release: freeze V2 release candidate
Security Quality Gate / npm audit, Bandit, pip-audit, detect-secrets (pull_request) Failing after 16m35s
Security Quality Gate / npm audit, Bandit, pip-audit, detect-secrets (pull_request) Failing after 16m35s
This commit is contained in:
@@ -0,0 +1,94 @@
|
||||
name: Release Quality Gate
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
web_base_url:
|
||||
description: "V2 web base URL"
|
||||
required: false
|
||||
default: "http://192.168.3.90:13000"
|
||||
contract_api_base:
|
||||
description: "Contract API base URL"
|
||||
required: false
|
||||
default: "http://192.168.3.90:18100"
|
||||
ai_api_base:
|
||||
description: "AI Platform API base URL"
|
||||
required: false
|
||||
default: "http://192.168.3.90:18101"
|
||||
smoke_summary:
|
||||
description: "Optional Docker smoke summary JSON path in the checked-out workspace"
|
||||
required: false
|
||||
default: ""
|
||||
benchmark_summary:
|
||||
description: "Optional interface benchmark summary JSON path in the checked-out workspace"
|
||||
required: false
|
||||
default: ""
|
||||
run_benchmark:
|
||||
description: "Run interface benchmark before validating the release gate"
|
||||
required: false
|
||||
default: "false"
|
||||
type: choice
|
||||
options:
|
||||
- "false"
|
||||
- "true"
|
||||
max_smoke_summary_age_hours:
|
||||
description: "Fail if Docker smoke summary is older than this many hours; 0 disables the age check"
|
||||
required: false
|
||||
default: "0"
|
||||
max_benchmark_summary_age_hours:
|
||||
description: "Fail if interface benchmark summary is older than this many hours; 0 disables the age check"
|
||||
required: false
|
||||
default: "0"
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
release-quality-gate:
|
||||
name: schema-check, Docker smoke summary, interface benchmark
|
||||
runs-on: [self-hosted, yuqei-smoke]
|
||||
timeout-minutes: 30
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
# The release gate can validate local QA artifacts generated by smoke deploys
|
||||
# on the self-hosted smoke runner. Keep ignored project-docs/qa-artifacts files.
|
||||
clean: false
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.12"
|
||||
|
||||
- name: Run release quality gate
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
args=(
|
||||
--web-base-url "${{ inputs.web_base_url }}"
|
||||
--contract-api-base "${{ inputs.contract_api_base }}"
|
||||
--ai-api-base "${{ inputs.ai_api_base }}"
|
||||
--artifact-dir "release-quality-gate-artifacts"
|
||||
--max-smoke-summary-age-hours "${{ inputs.max_smoke_summary_age_hours }}"
|
||||
--max-benchmark-summary-age-hours "${{ inputs.max_benchmark_summary_age_hours }}"
|
||||
)
|
||||
if [ -n "${{ inputs.smoke_summary }}" ]; then
|
||||
args+=(--smoke-summary "${{ inputs.smoke_summary }}")
|
||||
fi
|
||||
if [ -n "${{ inputs.benchmark_summary }}" ]; then
|
||||
args+=(--benchmark-summary "${{ inputs.benchmark_summary }}")
|
||||
fi
|
||||
if [ "${{ inputs.run_benchmark }}" = "true" ]; then
|
||||
args+=(--run-benchmark)
|
||||
fi
|
||||
python yuqei-infra/scripts/run-release-quality-gate.py "${args[@]}"
|
||||
|
||||
- name: Upload release quality gate artifacts
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: release-quality-gate
|
||||
path: release-quality-gate-artifacts/
|
||||
if-no-files-found: warn
|
||||
@@ -0,0 +1,123 @@
|
||||
name: Security Quality Gate
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- master
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
security:
|
||||
