fix: pin hatchling + bump pypi-publish (Metadata-Version 2.5 publish failure) #161
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Snyk Security Scan for QWED-Infra | |
| # Scans Python dependencies AND Terraform IaC files | |
| # Secrets required: SNYK_TOKEN, SNYK_ORG_ID | |
| name: Snyk Security | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| # Weekly scan every Monday at 9 AM UTC | |
| - cron: '0 9 * * 1' | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| snyk-python: | |
| name: Snyk Python Dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Set up Python | |
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | |
| with: | |
| python-version: '3.11' | |
| - name: Install Snyk CLI | |
| run: npm install -g snyk | |
| - name: Install Python dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e ".[dev]" || pip install -e . | |
| pip freeze > requirements.txt | |
| - name: Snyk Python dependency scan | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| run: snyk test --file=requirements.txt --package-manager=pip --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high --sarif-file-output=snyk-python.sarif | |
| - name: Upload Snyk Python results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| if: always() && hashFiles('snyk-python.sarif') != '' | |
| with: | |
| sarif_file: snyk-python.sarif | |
| snyk-iac: | |
| name: Snyk IaC (Terraform) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Install Snyk CLI | |
| run: npm install -g snyk | |
| - name: Snyk IaC Terraform scan | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| run: snyk iac test demo/ --org=${{ secrets.SNYK_ORG_ID }} --severity-threshold=high --sarif-file-output=snyk-iac.sarif | |
| - name: Upload Snyk IaC results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| if: always() && hashFiles('snyk-iac.sarif') != '' | |
| with: | |
| sarif_file: snyk-iac.sarif | |
| snyk-code: | |
| name: Snyk Code SAST | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
| - name: Install Snyk CLI | |
| run: npm install -g snyk | |
| - name: Snyk Code analysis | |
| env: | |
| SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} | |
| run: snyk code test --org=${{ secrets.SNYK_ORG_ID }} --sarif-file-output=snyk-code.sarif | |
| - name: Upload Snyk Code results | |
| uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4 | |
| if: always() && hashFiles('snyk-code.sarif') != '' | |
| with: | |
| sarif_file: snyk-code.sarif |