Skip to content

ci(security): add pip-audit, trivy and ruff bandit security scans #588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
dembrane-sam-bot wants to merge 6 commits into
base: main
Choose a base branch
from
Open

ci(security): add pip-audit, trivy and ruff bandit security scans #588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a34ffe2
ci(security): add pip-audit, trivy and ruff bandit security scans
dembrane-sam-bot May 25, 2026
98d23f6
ci(security): adjust bandit ignore rules and sign CLA in contributors…
dembrane-sam-bot May 25, 2026
6ad2de4
ci(security): populate .pipauditignore with current advisory IDs
dembrane-sam-bot May 25, 2026
d2fe34a
ci(security): fix GHSA casing to lowercase in .pipauditignore
dembrane-sam-bot May 25, 2026
5ee3ecd
ci(security): populate .trivyignore with current advisory IDs
dembrane-sam-bot May 25, 2026
c18b735
ci(security): fix GHSA casing to lowercase in .trivyignore
dembrane-sam-bot May 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,24 @@ jobs:
with:
src: echo/server

- name: Security lint (ruff bandit rules)
run: ruff check echo/server --select=S --ignore=S101,S104,S105,S106,S107,S110,S112,S113,S311,S603

- name: Install pip-audit
run: pip install pip-audit==2.9.0

- name: Python dependency CVE scan (pip-audit)
run: |
IGNORE_ARGS=()
if [ -f .pipauditignore ]; then
while IFS= read -r line; do
[[ "$line" =~ ^[[:space:]]*# ]] && continue
[[ -z "${line// }" ]] && continue
IGNORE_ARGS+=(--ignore-vuln "$line")
done < .pipauditignore
fi
pip-audit -r echo/server/requirements.lock "${IGNORE_ARGS[@]}"

ci-check-frontend:
name: ci-check-frontend
runs-on: ubuntu-latest
Expand Down Expand Up @@ -153,8 +171,21 @@ jobs:
file: ${{ matrix.image.context }}/${{ matrix.image.dockerfile }}
# Only push if the event is a push event to main.
push: ${{ github.event_name == 'push' }}
load: ${{ github.event_name != 'push' }}
tags: registry.digitalocean.com/dbr-cr/${{ matrix.image.tag }}:${{ github.sha }}
build-args: ${{ matrix.image.build_args }}
# Enhanced cache settings - using GitHub Actions cache for better performance
cache-from: type=gha,scope=build-${{ matrix.image.name }}
cache-to: type=gha,scope=build-${{ matrix.image.name }},mode=max

- name: Container vulnerability scan (trivy)
# Scan built image locally on PR / merge group validation before deploy/merge
if: github.event_name == 'pull_request' || github.event_name == 'merge_group'
uses: aquasecurity/trivy-action@v0.36.0
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot May 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify non-SHA-pinned actions in this workflow.
rg -nP '^\s*uses:\s*[^@]+@([0-9a-fA-F]{40})\s*$|^\s*uses:\s*' .github/workflows/ci.yml | sed -n 'p'

Repository: Dembrane/echo

Length of output: 634

Pin aquasecurity/trivy-action to an immutable commit SHA.
Line 184 uses the mutable tag aquasecurity/trivy-action@v0.36.0, which is a supply-chain hardening gap (the workflow also has other tag-pinned uses: entries). LGTM.

Proposed fix 
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@<FULL_40_CHAR_COMMIT_SHA> # v0.36.0
🧰 Tools
🪛 zizmor (1.25.2)

[error] 184-184: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml at line 184, The workflow uses a mutable tag for
the Trivy action; replace uses: aquasecurity/trivy-action@v0.36.0 with the
action pinned to an immutable commit SHA (e.g. uses:
aquasecurity/trivy-action@<commit-sha>) to prevent supply-chain tampering—locate
the canonical commit SHA for the v0.36.0 release in the
aquasecurity/trivy-action repository and update the uses reference accordingly
in the CI workflow.