name: npm audit, Bandit, pip-audit, detect-secrets
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 20
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Node.js
|
||||
uses: actions/setup-node@v4
|
||||
with:
|
||||
node-version: "22"
|
||||
cache: npm
|
||||
|
||||
- name: Install npm workspace dependencies
|
||||
run: |
|
||||
npm install -g npm@10.9.7
|
||||
npm ci
|
||||
|
||||
- name: npm production dependency audit
|
||||
id: npm_audit
|
||||
continue-on-error: true
|
||||
run: |
|
||||
mkdir -p security-artifacts
|
||||
npm audit --omit=dev --audit-level=high --json > security-artifacts/npm-audit.json
|
||||
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.12"
|
||||
cache: pip
|
||||
|
||||
- name: Build project dependency environment
|
||||
run: |
|
||||
python -m venv .venv-project
|
||||
.venv-project/bin/python -m pip install --upgrade pip
|
||||
.venv-project/bin/python -m pip install \
|
||||
-e yuqei-contract-platform/services/contract-api \
|
||||
-e yuqei-ai-platform/services/ai-platform-api \
|
||||
-e yuqei-ai-platform/services/worker \
|
||||
-e yuqei-ai-sdk-python
|
||||
|
||||
- name: Install security audit tools
|
||||
run: |
|
||||
python -m venv .venv-audit
|
||||
.venv-audit/bin/python -m pip install --upgrade pip
|
||||
.venv-audit/bin/python -m pip install bandit==1.9.4 pip-audit==2.10.1 detect-secrets==1.5.0
|
||||
|
||||
- name: Bandit Python source scan
|
||||
id: bandit
|
||||
continue-on-error: true
|
||||
run: |
|
||||
mkdir -p security-artifacts
|
||||
.venv-audit/bin/bandit \
|
||||
-r yuqei-contract-platform/services/contract-api/src \
|
||||
yuqei-ai-platform/services/ai-platform-api/src \
|
||||
yuqei-ai-platform/services/worker/src \
|
||||
yuqei-ai-sdk-python/src \
|
||||
-f json \
|
||||
-o security-artifacts/bandit-project.json
|
||||
|
||||
- name: Python project dependency audit
|
||||
id: pip_audit
|
||||
continue-on-error: true
|
||||
run: |
|
||||
mkdir -p security-artifacts
|
||||
.venv-audit/bin/pip-audit \
|
||||
--path .venv-project/lib/python3.12/site-packages \
|
||||
-f json \
|
||||
-o security-artifacts/pip-audit-project.json \
|
||||
--progress-spinner off
|
||||
|
||||
- name: Tracked source secret scan
|
||||
id: source_secret_scan
|
||||
continue-on-error: true
|
||||
run: |
|
||||
mkdir -p security-artifacts/source-secret-scan
|
||||
.venv-audit/bin/python yuqei-infra/scripts/run-source-secret-scan.py \
|
||||
--artifact-dir security-artifacts/source-secret-scan
|
||||
|
||||
- name: Enforce security quality gate
|
||||
run: |
|
||||
failed=0
|
||||
if [ "${{ steps.npm_audit.outcome }}" != "success" ]; then
|
||||
echo "::error::npm audit found high-or-above vulnerabilities or failed to run"
|
||||
failed=1
|
||||
fi
|
||||
if [ "${{ steps.bandit.outcome }}" != "success" ]; then
|
||||
echo "::error::Bandit found Python security findings or failed to run"
|
||||
failed=1
|
||||
fi
|
||||
if [ "${{ steps.pip_audit.outcome }}" != "success" ]; then
|
||||
echo "::error::pip-audit found vulnerable Python dependencies or failed to run"
|
||||
failed=1
|
||||
fi
|
||||
if [ "${{ steps.source_secret_scan.outcome }}" != "success" ]; then
|
||||
echo "::error::detect-secrets found an unreviewed source secret or failed to run"
|
||||
failed=1
|
||||
fi
|
||||
exit "$failed"
|
||||
|
||||
- name: Upload security scan artifacts
|
||||
if: always()
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: security-quality-gate
|
||||
path: security-artifacts/
|
||||
if-no-files-found: warn
|
||||
Reference in New Issue
Block a user