diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 5dd9551..fb1d3c2 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -2,6 +2,11 @@ name: Security scan on: pull_request: workflow_call: + inputs: + ENABLE_BANDIT: + description: 'Enable the Bandit scanner - useful for Python only' + default: true + type: boolean jobs: build: name: Check for vulnerabilities @@ -12,6 +17,7 @@ jobs: - name: Security check - Bandit uses: mdegis/bandit-action@v1.0.1 + if: ${{ inputs.ENABLE_BANDIT }} with: path: "." level: high diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml deleted file mode 100644 index f49729f..0000000 --- a/.github/workflows/trivy.yaml +++ /dev/null @@ -1,25 +0,0 @@ -name: Trivy Security Scan -on: - workflow_call: -jobs: - build: - name: Check for vulnerabilities - runs-on: ubuntu-20.04 - steps: - - name: Security check - Trivy - uses: aquasecurity/trivy-action@0.24.0 - with: - scan-type: "fs" - scan-ref: "." - severity: "MEDIUM,CRITICAL,HIGH" - exit-code: "1" - trivy-config: | - rules: - - id: rule1 - category: general - title: Generic Rule - severity: 'MEDIUM,CRITICAL,HIGH' - keywords: - - secret - regex: (?i)(?P(secret))(=|:).{0,5}'\"['\"] - secret-group-name: secret