python-project-template/.github/workflows/dependency-review.yml at main · nullhack/python-project-template · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
name: Dependency Review

on:
  pull_request:
    branches: [ main ]

permissions:
  contents: read
  # Write permission for security-events is required for private repositories
  # to upload SARIF files. For public repositories, this permission is not needed.
  security-events: write

jobs:
  dependency-review:
    name: Dependency Review
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.1

      - name: Dependency Review
        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
        with:
          # Fail the build if vulnerabilities are found
          fail-on-severity: moderate
          # Deny copyleft and non-permissive licenses explicitly
          deny-licenses: AGPL-3.0, GPL-2.0-only, GPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-3.0-only, SSPL-1.0, BUSL-1.1
          # Create a summary comment on the PR
          comment-summary-in-pr: true

  # Additional security scanning for Python dependencies
  python-security:
    name: Python Dependency Security
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.1

      - name: Install uv
        uses: astral-sh/setup-uv@cdfb2ee6dde255817c739680168ad81e184c4bfb # v4.0.0

      - name: Set up Python
        run: uv python install 3.13

      - name: Install dependencies
        run: uv sync --locked --dev

      - name: Run safety check
        run: |
          # Install safety for vulnerability scanning
          uv add --dev safety
          uv run safety check --json --output safety-report.json
        continue-on-error: true

      - name: Upload safety report
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: safety-security-report
          path: safety-report.json

      - name: Security Summary
        if: always()
        run: |
          echo "## 🔒 Dependency Security Summary" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY

          if [ -f "safety-report.json" ]; then
            echo "### Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY
            echo "Detailed report uploaded as artifact." >> $GITHUB_STEP_SUMMARY
          else
            echo "### ✅ Safety Vulnerability Scan" >> $GITHUB_STEP_SUMMARY
            echo "No known vulnerabilities found in dependencies." >> $GITHUB_STEP_SUMMARY
          fi

          echo "" >> $GITHUB_STEP_SUMMARY
          echo "### Dependency Review Features" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ License compliance checking" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Vulnerability severity: moderate+" >> $GITHUB_STEP_SUMMARY
          echo "- ✅ Automatic PR comments enabled" >> $GITHUB_STEP_SUMMARY