Fix testing issues #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Supply chain | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| # A weekly run catches vulnerabilities that are published after a change merged. | |
| - cron: "17 5 * * 1" | |
| permissions: {} | |
| jobs: | |
| gitleaks: | |
| name: Leaked credentials | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # The history scan needs every commit, not just the checked out tip. | |
| fetch-depth: 0 | |
| - name: Run gitleaks scan | |
| uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITLEAKS_CONFIG: .gitleaks.toml | |
| GITLEAKS_ENABLE_COMMENTS: "false" | |
| pip-audit: | |
| name: Vulnerable dependencies | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install pip-audit | |
| run: python -m pip install --upgrade pip pip-audit | |
| - name: Audit the resolved dependency tree | |
| # Auditing the project rather than the runner environment keeps pip-audit's own dependencies | |
| # out of the result, so a finding always concerns something a user actually installs. | |
| run: pip-audit --strict --progress-spinner=off . | |
| sbom: | |
| name: Software bill of materials | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Install the project into an isolated environment | |
| # The SBOM records the transitive closure a user really gets, which needs a resolved install | |
| # rather than the version floors declared in pyproject.toml. | |
| run: | | |
| python -m venv local/sbom-venv | |
| local/sbom-venv/bin/python -m pip install --upgrade pip | |
| local/sbom-venv/bin/python -m pip install . | |
| - name: Generate the SBOM | |
| run: | | |
| python -m pip install cyclonedx-bom | |
| mkdir -p dist | |
| cyclonedx-py environment local/sbom-venv/bin/python --of JSON -o dist/spotify_monitor.cdx.json | |
| - name: Publish the SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: spotify-monitor-sbom | |
| path: dist/spotify_monitor.cdx.json | |
| if-no-files-found: error | |
| debug-image-scan: | |
| name: Debug image vulnerabilities | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build the debug secret grabber image | |
| run: docker build --file debug/spotify_monitor_secret_grabber_docker/Dockerfile --tag spotify-secrets-grabber:scan debug | |
| - name: Scan the debug secret grabber image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: spotify-secrets-grabber:scan | |
| severity: CRITICAL,HIGH | |
| # A base-image CVE with no available fix cannot be acted on here, so it does not fail the build. | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| image-scan: | |
| name: Container image vulnerabilities | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build the image | |
| run: docker build --tag spotify-monitor:scan . | |
| - name: Scan the image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: spotify-monitor:scan | |
| severity: CRITICAL,HIGH | |
| # A base-image CVE with no available fix cannot be acted on here, so it does not fail the build. | |
| ignore-unfixed: true | |
| exit-code: "1" |