Implemented pylint

.github/workflows/docs.yml

@@ -1,4 +1,6 @@
 name: Build and deploy documentation
+permissions:
+  contents: read
 
 on:
   push:

.github/workflows/osv-scanner.yml

@@ -0,0 +1,166 @@
+name: OSV Dependency Scan
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'requirements.txt'
+      - 'dev-requirements.txt'
+      - '.github/workflows/osv-scanner.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'requirements.txt'
+      - 'dev-requirements.txt'
+  schedule:
+    # Run weekly on Monday at 00:00 UTC to catch new CVEs
+    - cron: '0 0 * * 1'
+
+permissions:
+  contents: read
+  security-events: write  # Required for SARIF upload
+  actions: read           # Required for OSV-Scanner action
+
+jobs:
+  osv-scan:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Prepare requirements for scanning
+        run: |
+          # Use Python to safely read files with correct encoding (handling BOMs automatically)
+          python3 -c "
+          import sys
+
+          def process_file(filename):
+              try:
+                  # Open with utf-8-sig to handle UTF-8 BOM, errors='replace' to handle binary/UTF-16 confusion
+                  # Ideally we would detect encoding, but requirements files should be text
+                  with open(filename, 'r', encoding='utf-8', errors='replace') as f:
+                      content = f.read()
+                      # If it looks like UTF-16 (null bytes), try re-reading
+                      if '\x00' in content:
+                          with open(filename, 'r', encoding='utf-16') as f2:
+                              content = f2.read()
+
+                  for line in content.splitlines():
+                      line = line.strip()
+                      if not line or line.startswith(('#', '-i', '--')):
+                          continue
+                      # Remove markers
+                      line = line.split(';')[0].strip()
+                      if line:
+                          print(line)
+              except Exception as e:
+                  print(f'Error processing {filename}: {e}', file=sys.stderr)
+
+          process_file('requirements.txt')
+          process_file('dev-requirements.txt')
+          " | sort -u > combined-requirements.txt
+
+          echo "Combined requirements file created:"
+          if [ -s combined-requirements.txt ]; then
+            echo "  Total packages: $(wc -l < combined-requirements.txt)"
+            echo ""
+            echo "Package list (first 10):"
+            head -10 combined-requirements.txt
+          else
+             echo "Error: combined-requirements.txt is empty!"
+             echo "Debug: File listing:"
+             ls -l requirements.txt dev-requirements.txt
+          fi
+          echo ""
+
+      - name: Install OSV-Scanner
+        run: |
+          curl -LO https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64
+          chmod +x osv-scanner_linux_amd64
+          sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner
+
+      - name: Run OSV-Scanner
+        id: osv-scanner
+        continue-on-error: true
+        run: |
+          echo "Running OSV-Scanner dependency vulnerability check..."
+          echo "=================================================="
+          echo ""
+
+          # Check if combined file has content
+          if [ ! -s combined-requirements.txt ]; then
+            echo "Error: combined-requirements.txt is empty!"
+            echo "Falling back to scanning requirements.txt only..."
+            LOCKFILE="requirements.txt"
+          else
+            LOCKFILE="combined-requirements.txt"
+          fi
+
+          echo "Scanning: $LOCKFILE"
+          echo ""
+
+          # Run scan and capture exit code
+          set +e
+          osv-scanner --lockfile="$LOCKFILE"
+          SCAN_EXIT_CODE=$?
+          set -e
+
+          # Exit code 128 means no packages found, which should not happen
+          if [ $SCAN_EXIT_CODE -eq 128 ]; then
+            echo ""
+            echo "OSV-Scanner found no packages to scan"
+            echo "Debug: Contents of $LOCKFILE:"
+            cat "$LOCKFILE"
+            exit 1
+          fi
+
+          echo ""
+          echo "Generating SARIF report..."
+          osv-scanner --lockfile="$LOCKFILE" --format=sarif --output=results.sarif 2>&1 || {
+            echo "⚠️  SARIF generation encountered issues (possibly plugin warning)"
+            echo "    Scan results are still valid - see output above"
+          }
+
+          if [ -f results.sarif ] && [ -s results.sarif ]; then
+            echo "✓ SARIF file created successfully"
+            ls -lh results.sarif
+          fi
+
+          # Return the original scan exit code
+          exit $SCAN_EXIT_CODE
+
+      - name: Upload SARIF results to GitHub Security
+        if: always() && hashFiles('results.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: results.sarif
+          category: osv-scanner
+
+      - name: Success - No vulnerabilities found
+        if: steps.osv-scanner.outcome == 'success'
+        run: |
+          echo "=========================================="
+          echo "✅ No Vulnerabilities Found"
+          echo "=========================================="
+          echo ""
+          echo "All Python dependencies (requirements.txt + dev-requirements.txt)"
+          echo "are free of known vulnerabilities."
+          echo ""
+
+      - name: Check OSV-Scanner results
+        if: steps.osv-scanner.outcome == 'failure'
+        run: |
+          echo "=========================================="
+          echo "⚠️  Vulnerabilities Found in Dependencies"
+          echo "=========================================="
+          echo ""
+          echo "OSV-Scanner detected security vulnerabilities in your Python dependencies"
+          echo "(requirements.txt + dev-requirements.txt)."
+          echo ""
+          echo "Review the findings in the Security tab -> Code scanning alerts."
+          echo ""
+          echo "Note: This workflow is configured to pass even with findings"
+          echo "to allow for known unfixable or constrained vulnerabilities."
+          echo ""
+

