Skip to content

Code Scanning

Code Scanning #365

Workflow file for this run

name: Code Scanning
permissions: read-all
on:
workflow_dispatch: # run on request (no need for PR)
schedule:
# every UTC 6PM from Mon to Fri
- cron: "0 18 * * 1-5"
jobs:
Bandit:
runs-on: ubuntu-20.04
steps:
- name: CHECKOUT REPOSITORY
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Install dependencies
run: python -m pip install tox
- name: Bandit Scanning
run: tox -e bandit-scan
- name: UPLOAD BANDIT REPORT
uses: actions/upload-artifact@v4
with:
name: bandit-report
path: .tox/bandit-report.txt
# Use always() to always run this step to publish scan results when there are test failures
if: ${{ always() }}
Trivy-scan:
runs-on: ubuntu-20.04
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Install dependencies
run: python -m pip install tox
- name: Trivy Scanning
env:
TRIVY_DOWNLOAD_URL: ${{ vars.TRIVY_DOWNLOAD_URL }}
run: tox -vv -e trivy-scan
- name: Upload Trivy results artifact
uses: actions/upload-artifact@v4
with:
name: trivy-results
path: |
.tox/trivy-scan-results.txt
.tox/trivy-spdx-anomalib.json