mirror of
https://github.com/semantica-agi/semantica.git
synced 2026-09-01 04:00:28 +00:00
Mohd KaifandSameer6305
a4aa71ad87
* fix(ci): unblock py3.9 install matrix and raise Scorecard pinning/signing pip install semantica failed on Python 3.9 across all three OSes because spacy had no upper bound, so pip resolved spacy 3.8.16 whose thinc>=8.3.12 requirement has no cp39 wheels and no working sdist build path. Cap spacy/thinc for python_version < '3.10' to the last wheel-compatible pair. Also addresses the two OpenSSF Scorecard findings that were actually fixable in code: - Pinned-Dependencies: Dockerfile base images (node:26-alpine, python:3.13-slim) were unpinned by digest; pin both, and pin five previously-unversioned pip install calls in CI (build, safety, bandit, semgrep, jq, pip-audit). - Signed-Releases: attest-build-provenance only publishes to the GH attestations API, which Scorecard doesn't inspect. Sign dist/* with Sigstore and attach the .sigstore.json bundles as release assets. * fix(ci): correct Sigstore artifact inputs --------- Co-authored-by: Sameer6305 <sskadam6305@gmail.com>
43 lines
1.6 KiB
YAML
43 lines
1.6 KiB
YAML
name: Security
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 1'
|
|
workflow_dispatch:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'pyproject.toml'
|
|
- 'requirements-ci.txt'
|
|
- '.github/workflows/security.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
|
|
with:
|
|
python-version: '3.11'
|
|
# Upgrade first: actions/setup-python's baked-in setuptools has been
|
|
# behind known-vulnerable floors before (e.g. PYSEC-2026-3447 /
|
|
# setuptools 75.1.0), so don't trust the preinstalled one.
|
|
- run: python -m pip install --upgrade pip setuptools
|
|
# Audit the pinned dependency set (requirements-ci.txt is compiled from
|
|
# pyproject.toml with --extra all — the same coverage as the [all]
|
|
# extra, minus the Linux-only gpu set — so this keeps scan parity with
|
|
# CI/release builds without a time-dependent resolution). This is the
|
|
# fix for PYSEC-2024-38 (#869): the bare-env job never had fastapi or
|
|
# python-multipart installed to look at.
|
|
- run: pip install -r requirements-ci.txt
|
|
# PR runs gate on findings, since they're scoped to actual
|
|
# pyproject.toml changes under review. The schedule/workflow_dispatch
|
|
# runs stay non-blocking until a full pass over pre-existing findings
|
|
# across the whole [all] tree has been done.
|
|
- run: pip install pip-audit==2.10.1
|
|
- run: pip-audit -r requirements-ci.txt
|
|
continue-on-error: ${{ github.event_name != 'pull_request' }}
|