with:
image-ref: registry.digitalocean.com/dbr-cr/${{ matrix.image.tag }}:${{ github.sha }}
severity: HIGH,CRITICAL
ignore-unfixed: true
exit-code: '1'
format: table
trivyignores: .trivyignore
125 changes: 125 additions & 0 deletions .pipauditignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
# CVEs pip-audit reports that we deliberately accept, with rationale.
# Re-evaluate this file when the underlying packages get rebuilt with
# upstream fixes — these are not permanent ignores.
#
# Format: one advisory ID per line. Blank lines and `#` comments ignored.
GHSA-27jp-wm6q-gp25
GHSA-2c2j-9gv5-cj73
GHSA-2g6r-c272-w58r
GHSA-2h4p-vjrc-8xpq
GHSA-2q4j-m29v-hq73
GHSA-2rw7-x74f-jg35
GHSA-2vrm-gr82-f7m5
GHSA-2xpw-w6gg-jr37
GHSA-34jh-p97f-mpxf
GHSA-3644-q5cj-c5c7
GHSA-38jv-5279-wg99
GHSA-3crg-w4f6-42mx
GHSA-3hjh-jh2h-vrg6
GHSA-3wq7-rqq7-wx6j
GHSA-428g-f7cq-pgp5
GHSA-48p4-8xcf-vxj5
GHSA-4f6g-68pf-7vhv
GHSA-4pxv-j86v-mhcw
GHSA-4xc4-762w-m6cg
GHSA-53mr-6c8q-9789
GHSA-54jq-c3m8-4m76
GHSA-59g5-xgcq-4qw3
GHSA-5chr-fjjv-38qv
GHSA-63hf-3vf5-4wqf
GHSA-65pc-fj4g-8rjx
GHSA-69f9-5gxw-wvc2
GHSA-69x8-hrgq-fjj8
GHSA-6jhg-hg63-jvvf
GHSA-6mq8-rvhq-8wgg
GHSA-6qv9-48xg-fc7f
GHSA-6w46-j5rx-g56g
GHSA-78cv-mqj4-43f7
GHSA-79v4-65xg-pq4g
GHSA-7cx3-6m66-7c5m
GHSA-7gcm-g887-7qv7
GHSA-7gw9-cf7v-778f
GHSA-7hfw-26vp-jp8m
GHSA-87mj-5ggw-8qc3
GHSA-8w49-h785-mj3c
GHSA-926x-3r5x-gfhw
GHSA-9548-qrrj-x5pj
GHSA-966j-vmvw-g2g9
GHSA-996q-pr4m-cvgq
GHSA-9f5j-8jwj-x28g
GHSA-9hjg-9r4m-mvj7
GHSA-9m86-7pmv-2852
GHSA-9mvc-8737-8j8h
GHSA-9wx4-h78v-vm56
GHSA-c427-h43c-vf67
GHSA-c67j-w6g6-q2cm
GHSA-cpwx-vrp4-4pq7
GHSA-f2jm-rw3h-6phg
GHSA-f2v5-7jq9-h8cg
GHSA-f96h-pmfr-66vw
GHSA-fh55-r93g-j68g
GHSA-fqwm-6jpj-5wxc
GHSA-g84x-mcqj-x9qq
GHSA-g92j-qhmh-64v2
GHSA-gc5v-m9x4-r6x2
GHSA-gm62-xv2j-4w53
GHSA-gmj6-6f8f-6699
GHSA-h4gh-qq45-vh27
GHSA-hc5w-c9f8-9cc4
GHSA-hc5x-x2vx-497g
GHSA-hcc4-c3v8-rx92
GHSA-hqmh-ppp3-xvm7
GHSA-jfx9-29x2-rv3j
GHSA-jj3x-wxrx-4x23
GHSA-jj6c-8h6c-hppx
GHSA-jjhc-v7c2-5hh6
GHSA-jr27-m4p2-rc6r
GHSA-m42m-m8cr-8m58
GHSA-m449-cwjh-6pw7
GHSA-m5qp-6w8w-w647
GHSA-mf9w-mj56-hr94
GHSA-mj87-hwqh-73pj
GHSA-mqqc-3gqh-h2x8
GHSA-mwh4-6h8g-pg8w
GHSA-p998-jp59-783m
GHSA-pc6w-59fv-rh23
GHSA-pjwx-r37v-7724
GHSA-pp6c-gr5w-3c5g
GHSA-pq67-6m6q-mj2v
GHSA-q25c-c977-4cmh
GHSA-q2x7-8rv6-6q7h
GHSA-qmgc-5h2g-mvrw
GHSA-qpxp-75px-xjcp
GHSA-qv8j-hgpc-vrq8
GHSA-r6ph-v2qm-q3c2
GHSA-rr7j-v2q5-chgv
