cedrick2711
666673fa8f
Force connection HTTPS, proxy-inversé, WSGI de production, reset cookie de conncection à chaque reconnection, limite sur les mdp, fichiers et One on One par minute, verification d'injection de SQL dans les champs d'entrées. renommage des fichiers lors du téléchargement, fichier de backup quotidien pour la bd et j'ai oublié quelque chose :(
94 lines
2.2 KiB
YAML
94 lines
2.2 KiB
YAML
name: CI - Security & Lint
|
|
|
|
on:
|
|
push:
|
|
branches: [main, master]
|
|
pull_request:
|
|
branches: [main, master]
|
|
workflow_dispatch: # Allow manual triggers
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
security-audit:
|
|
name: Security Audit
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
cache: 'pip'
|
|
|
|
- name: Install dependencies
|
|
run: pip install pip-audit
|
|
|
|
- name: Scan for vulnerable dependencies
|
|
run: pip-audit --require-hashes --no-deps || pip-audit
|
|
|
|
lint:
|
|
name: Lint with Ruff
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
|
|
- name: Install ruff
|
|
run: pip install ruff
|
|
|
|
- name: Run ruff linter
|
|
run: ruff check . --output-format=github
|
|
|
|
- name: Run ruff formatter check
|
|
run: ruff format --check .
|
|
|
|
security-scan:
|
|
name: Security Scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
cache: 'pip'
|
|
|
|
- name: Install app dependencies
|
|
run: pip install -r requirements.txt
|
|
|
|
- name: Run security scan
|
|
env:
|
|
SECRET_KEY: ${{ secrets.CI_SECRET_KEY || 'test-key-not-for-production-1234567890' }}
|
|
FLASK_DEBUG: 'false'
|
|
run: python security_scan.py --skip-http
|
|
|
|
test:
|
|
name: Tests
|
|
runs-on: ubuntu-latest
|
|
needs: [security-audit, lint]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.12'
|
|
cache: 'pip'
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r requirements.txt
|
|
|
|
- name: Run tests
|
|
run: |
|
|
echo "No tests configured yet. Add tests to the project."
|
|
# python -m pytest tests/ --cov=. --cov-report=xml
|
|
continue-on-error: true |