Enhanced Security Scanning and Remediation

Enhanced Security Scanning and Remediation #62

Workflow file for this run

.github/workflows/enhanced-security.yml at 80cb5c3

	name: Enhanced Security Scanning and Remediation

	on:
	push:
	branches: [ main, master, develop ]
	pull_request:
	branches: [ main, master, develop ]
	schedule:
	# Run comprehensive security scans daily at 2 AM UTC
	- cron: '0 2 * * *'
	workflow_dispatch:
	inputs:
	scan_type:
	description: 'Type of scan to run'
	required: false
	default: 'all'
	type: choice
	options:
	- all
	- dependencies
	- code
	- container
	- compliance
	fail_on_high:
	description: 'Fail workflow on high severity findings'
	required: false
	default: true
	type: boolean

	env:
	SECURITY_REPORT_PATH: security-reports
	REMEDIATION_PATH: remediation-scripts

	jobs:
	setup-security-scan:
	runs-on: ubuntu-latest
	name: Setup Security Scan Environment
	outputs:
	scan-matrix: ${{ steps.set-matrix.outputs.matrix }}
	should-fail: ${{ steps.check-fail.outputs.should-fail }}

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'

	- name: Install security tools
	run: \|
	python -m pip install --upgrade pip
	pip install safety bandit semgrep requests pyyaml
	pip install -r requirements-dev.txt \|\| true

	- name: Install system tools
	run: \|
	sudo apt-get update
	sudo apt-get install -y curl wget gnupg
	# Install Trivy
	sudo apt-get install wget apt-transport-https gnupg lsb-release
	wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key \| sudo apt-key add -
	echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" \| sudo tee -a /etc/apt/sources.list.d/trivy.list
	sudo apt-get update
	sudo apt-get install trivy

	- name: Set scan matrix
	id: set-matrix
	run: \|
	if [ "${{ github.event.inputs.scan_type }}" = "dependencies" ]; then
	echo 'matrix=["dependencies"]' >> $GITHUB_OUTPUT
	elif [ "${{ github.event.inputs.scan_type }}" = "code" ]; then
	echo 'matrix=["code"]' >> $GITHUB_OUTPUT
	elif [ "${{ github.event.inputs.scan_type }}" = "container" ]; then
	echo 'matrix=["container"]' >> $GITHUB_OUTPUT
	elif [ "${{ github.event.inputs.scan_type }}" = "compliance" ]; then
	echo 'matrix=["compliance"]' >> $GITHUB_OUTPUT
	else
	echo 'matrix=["dependencies","code","container","compliance"]' >> $GITHUB_OUTPUT
	fi

	- name: Check fail condition
	id: check-fail
	run: \|
	if [ "${{ github.event.inputs.fail_on_high }}" = "false" ]; then
	echo "should-fail=false" >> $GITHUB_OUTPUT
	else
	echo "should-fail=true" >> $GITHUB_OUTPUT
	fi

	dependency-vulnerability-scan:
	runs-on: ubuntu-latest
	name: Dependency Vulnerability Scan
	needs: setup-security-scan
	if: contains(needs.setup-security-scan.outputs.scan-matrix, 'dependencies')

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'
	cache: 'pip'

	- name: Setup Rust
	uses: actions-rs/toolchain@v1
	with:
	toolchain: stable
	components: rustfmt, clippy

	- name: Setup Node.js
	uses: actions/setup-node@v3
	with:
	node-version: '18'
	cache: 'npm'

	- name: Install security tools
	run: \|
	python -m pip install --upgrade pip
	pip install safety
	cargo install cargo-audit
	npm install -g audit-ci

	- name: Run Python dependency scan
	run: \|
	python scripts/security/vulnerability_scanner.py --dependencies --output ${{ env.SECURITY_REPORT_PATH }}/python-dependencies.json

	- name: Run Rust dependency scan
	run: \|
	cargo audit --json > ${{ env.SECURITY_REPORT_PATH }}/rust-dependencies.json \|\| true

	- name: Run Node.js dependency scan
	run: \|
	npm audit --json > ${{ env.SECURITY_REPORT_PATH }}/node-dependencies.json \|\| true

	- name: Generate dependency remediation script
	run: \|
	python scripts/security/generate_remediation.py --type dependencies --output ${{ env.REMEDIATION_PATH }}/dependencies.sh

	- name: Upload dependency scan results
	uses: actions/upload-artifact@v3
	if: always()
	with:
	name: dependency-security-reports
	path: \|
	${{ env.SECURITY_REPORT_PATH }}/python-dependencies.json
	${{ env.SECURITY_REPORT_PATH }}/rust-dependencies.json
	${{ env.SECURITY_REPORT_PATH }}/node-dependencies.json
	${{ env.REMEDIATION_PATH }}/dependencies.sh
	retention-days: 30

	code-security-analysis:
	runs-on: ubuntu-latest
	name: Code Security Analysis
	needs: setup-security-scan
	if: contains(needs.setup-security-scan.outputs.scan-matrix, 'code')

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'
	cache: 'pip'

	- name: Setup Rust
	uses: actions-rs/toolchain@v1
	with:
	toolchain: stable
	components: rustfmt, clippy

	- name: Install security tools
	run: \|
	python -m pip install --upgrade pip
	pip install bandit semgrep

	- name: Run Bandit static analysis
	run: \|
	bandit -r . -f json -o ${{ env.SECURITY_REPORT_PATH }}/bandit-report.json \|\| true
	bandit -r . \|\| true

	- name: Run Semgrep static analysis
	run: \|
	semgrep --config=auto --json --output=${{ env.SECURITY_REPORT_PATH }}/semgrep-report.json \|\| true
	semgrep --config=auto \|\| true

	- name: Run Rust clippy analysis
	run: \|
	cargo clippy --all-targets --all-features -- -D warnings \|\| true

	- name: Run comprehensive code scan
	run: \|
	python scripts/security/vulnerability_scanner.py --code --output ${{ env.SECURITY_REPORT_PATH }}/code-analysis.json

	- name: Generate code remediation script
	run: \|
	python scripts/security/generate_remediation.py --type code --output ${{ env.REMEDIATION_PATH }}/code-fixes.sh

	- name: Upload code analysis results
	uses: actions/upload-artifact@v3
	if: always()
	with:
	name: code-security-reports
	path: \|
	${{ env.SECURITY_REPORT_PATH }}/bandit-report.json
	${{ env.SECURITY_REPORT_PATH }}/semgrep-report.json
	${{ env.SECURITY_REPORT_PATH }}/code-analysis.json
	${{ env.REMEDIATION_PATH }}/code-fixes.sh
	retention-days: 30

	container-security-scan:
	runs-on: ubuntu-latest
	name: Container Security Scan
	needs: setup-security-scan
	if: contains(needs.setup-security-scan.outputs.scan-matrix, 'container')

	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v2

	- name: Install security tools
	run: \|
	sudo apt-get update
	sudo apt-get install -y curl wget gnupg
	# Install Hadolint
	wget -O /tmp/hadolint https://github.com/hadolint/hadolint/releases/latest/download/hadolint-Linux-x86_64
	chmod +x /tmp/hadolint
	sudo mv /tmp/hadolint /usr/local/bin/hadolint
	# Install Trivy
	sudo apt-get install wget apt-transport-https gnupg lsb-release
	wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key \| sudo apt-key add -
	echo "deb https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" \| sudo tee -a /etc/apt/sources.list.d/trivy.list
	sudo apt-get update
	sudo apt-get install trivy

	- name: Run Hadolint Dockerfile analysis
	run: \|
	hadolint Dockerfile --format=json > ${{ env.SECURITY_REPORT_PATH }}/hadolint-report.json \|\| true
	hadolint Dockerfile \|\| true

	- name: Build test Docker image
	run: \|
	docker build -t flavorsnap-security-scan .

	- name: Run Trivy container scan
	run: \|
	trivy image --format json --output ${{ env.SECURITY_REPORT_PATH }}/trivy-report.json flavorsnap-security-scan \|\| true
	trivy image flavorsnap-security-scan \|\| true

	- name: Run comprehensive container scan
	run: \|
	python scripts/security/vulnerability_scanner.py --container --output ${{ env.SECURITY_REPORT_PATH }}/container-analysis.json

	- name: Generate container remediation script
	run: \|
	python scripts/security/generate_remediation.py --type container --output ${{ env.REMEDIATION_PATH }}/container-fixes.sh

	- name: Upload container scan results
	uses: actions/upload-artifact@v3
	if: always()
	with:
	name: container-security-reports
	path: \|
	${{ env.SECURITY_REPORT_PATH }}/hadolint-report.json
	${{ env.SECURITY_REPORT_PATH }}/trivy-report.json
	${{ env.SECURITY_REPORT_PATH }}/container-analysis.json
	${{ env.REMEDIATION_PATH }}/container-fixes.sh
	retention-days: 30

	compliance-check:
	runs-on: ubuntu-latest
	name: Security Compliance Check
	needs: setup-security-scan
	if: contains(needs.setup-security-scan.outputs.scan-matrix, 'compliance')

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'
	cache: 'pip'

	- name: Install security tools
	run: \|
	python -m pip install --upgrade pip
	pip install requests pyyaml

	- name: Run secret scanning with TruffleHog
	uses: trufflesecurity/trufflehog@main
	with:
	path: ./
	base: main
	head: HEAD
	extra_args: --json --output=${{ env.SECURITY_REPORT_PATH }}/trufflehog-report.json

	- name: Run secret scanning with Gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

	- name: Run comprehensive compliance scan
	run: \|
	python scripts/security/vulnerability_scanner.py --compliance --output ${{ env.SECURITY_REPORT_PATH }}/compliance-analysis.json

	- name: Check security headers configuration
	run: \|
	python scripts/security/check_headers.py --output ${{ env.SECURITY_REPORT_PATH }}/headers-report.json

	- name: Generate compliance remediation script
	run: \|
	python scripts/security/generate_remediation.py --type compliance --output ${{ env.REMEDIATION_PATH }}/compliance-fixes.sh

