code_scan.yml

name: Code Scanning

on:
  workflow_dispatch: # run on request (no need for PR)
  push:
    branches: [ "develop", "releases/*" ]
  schedule:
    # every UTC 6PM from Mon to Fri
    - cron: "0 18 * * 1-5"

jobs:
  Trivy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: python -m pip install pip-tools
      - name: Freeze dependencies
        run: |
          mkdir -p .ci/base
          pip-compile -o .ci/base/requirements.txt requirements.txt
          mkdir -p .ci/dev/tests
          pip-compile -o .ci/dev/tests/requirements.txt tests/requirements.txt
          mkdir -p .ci/dev/docker/segment-anything/
          pip-compile -o .ci/dev/docker/segment-anything/requirements.txt docker/segment-anything/requirements.txt
          mkdir -p .ci/base/docs
          pip-compile -o .ci/base/docs/requirements.txt docs/requirements.txt
      - name: Run Trivy Scan (full, csv)
        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
        with:
          trivy-config: ".ci/trivy-csv.yaml"
          scan-type: 'fs'
          scan-ref: ".ci/"
          scanners: vuln,secret
      - name: Run Trivy Scan (prod, spdx.json)
        uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
        with:
          trivy-config: ".ci/trivy-json.yaml"
          scan-type: 'fs'
          scan-ref: ".ci/base"
      - name: Upload Trivy results
        uses: actions/upload-artifact@v4
        with:
          name: trivy-results-prod-json
          path: '${{ github.workspace }}/trivy-results-*'
  Bandit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
      - name: Setup Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: python -m pip install tox
      - name: Bandit Scanning
        run: tox -e bandit-scan
      - name: Upload Bandit artifact
        uses: actions/upload-artifact@v4
        with:
          name: bandit-report
          path: .tox/bandit-report.txt
        # Use always() to always run this step to publish scan results when there are test failures
        if: ${{ always() }}
  call-notify-to-teams:
    needs: [Trivy, Bandit]
    if: |
      always() &&
      contains(needs.*.result, 'failure')
    uses: ./.github/workflows/notify_teams.yml
    secrets: inherit