Static Security CI Check - #167
Conversation
github-actions
Bot
added
ci
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
The Bandit Python security tool will be run for each PR, and any results will be uploaded to GitHub's security dashboard for this repository.
alecbcs
left a comment
alecbcs
left a comment
There was a problem hiding this comment.
Just a couple quick suggestions. Otherwise this is looking good for me.
- minimize requirements.txt for the security check - use always() instead of || true to ensure the sarif file is uploaded - add explanation to ignore check line Co-authored-by: Caetano Melone <melone1@llnl.gov> Co-authored-by: Alec Scott <scott112@llnl.gov>
… trigger Co-authored-by: Caetano Melone <melone1@llnl.gov> Co-authored-by: Alec Scott <scott112@llnl.gov>
|
Can we merge the CodeQL CI YAML file into the existing security CI YAML so that we run both out of a single file and they're triggered by the same conditions? |
|
I'll try |
|
ok @alecbcs that worked, though for some reason I needed to pull out the permissions into |
replica of llnl/hubcast#167 and llnl/hubcast#169: - adds Bandit (Python static security analysis) check to each PR - enables GitHub's CodeQL feature - adds permissions blocks to existing workflows
* ci: add security checks replica of llnl/hubcast#167 and llnl/hubcast#169: - adds Bandit (Python static security analysis) check to each PR - enables GitHub's CodeQL feature - adds permissions blocks to existing workflows * allow use of asserts
3 participants
The Bandit Python security tool will be run for each PR, and any results
will be uploaded to GitHub's security dashboard for this repository.
GitHub's CodeQL feature is also enabled.
A bot will add inline comments to the PR if any issues are found. Example: