chore(deps-dev): bump vitest from 4.1.10 to 4.1.11 in /ui #12650
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'SDK: Security' | |
| on: | |
| push: | |
| branches: | |
| - 'master' | |
| - 'v5.*' | |
| paths: | |
| - 'prowler/**' | |
| - 'tests/**' | |
| - 'pyproject.toml' | |
| - 'uv.lock' | |
| - '.github/workflows/sdk-tests.yml' | |
| - '.github/workflows/sdk-security.yml' | |
| - '.github/actions/setup-python-uv/**' | |
| - '.github/actions/osv-scanner/**' | |
| - '.github/scripts/osv-scan.sh' | |
| pull_request: | |
| branches: | |
| - 'master' | |
| - 'v5.*' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| sdk-security-scans: | |
| if: github.repository == 'prowler-cloud/prowler' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pull-requests: write # osv-scanner action posts/updates a PR comment with findings | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| pypi.org:443 | |
| files.pythonhosted.org:443 | |
| github.com:443 | |
| api.github.com:443 | |
| objects.githubusercontent.com:443 | |
| release-assets.githubusercontent.com:443 | |
| api.osv.dev:443 | |
| api.deps.dev:443 | |
| osv-vulnerabilities.storage.googleapis.com:443 | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| # zizmor: ignore[artipacked] | |
| persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch | |
| - name: Check for SDK changes | |
| id: check-changes | |
| uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6 | |
| with: | |
| files: | | |
| prowler/** | |
| tests/** | |
| pyproject.toml | |
| uv.lock | |
| .github/workflows/sdk-tests.yml | |
| .github/workflows/sdk-security.yml | |
| .github/actions/setup-python-uv/** | |
| .github/actions/osv-scanner/** | |
| .github/scripts/osv-scan.sh | |
| files_ignore: | | |
| prowler/CHANGELOG.md | |
| prowler/changelog.d/** | |
| **/AGENTS.md | |
| - name: Setup Python with uv | |
| if: steps.check-changes.outputs.any_changed == 'true' | |
| uses: ./.github/actions/setup-python-uv | |
| with: | |
| python-version: '3.12' | |
| - name: Security scan with Bandit | |
| if: steps.check-changes.outputs.any_changed == 'true' | |
| run: uv run bandit -q -lll -x '*_test.py,./.venv/,./contrib/,./api/,./ui' -r . | |
| - name: Dependency vulnerability scan with osv-scanner | |
| if: steps.check-changes.outputs.any_changed == 'true' | |
| uses: ./.github/actions/osv-scanner | |
| with: | |
| lockfile: uv.lock | |
| - name: Dead code detection with Vulture | |
| # Run even when osv-scanner reports findings so dead-code signal isn't masked by SCA failures. | |
| if: ${{ !cancelled() && steps.check-changes.outputs.any_changed == 'true' }} | |
| run: uv run vulture --exclude ".venv,contrib,api,ui" --min-confidence 100 . |