security.yml

name: Security Scanning

on:
    push:
      branches: ['**']
    pull_request:
      branches: [ "master" ]

jobs:
  bandit_scan:
    name: Bandit Security Check
    runs-on: ubuntu-latest

    steps:
    - name: Checkout
      uses: actions/checkout@v3

    - name: Set up Python
      uses: actions/setup-python@v3
      with:
        python-version: '3.11'

    - name: Install dependencies
      uses: actions/checkout@v3
    - working-directory: ./backend
      run: |
        python -m pip install --upgrade pip
        pip3 install poetry
        poetry config virtualenvs.create false
        poetry shell
        poetry install

    - name: Run security scan
      uses: actions/checkout@v3
    - working-directory: ./backend
      run: |
        bandit -r .

    - name: Upload report
      if: ${{ failure() }}
      uses: actions/upload-artifact@v2
      with:
        name: bandit-report
        path: output/bandit-report.txt

  truffle_scan:
    name: Truffle Key Scanner
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v4
      with:
        fetch-depth: 0
    - name:
      uses: trufflesecurity/trufflehog@main
      with:
        path: ./
        base: ${{ github.event.repository.default_branch }}
        head: HEAD
  
  pip_audit:
    name: Pip Audit
    runs-on: ubuntu-latest
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - working-directory: ./backend
      run: |
        python -m pip install --upgrade pip
        pip3 install poetry
        poetry config virtualenvs.create false
        poetry shell
        poetry install
    - name: Run pip-audit
      uses: actions/checkout@v3
    - working-directory: ./backend
      run: |
        pip-audit