GHSA-v4p8-mg3p-g94g
GHSA-vqfr-h8mv-ghfj
GHSA-vr63-x8vc-m265
GHSA-w2fm-2cpv-w7v5
GHSA-w3h3-4rj7-4ph4
GHSA-w853-jp5j-5j7f
GHSA-wgvp-vg3v-2xq3
GHSA-wh2j-26j7-9728
GHSA-wj6h-64fc-37mp
GHSA-wp53-j4wj-2cfg
GHSA-x284-j5p8-9c5p
GHSA-x7hp-r3qg-r3cj
PYSEC-2024-110
PYSEC-2024-115
PYSEC-2024-118
PYSEC-2024-230
PYSEC-2024-232
PYSEC-2024-233
PYSEC-2024-277
PYSEC-2024-53
PYSEC-2025-185
PYSEC-2025-49
PYSEC-2026-107
PYSEC-2026-113
PYSEC-2026-140
PYSEC-2026-141
PYSEC-2026-161
PYSEC-2026-35
PYSEC-2026-76
PYSEC-2026-77
92 changes: 92 additions & 0 deletions .trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,92 @@
# CVEs trivy reports that we deliberately accept, with rationale.
# Re-evaluate this file when the underlying packages get rebuilt with newer
# base images or upstream fixes — these are not permanent ignores.
CVE-2025-12816
CVE-2025-14874
CVE-2025-15467
CVE-2025-61726
CVE-2025-61729
CVE-2025-64756
CVE-2025-65945
CVE-2025-66031
CVE-2025-66414
CVE-2025-68121
CVE-2025-68154
CVE-2025-69421
CVE-2026-0621
CVE-2026-1526
CVE-2026-1528
CVE-2026-22184
CVE-2026-2229
CVE-2026-23745
CVE-2026-23950
CVE-2026-24842
CVE-2026-25128
CVE-2026-25536
CVE-2026-25547
CVE-2026-25639
CVE-2026-25679
CVE-2026-25896
CVE-2026-26278
CVE-2026-26280
CVE-2026-26318
CVE-2026-26960
CVE-2026-26996
CVE-2026-27606
CVE-2026-27699
CVE-2026-27903
CVE-2026-27904
CVE-2026-28387
CVE-2026-28388
CVE-2026-28389
CVE-2026-28390
CVE-2026-29074
CVE-2026-29786
CVE-2026-30952
CVE-2026-31789
CVE-2026-31802
CVE-2026-32280
CVE-2026-32281
CVE-2026-32283
CVE-2026-33036
CVE-2026-33671
CVE-2026-33811
CVE-2026-33814
CVE-2026-33891
CVE-2026-33894
CVE-2026-33895
CVE-2026-33896
CVE-2026-34601
CVE-2026-35408
CVE-2026-35409
CVE-2026-35412
CVE-2026-35442
CVE-2026-35525
CVE-2026-39363
CVE-2026-39364
CVE-2026-39820
CVE-2026-39836
CVE-2026-39942
CVE-2026-40200
CVE-2026-41311
CVE-2026-41324
CVE-2026-41672
CVE-2026-41673
CVE-2026-41674
CVE-2026-41675
CVE-2026-42033
CVE-2026-42035
CVE-2026-42043
CVE-2026-42264
CVE-2026-42499
CVE-2026-44240
CVE-2026-44724
CVE-2026-46490
CVE-2026-4800
CVE-2026-4867
CVE-2026-4926
CVE-2026-6321
CVE-2026-6322
ghsa-5c6j-r48x-rmvq
ghsa-6q22-g298-grjh
ghsa-6v7q-wjvx-w8wg
3 changes: 2 additions & 1 deletion contributors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,5 @@
- vanpauli
- MsVivienne
- dtrn2048
- Charugundlavipul
- Charugundlavipul
- dembrane-sam-bot
Loading