.github/workflows/pylint_check.yml

@@ -0,0 +1,53 @@
+name: Pylint Code Quality
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  pylint:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.13.7"]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: 'pip'
+
+      - name: Install system dependencies for pyscard
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y swig libpcsclite-dev pcscd
+
+      - name: Install Python dependencies
+        continue-on-error: true
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Install Pylint
+        run: |
+          pip install pylint
+
+      - name: Run Pylint analysis
+        run: |
+          echo "Running Pylint code quality analysis..."
+          echo "========================================"
+          echo ""
+          pylint cryptnox_cli \
+            --output-format=colorized \
+            --fail-under=7.0 \
+            --fail-on=error,fatal
+

.github/workflows/semgrep.yml

@@ -0,0 +1,111 @@
+name: Semgrep Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run daily at 00:00 UTC to catch new vulnerabilities
+    - cron: '0 0 * * *'
+
+permissions:
+  contents: read
+  security-events: write  # Required for SARIF upload
+  pull-requests: write    # For PR comments
+
+jobs:
+  semgrep:
+    runs-on: ubuntu-latest
+
+    # Skip scheduled runs on forks
+    if: (github.event_name != 'schedule') || (github.repository == 'cryptnox/cryptnox-cli')
+
+    container:
+      # Official Semgrep Docker image
+      image: semgrep/semgrep
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Fix Git ownership in container
+        run: |
+          git config --global --add safe.directory /__w/cryptnox-cli/cryptnox-cli || true
+          git config --global --add safe.directory "$GITHUB_WORKSPACE" || true
+
+      - name: Run Semgrep Security Scan
+        id: semgrep
+        continue-on-error: true
+        run: |
+          echo "Running Semgrep security analysis..."
+          echo "===================================="
+          echo ""
+
+          # 1. Run Semgrep with text output to console (for logs)
+          # We use --error to ensure it fails if issues are found
+          semgrep scan \
+            --config=p/python \
+            --config=p/security-audit \
+            --config=p/owasp-top-ten \
+            --verbose \
+            --metrics=off
+
+          # Capture exit code from the text scan
+          EXIT_CODE=$?
+
+          echo ""
+          echo "Generating SARIF report..."
+
+          # 2. Generate SARIF report for GitHub Security
+          semgrep scan \
+            --config=p/python \
+            --config=p/security-audit \
+            --config=p/owasp-top-ten \
+            --sarif \
+            --output=semgrep.sarif \
+            --metrics=off || true
+
+          # Verify SARIF file was created
+          if [ -f semgrep.sarif ]; then
+            echo "✓ SARIF file created successfully"
+            ls -lh semgrep.sarif
+          else
+            echo "⚠️  Warning: SARIF file not created"
+          fi
+
+          # Return the exit code from the text scan
+          exit $EXIT_CODE
+        env:
+          SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+
+      - name: Upload Semgrep SARIF to GitHub Security
+        if: always() && hashFiles('semgrep.sarif') != ''
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: semgrep.sarif
+          category: semgrep
+
+      - name: Upload Semgrep reports as artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: semgrep-reports
+          path: semgrep.sarif
+          if-no-files-found: warn
+
+      - name: Check Semgrep results
+        if: steps.semgrep.outcome == 'failure'
+        run: |
+          echo "⚠️  Semgrep found security issues"
+          echo ""
+          echo "Review the findings:"
+          echo "  1. Check the output above for details"
+          echo "  2. Go to Security -> Code scanning -> Semgrep category"
+          echo "  3. Download artifacts for full reports"
+          echo ""
+          echo "Note: Some findings may be false positives."
+          echo "Review each one carefully before taking action."
+          exit 1
+
+