue-on-error: true | |
| with: | |
| python-version: ${{ vars.PYTHON_VERSION }} | |
| audit-dir: ${{ env.audit-dir }} | |
| - name: Notify PR creator | |
| # TODO: Ensure only a single comment is created per PR, updated on each run | |
| if: env.PYTHON_TOO_OLD != 'true' && github.event_name == 'pull_request' && github.event.action == 'opened' | |
| uses: ./github-standards/.github/actions/notify/vulnerability | |
| continue-on-error: true | |
| with: | |
| token: ${{ github.token }} | |
| audit-dir: ${{ env.audit-dir }} |