From b6e700a4e3095fe3a7167ee1751a136119270dc8 Mon Sep 17 00:00:00 2001 From: Vijay Kumar HP <98866009+vhpintel@users.noreply.github.com> Date: Thu, 12 Feb 2026 14:07:13 +0530 Subject: [PATCH 1/2] Create code-scans.yaml Workflow to scan the code for Security vulnerabilities and Code quality issues --- .github/workflows/code-scans.yaml | 167 ++++++++++++++++++++++++++++++ 1 file changed, 167 insertions(+) create mode 100644 .github/workflows/code-scans.yaml diff --git a/.github/workflows/code-scans.yaml b/.github/workflows/code-scans.yaml new file mode 100644 index 00000000..b2309e99 --- /dev/null +++ b/.github/workflows/code-scans.yaml @@ -0,0 +1,167 @@ +name: SDLE Scans + +on: + workflow_dispatch: + inputs: + PR_number: + description: 'Pull request number' + required: true + push: + branches: [ main ] + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + +concurrency: + group: sdle-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + +# ----------------------------- +# 1) Trivy Scan +# ----------------------------- + trivy_scan: + name: Trivy Vulnerability Scan + runs-on: self-hosted + steps: + - uses: actions/checkout@v4 + + - name: Create report directory + run: mkdir -p trivy-reports + + - name: Install Trivy + run: | + # Check if trivy is already installed + if ! command -v trivy &> /dev/null; then + wget -qO- https://github.com/aquasecurity/trivy/releases/download/v0.55.0/trivy_0.55.0_Linux-64bit.tar.gz | tar -xzv -C /tmp + sudo mv /tmp/trivy /usr/local/bin/ + fi + trivy --version + + - name: Run Trivy FS Scan + continue-on-error: true + run: | + trivy fs . \ + --scanners vuln,misconfig,secret \ + --severity CRITICAL,HIGH \ + --format table \ + --output trivy-reports/trivy_scan_report.txt + + - name: Run Trivy Image Scan - vllm-cpu + continue-on-error: true + run: | + trivy image \ + --severity HIGH,CRITICAL \ + --format table \ + --output trivy-reports/trivy-vllm-cpu.txt \ + public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2 || \ + echo "Image scan skipped - image not available locally" > trivy-reports/trivy-vllm-cpu.txt + + - name: Upload Trivy Reports + if: always() + uses: actions/upload-artifact@v4 + with: + name: trivy-reports + path: trivy-reports/ + + - name: Show Trivy FS Report in Logs + if: always() + run: | + echo "========= TRIVY FS SCAN FINDINGS =========" + cat trivy-reports/trivy_scan_report.txt || echo "No FS scan report found" + echo "==========================================" + +# ----------------------------- +# 2) Bandit Scan +# ----------------------------- + bandit_scan: + name: Bandit security scan + runs-on: self-hosted + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + submodules: 'recursive' + fetch-depth: 0 + - uses: actions/setup-python@v5 + with: + python-version: "3.x" + - name: Install Bandit + run: pip install bandit + - name: Create Bandit configuration + run: | + cat > .bandit << 'EOF' + [bandit] + exclude_dirs = tests,test,venv,.venv,node_modules + skips = B101 + EOF + shell: bash + - name: Run Bandit scan + run: | + bandit -r . -ll -iii -f screen + bandit -r . -ll -iii -f html -o bandit-report.html + - name: Upload Bandit Report + uses: actions/upload-artifact@v4 + with: + name: bandit-report + path: bandit-report.html + retention-days: 30 +# ----------------------------- +# 3) ShellCheck Scan +# ----------------------------- + shellcheck_scan: + name: ShellCheck script analysis + runs-on: self-hosted + permissions: + contents: read + steps: + - uses: actions/checkout@v4 + + - name: Create report directory + run: mkdir -p shellcheck-reports + + - name: Install ShellCheck + run: | + # Check if shellcheck is already installed + if ! command -v shellcheck &> /dev/null; then + wget -qO- "https://github.com/koalaman/shellcheck/releases/download/stable/shellcheck-stable.linux.x86_64.tar.xz" | tar -xJv + sudo cp shellcheck-stable/shellcheck /usr/local/bin/ + rm -rf shellcheck-stable + fi + shellcheck --version + + - name: Find shell scripts + id: find_scripts + run: | + SCRIPT_COUNT=$(find . -type f -name "*.sh" ! -path "./.git/*" | wc -l) + echo "Shell scripts found: $SCRIPT_COUNT" + echo "script_count=$SCRIPT_COUNT" >> $GITHUB_OUTPUT + + - name: Run ShellCheck + if: steps.find_scripts.outputs.script_count > 0 + continue-on-error: true + run: | + echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt + echo "==========================" >> shellcheck-reports/shellcheck-report.txt + echo "" >> shellcheck-reports/shellcheck-report.txt + + find . -type f -name "*.sh" ! -path "./.git/*" | while read -r script; do + echo "Checking: $script" >> shellcheck-reports/shellcheck-report.txt + shellcheck -f gcc "$script" >> shellcheck-reports/shellcheck-report.txt 2>&1 || true + echo "" >> shellcheck-reports/shellcheck-report.txt + done + + cat shellcheck-reports/shellcheck-report.txt + + - name: Create empty report if no scripts + if: steps.find_scripts.outputs.script_count == 0 + run: | + echo "ShellCheck Analysis Report" > shellcheck-reports/shellcheck-report.txt + echo "No shell scripts found to analyze." >> shellcheck-reports/shellcheck-report.txt + + - name: Upload ShellCheck Report + if: always() + uses: actions/upload-artifact@v4 + with: + name: shellcheck-report + path: shellcheck-reports/shellcheck-report.txt From b2948f39f2ce1dc712dd30791b75eb3e72743812 Mon Sep 17 00:00:00 2001 From: "H P, Vijay Kumar" Date: Mon, 16 Feb 2026 00:16:18 +0530 Subject: [PATCH 2/2] Updated the co-pilot review --- .github/workflows/code-scans.yaml | 50 +++++++++++++++---------------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/.github/workflows/code-scans.yaml b/.github/workflows/code-scans.yaml index b2309e99..b8460895 100644 --- a/.github/workflows/code-scans.yaml +++ b/.github/workflows/code-scans.yaml @@ -12,9 +12,13 @@ on: types: [opened, synchronize, reopened, ready_for_review] concurrency: - group: sdle-${{ github.event.pull_request.number || github.ref }} + group: sdle-${{ github.event.inputs.PR_number || github.event.pull_request.number || github.ref }} cancel-in-progress: true +permissions: + contents: read + actions: read + jobs: # ----------------------------- @@ -25,37 +29,32 @@ jobs: runs-on: self-hosted steps: - uses: actions/checkout@v4 + with: + ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }} - name: Create report directory run: mkdir -p trivy-reports - - name: Install Trivy - run: | - # Check if trivy is already installed - if ! command -v trivy &> /dev/null; then - wget -qO- https://github.com/aquasecurity/trivy/releases/download/v0.55.0/trivy_0.55.0_Linux-64bit.tar.gz | tar -xzv -C /tmp - sudo mv /tmp/trivy /usr/local/bin/ - fi - trivy --version - - name: Run Trivy FS Scan + uses: aquasecurity/trivy-action@0.28.0 continue-on-error: true - run: | - trivy fs . \ - --scanners vuln,misconfig,secret \ - --severity CRITICAL,HIGH \ - --format table \ - --output trivy-reports/trivy_scan_report.txt + with: + scan-type: 'fs' + scan-ref: '.' + scanners: 'vuln,misconfig,secret' + severity: 'CRITICAL,HIGH' + format: 'table' + output: 'trivy-reports/trivy_scan_report.txt' - name: Run Trivy Image Scan - vllm-cpu + uses: aquasecurity/trivy-action@0.28.0 continue-on-error: true - run: | - trivy image \ - --severity HIGH,CRITICAL \ - --format table \ - --output trivy-reports/trivy-vllm-cpu.txt \ - public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2 || \ - echo "Image scan skipped - image not available locally" > trivy-reports/trivy-vllm-cpu.txt + with: + scan-type: 'image' + image-ref: 'public.ecr.aws/q9t5s3a7/vllm-cpu-release-repo:v0.10.2' + severity: 'HIGH,CRITICAL' + format: 'table' + output: 'trivy-reports/trivy-vllm-cpu.txt' - name: Upload Trivy Reports if: always() @@ -81,6 +80,7 @@ jobs: - name: Checkout uses: actions/checkout@v4 with: + ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }} submodules: 'recursive' fetch-depth: 0 - uses: actions/setup-python@v5 @@ -112,10 +112,10 @@ jobs: shellcheck_scan: name: ShellCheck script analysis runs-on: self-hosted - permissions: - contents: read steps: - uses: actions/checkout@v4 + with: + ref: ${{ github.event.inputs.PR_number && format('refs/pull/{0}/merge', github.event.inputs.PR_number) || '' }} - name: Create report directory run: mkdir -p shellcheck-reports