ci(security): add pip-audit, trivy and ruff bandit security scans#588
ci(security): add pip-audit, trivy and ruff bandit security scans#588dembrane-sam-bot wants to merge 6 commits into
Conversation
|
Warning Review limit reached
More reviews will be available in 25 minutes and 40 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (4)
WalkthroughPR extends the CI pipeline with two security scanning tiers: dependency vulnerability checks (Bandit rules + pip-audit CVE scanning of requirements.lock) and container image scanning (Trivy on built image). Both integrate ignore configuration files for deliberate CVE acceptance with periodic re-evaluation guidance. ChangesCI Security Scanning Enhancement
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Line 184: The workflow uses a mutable tag for the Trivy action; replace uses:
aquasecurity/trivy-action@v0.36.0 with the action pinned to an immutable commit
SHA (e.g. uses: aquasecurity/trivy-action@<commit-sha>) to prevent supply-chain
tampering—locate the canonical commit SHA for the v0.36.0 release in the
aquasecurity/trivy-action repository and update the uses reference accordingly
in the CI workflow.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 6dc0000d-f4b4-41c2-9ddf-fb0b724cda75
📒 Files selected for processing (3)
.github/workflows/ci.yml.pipauditignore.trivyignore
| - name: Container vulnerability scan (trivy) | ||
| # Scan built image locally on PR / merge group validation before deploy/merge | ||
| if: github.event_name == 'pull_request' || github.event_name == 'merge_group' | ||
| uses: aquasecurity/trivy-action@v0.36.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify non-SHA-pinned actions in this workflow.
rg -nP '^\s*uses:\s*[^@]+@([0-9a-fA-F]{40})\s*$|^\s*uses:\s*' .github/workflows/ci.yml | sed -n 'p'Repository: Dembrane/echo
Length of output: 634
Pin aquasecurity/trivy-action to an immutable commit SHA.
Line 184 uses the mutable tag aquasecurity/trivy-action@v0.36.0, which is a supply-chain hardening gap (the workflow also has other tag-pinned uses: entries). LGTM.
Proposed fix
- uses: aquasecurity/trivy-action@v0.36.0
+ uses: aquasecurity/trivy-action@<FULL_40_CHAR_COMMIT_SHA> # v0.36.0🧰 Tools
🪛 zizmor (1.25.2)
[error] 184-184: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 184, The workflow uses a mutable tag for
the Trivy action; replace uses: aquasecurity/trivy-action@v0.36.0 with the
action pinned to an immutable commit SHA (e.g. uses:
aquasecurity/trivy-action@<commit-sha>) to prevent supply-chain tampering—locate
the canonical commit SHA for the v0.36.0 release in the
aquasecurity/trivy-action repository and update the uses reference accordingly
in the CI workflow.
1 participant
This PR introduces comprehensive security auditing workflows to the pull request validation pipeline, aligning
dembrane/echowith the security practices used indembrane/sam.What this changes
.github/workflows/ci.yml.github/workflows/ci.yml.github/workflows/ci.yml.pipauditignoreand.trivyignorefiles are available at the repo root to deliberately ignore specific CVEs with documented rationales —.pipauditignore,.trivyignoreConfidence
Confidence: high. The security audit configurations are modeled directly after the stable, production-tested pipelines in
dembrane/sam. The jobs run on PRs without making permanent changes to deployed images or environments.Summary by CodeRabbit