Merge pull request #41 from CoreyLeath-code/agent/release-v1-1-0 #114
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: HelixAgent Security & Supply Chain | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "31 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: github/codeql-action/init@v4 | |
| with: | |
| languages: python | |
| - uses: github/codeql-action/autobuild@v4 | |
| - uses: github/codeql-action/analyze@v4 | |
| gitleaks: | |
| name: Secret Scanning | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Scan current source tree | |
| run: | | |
| docker run --rm \ | |
| -v "$PWD:/repo" \ | |
| -w /repo \ | |
| ghcr.io/gitleaks/gitleaks:latest \ | |
| detect --source . --no-git --redact --no-banner --exit-code 1 | |
| trivy: | |
| name: Trivy Filesystem Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| sbom: | |
| name: CycloneDX SBOM | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: anchore/sbom-action@v0 | |
| with: | |
| path: . | |
| format: cyclonedx-json | |
| output-file: sbom.cdx.json | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: helixagent-sbom | |
| path: sbom.cdx.json | |
| dependency-audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| - run: pip install pip-audit | |
| - name: Generate audit report | |
| run: | | |
| set +e | |
| pip-audit -r requirements.txt --format json --output pip-audit.json | |
| echo "Dependency findings retained for triage." | |
| exit 0 | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: pip-audit-report | |
| path: pip-audit.json | |
| if-no-files-found: warn |