From 1e97a3b615d86137110ea32db845381a0262c5da Mon Sep 17 00:00:00 2001 From: Tomer Seinfeld Date: Thu, 12 Jun 2025 21:02:07 +0300 Subject: [PATCH 1/4] add ci --- .github/workflows/EOLScan.yml | 20 +++++++++++++ .github/workflows/LicenseCompliance.yml | 20 +++++++++++++ .github/workflows/SecretsScan.yml | 20 +++++++++++++ .github/workflows/Vulnerability_Scan.yml | 31 ++++++++++++++++++++ .github/workflows/ZanadirScan.yml | 23 +++++++++++++++ .github/workflows/{ci.yml => unit-tests.yml} | 0 6 files changed, 114 insertions(+) create mode 100644 .github/workflows/EOLScan.yml create mode 100644 .github/workflows/LicenseCompliance.yml create mode 100644 .github/workflows/SecretsScan.yml create mode 100644 .github/workflows/Vulnerability_Scan.yml create mode 100644 .github/workflows/ZanadirScan.yml rename .github/workflows/{ci.yml => unit-tests.yml} (100%) diff --git a/.github/workflows/EOLScan.yml b/.github/workflows/EOLScan.yml new file mode 100644 index 0000000..2398917 --- /dev/null +++ b/.github/workflows/EOLScan.yml @@ -0,0 +1,20 @@ +name: EOL Scan + +on: + push: + branches: + - main + pull_request: + +jobs: + eol-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Scan current project + uses: xeol-io/xeol-action@v1.1.1 + with: + path: "." \ No newline at end of file diff --git a/.github/workflows/LicenseCompliance.yml b/.github/workflows/LicenseCompliance.yml new file mode 100644 index 0000000..0ae025b --- /dev/null +++ b/.github/workflows/LicenseCompliance.yml @@ -0,0 +1,20 @@ +name: License Compliance Scan + +on: + push: + branches: + - main + pull_request: + +jobs: + license-compliance-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: License Compliance Scan + uses: fossas/fossa-action@main + with: + api-key: ${{ secrets.FOSSA_API_KEY }} diff --git a/.github/workflows/SecretsScan.yml b/.github/workflows/SecretsScan.yml new file mode 100644 index 0000000..2d4295a --- /dev/null +++ b/.github/workflows/SecretsScan.yml @@ -0,0 +1,20 @@ +name: Secrets Scan + +on: + push: + branches: + - main + pull_request: + +jobs: + secrets-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Secret Scanning + uses: trufflesecurity/trufflehog@main + with: + extra_args: --results=verified,unknown \ No newline at end of file diff --git a/.github/workflows/Vulnerability_Scan.yml b/.github/workflows/Vulnerability_Scan.yml new file mode 100644 index 0000000..97e8996 --- /dev/null +++ b/.github/workflows/Vulnerability_Scan.yml @@ -0,0 +1,31 @@ +name: Vulnerability Scan + +# Controls when the workflow will run +on: + # Triggers the workflow on push or pull request events but only for the "main" branch + push: + branches: [ 'main'] + pull_request: + branches: [ 'main' ] + + # Allows you to run this workflow manually from the Actions tab + workflow_dispatch: + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a single job called "build" + vulnerability-scan: + # The type of runner that the job will run on + runs-on: ubuntu-latest + + # Steps represent a sequence of tasks that will be executed as part of the job + steps: + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it + - uses: actions/checkout@v4 + + # Vulnerability Scan + - name: Scan current project + uses: anchore/scan-action@v6 + with: + path: "." + output-format: "table" diff --git a/.github/workflows/ZanadirScan.yml b/.github/workflows/ZanadirScan.yml new file mode 100644 index 0000000..8a9406e --- /dev/null +++ b/.github/workflows/ZanadirScan.yml @@ -0,0 +1,23 @@ +name: Zanadir Scan + +on: + push: + branches: + - main + pull_request: + +jobs: + zanadir-scan: + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v4 + with: + fetch-depth: 0 + - name: Run zanadir Github action + uses: mustachecase/zanadir-action@v1 + with: + dir: . + debug: true + enforce: false + output: table \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/unit-tests.yml similarity index 100% rename from .github/workflows/ci.yml rename to .github/workflows/unit-tests.yml From 0fb1c5ea81575b8fe2684bb8f4588034122a3621 Mon Sep 17 00:00:00 2001 From: Tomer Seinfeld Date: Thu, 12 Jun 2025 21:08:21 +0300 Subject: [PATCH 2/4] fix vul --- .github/workflows/unit-tests.yml | 24 ++++++++++++++++++++++-- requirements.txt | 4 ++-- 2 files changed, 24 insertions(+), 4 deletions(-) diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index bf5547b..8e40f15 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -5,20 +5,40 @@ on: branches: [ main ] pull_request: branches: [ main ] + schedule: + - cron: '0 0 * * 0' # Run weekly on Sunday jobs: + security-scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Set up Python + uses: actions/setup-python@v4 + with: + python-version: '3.9' + - name: Install dependencies + run: | + python -m pip install --upgrade pip + pip install safety + - name: Check for security vulnerabilities + run: | + safety check + test: + needs: security-scan runs-on: ubuntu-latest steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v4 - name: Set up Python - uses: actions/setup-python@v2 + uses: actions/setup-python@v4 with: python-version: '3.9' - name: Install dependencies run: | python -m pip install --upgrade pip pip install -r requirements.txt + pip install requests==2.32.4 spotipy==2.25.1 - name: Run tests run: | python -m pytest -v \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index 4290f3d..d451d56 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,8 +1,8 @@ python-telegram-bot==20.8 google-generativeai==0.3.2 -requests==2.31.0 +requests==2.32.4 python-dotenv==1.0.1 schedule==1.2.1 -spotipy==2.23.0 +spotipy==2.25.1 pytest==8.0.0 pytest-mock==3.12.0 \ No newline at end of file From 4b034fa37ffa5a95f084b2acdf93626773ddf5fd Mon Sep 17 00:00:00 2001 From: Tomer Seinfeld Date: Thu, 12 Jun 2025 21:15:32 +0300 Subject: [PATCH 3/4] first commit From 749ba504373dc29468722420f87ac833e563e0f7 Mon Sep 17 00:00:00 2001 From: Tomer Seinfeld Date: Thu, 12 Jun 2025 21:20:59 +0300 Subject: [PATCH 4/4] ut --- .github/workflows/unit-tests.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 8e40f15..ea71d2c 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -5,8 +5,6 @@ on: branches: [ main ] pull_request: branches: [ main ] - schedule: - - cron: '0 0 * * 0' # Run weekly on Sunday jobs: security-scan: