FazBrowse GitHub Viewer | Trending | | Home

Tools: [Download Repo ZIP] [View Raw Code] [Original HTTPS Page]

feast/.github/workflows/security.yml at stable · feast-dev/feast · GitHub

112 lines (93 loc) · 2.64 KB

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

name: "Security"

on:

push:

branches: [master]

pull_request:

branches: [master]

schedule:

- cron: "0 6 * * 1"

concurrency:

group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}

cancel-in-progress: true

jobs:

codeql:

name: CodeQL Analysis

runs-on: ubuntu-latest

timeout-minutes: 30

permissions:

actions: read

contents: read

security-events: write

strategy:

fail-fast: false

matrix:

language: ["python", "javascript-typescript"]

steps:

- name: Checkout repository

uses: actions/checkout@v4

- name: Initialize CodeQL

uses: github/codeql-action/init@v4

with:

languages: ${{ matrix.language }}

- name: Autobuild

uses: github/codeql-action/autobuild@v4

- name: Perform CodeQL Analysis

uses: github/codeql-action/analyze@v4

with:

category: "/language:${{ matrix.language }}"

safety:

name: Dependency Security Scan

runs-on: ubuntu-latest

permissions:

contents: read

steps:

- name: Checkout repository

uses: actions/checkout@v4

- name: Set up Python

uses: actions/setup-python@v5

with:

python-version: "3.12"

cache: "pip"

cache-dependency-path: pyproject.toml

- name: Install project dependencies and safety

run: |

pip install safety

pip install -e ".[ci]" || pip install -e .

- name: Run safety scan

continue-on-error: true

run: safety scan --output json

govulncheck:

name: Go Vulnerability Check (${{ matrix.module }})

runs-on: ubuntu-latest

timeout-minutes: 15

permissions:

contents: read

strategy:

fail-fast: false

matrix:

include:

- module: go-feature-server

working-directory: .

go-version-file: go.mod

needs-protos: true

- module: feast-operator

working-directory: infra/feast-operator

go-version-file: infra/feast-operator/go.mod

needs-protos: false

steps:

- name: Checkout repository

uses: actions/checkout@v4

- name: Set up Go

uses: actions/setup-go@v5

with:

go-version-file: ${{ matrix.go-version-file }}

- name: Compile Go protobuf files

if: matrix.needs-protos

run: make compile-protos-go

- name: Run govulncheck

continue-on-error: true

uses: golang/govulncheck-action@v1

with:

work-dir: ${{ matrix.working-directory }}

go-package: ./...

repo-checkout: false

Back | FazBrowse Home | New Git URL