sdl.yml

name: sdl
permissions: read-all

on:
  workflow_dispatch:
  push:
    branches:
      - develop
      - release_v*
  pull_request:
    paths:
      - '.github/workflows/sdl.yml'
      - '**.py'

jobs:
  bandit:
    name: Bandit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    defaults:
      run:
        shell: bash
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: 3.10.14
      - name: Install bandit
        run: pip install bandit[toml]==1.7.4
      - name: Run bandit
        run: bandit -c pyproject.toml -r .

  codeql:
    name: CodeQL
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          lfs: true
      - name: Initialize CodeQL
        uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
        with:
          languages: python
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
        with:
          category: "/language:python"

      # pdf reports always empty for pull_request
      - name: Generate Security Report
        if: ${{ github.event_name != 'pull_request' }}
        uses: rsdmike/github-security-report-action@a149b24539044c92786ec39af8ba38c93496495d # v3.0.4
        with:
          template: report
          token: ${{ secrets.GITHUB_TOKEN }}
      - name: Rename Report
        shell: bash
        if: ${{ github.event_name != 'pull_request' }}
        run: |
          DATE=$(date +"%Y-%m-%d")
          REF_NAME="${{ github.ref_name }}"
          mv "report.pdf" "codeql_nncf_report_${DATE}_${REF_NAME//\//-}_${{ github.sha }}.pdf"
      - name: Upload CodeQL Artifacts
        if: ${{ github.event_name != 'pull_request' }}
        uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 #v4.6.1
        with:
          name: codeql-scan-results
          path: "./codeql*.pdf"

  trivy:
    name: Trivy
    runs-on: ubuntu-latest
    timeout-minutes: 10
    # Skip trivy for PRs to avoid blocking merge PRs by found vulnerabilities in requirements
    if: ${{ github.event_name != 'pull_request' }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Run trivy
        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
        with:
          scan-type: "fs"
          scan-ref: .
          severity: "CRITICAL,HIGH"
          scanners: "misconfig,license,vuln"
          format: template
          template: "@.github/scripts/trivy_html.tpl"
          output: trivy_report.html
          cache: false
          hide-progress: true
          exit-code: 1
      - name: Rename Report
        if: ${{ !cancelled() }}
        shell: bash
        run: |
          DATE=$(date +"%Y-%m-%d")
          REF_NAME="${{ github.ref_name }}"
          mv "trivy_report.html" "trivy_report_${DATE}_${REF_NAME//\//-}_${{ github.sha }}.html"
      - name: Upload Scan Results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
        with:
          name: trivy-report
          path: "./trivy_report*.html"
          retention-days: 30