	- name: Upload compliance check results
	uses: actions/upload-artifact@v3
	if: always()
	with:
	name: compliance-security-reports
	path: \|
	${{ env.SECURITY_REPORT_PATH }}/trufflehog-report.json
	${{ env.SECURITY_REPORT_PATH }}/compliance-analysis.json
	${{ env.SECURITY_REPORT_PATH }}/headers-report.json
	${{ env.REMEDIATION_PATH }}/compliance-fixes.sh
	retention-days: 30

	automated-remediation:
	runs-on: ubuntu-latest
	name: Automated Remediation
	needs: [setup-security-scan, dependency-vulnerability-scan, code-security-analysis, container-security-scan, compliance-check]
	if: always() && github.event_name == 'push'

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	token: ${{ secrets.GITHUB_TOKEN }}

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'

	- name: Download all artifacts
	uses: actions/download-artifact@v3

	- name: Setup Git config
	run: \|
	git config user.name "github-actions[bot]"
	git config user.email "github-actions[bot]@users.noreply.github.com"

	- name: Run automated remediation
	run: \|
	python scripts/security/automated_remediation.py --dry-run --output ${{ env.SECURITY_REPORT_PATH }}/remediation-summary.json

	- name: Create remediation branch
	if: steps.remediation.outputs.has_fixes == 'true'
	run: \|
	git checkout -b automated-security-fixes-${{ github.run_number }}

	- name: Apply automated fixes
	if: steps.remediation.outputs.has_fixes == 'true'
	run: \|
	python scripts/security/automated_remediation.py --apply-fixes

	- name: Commit and push fixes
	if: steps.remediation.outputs.has_fixes == 'true'
	run: \|
	git add .
	git commit -m " Automated security fixes from scan #${{ github.run_number }}"
	git push origin automated-security-fixes-${{ github.run_number }}

	- name: Create remediation PR
	if: steps.remediation.outputs.has_fixes == 'true'
	uses: peter-evans/create-pull-request@v5
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	title: "Automated Security Fixes - Scan #${{ github.run_number }}"
	body: \|
	This PR contains automated security fixes identified during security scan #${{ github.run_number }}.

	## Changes
	- Automated dependency updates for vulnerable packages
	- Code security fixes applied where possible
	- Configuration hardening recommendations implemented

	Please review all changes before merging.
	branch: automated-security-fixes-${{ github.run_number }}
	delete-branch: true

	security-summary-report:
	runs-on: ubuntu-latest
	name: Security Summary Report
	needs: [setup-security-scan, dependency-vulnerability-scan, code-security-analysis, container-security-scan, compliance-check]
	if: always()

	steps:
	- name: Download all artifacts
	uses: actions/download-artifact@v3

	- name: Setup Python
	uses: actions/setup-python@v4
	with:
	python-version: '3.9'

	- name: Generate comprehensive security report
	run: \|
	python scripts/security/generate_security_report.py --output-dir ${{ env.SECURITY_REPORT_PATH }}

	- name: Upload comprehensive report
	uses: actions/upload-artifact@v3
	if: always()
	with:
	name: comprehensive-security-report
	path: \|
	${{ env.SECURITY_REPORT_PATH }}/security-summary.json
	${{ env.SECURITY_REPORT_PATH }}/security-report.html
	${{ env.SECURITY_REPORT_PATH }}/remediation-priority.json
	retention-days: 90

	- name: Create security summary
	run: \|
	python scripts/security/generate_summary.py >> $GITHUB_STEP_SUMMARY

	- name: Check for critical vulnerabilities
	if: needs.setup-security-scan.outputs.should-fail == 'true'
	run: \|
	python scripts/security/check_critical_vulns.py --fail-threshold high \|\| exit 1

	security-notification:
	runs-on: ubuntu-latest
	name: Security Notification
	needs: [setup-security-scan, security-summary-report]
	if: always() && (github.event_name == 'schedule' \|\| github.event_name == 'push')

	steps:
	- name: Download security report
	uses: actions/download-artifact@v3
	with:
	name: comprehensive-security-report
	path: security-reports

	- name: Send Slack notification
	if: env.SLACK_WEBHOOK_URL != ''
	run: \|
	python scripts/security/send_notification.py --platform slack --webhook ${{ secrets.SLACK_WEBHOOK_URL }}
	env:
	SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

	- name: Send email notification
	if: env.SECURITY_EMAIL != ''
	run: \|
	python scripts/security/send_notification.py --platform email --to ${{ secrets.SECURITY_EMAIL }}
	env:
	SECURITY_EMAIL: ${{ secrets.SECURITY_EMAIL }}
	SMTP_HOST: ${{ secrets.SMTP_HOST }}
	SMTP_USER: ${{ secrets.SMTP_USER }}
	SMTP_PASS: ${{ secrets.SMTP_PASS }}

Navigation Menu

Enhanced Security Scanning and Remediation #62

Workflow file

Enhanced Security Scanning and Remediation #62

Uh oh!

Workflow file for this run