Skip to content

Bump the pip-others group across 1 directory with 3 updates (#4125) #890

Bump the pip-others group across 1 directory with 3 updates (#4125)

Bump the pip-others group across 1 directory with 3 updates (#4125) #890

Workflow file for this run

name: Code Scanning
on:
workflow_dispatch: # run on request (no need for PR)
push:
branches:
- "develop"
- "releases/*"
schedule:
# every UTC 6PM from Mon to Fri
- cron: "0 18 * * 1-5"
# Declare default permissions as read only.
permissions: read-all
jobs:
Trivy-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
with:
python-version: "3.10"
- name: Install dependencies
run: python -m pip install --require-hashes --no-deps -r .ci/requirements.txt
- name: Freeze dependencies
run: pip-compile --extra=docs,base,mmlab,anomaly -o requirements.txt pyproject.toml
- name: Trivy Scanning (spdx.json)
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
with:
trivy-config: ".ci/trivy-json.yaml"
scan-type: "fs"
scan-ref: .
- name: Trivy Scanning
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
with:
trivy-config: ".ci/trivy.yaml"
scan-type: "fs"
scan-ref: .
- name: Upload Trivy results artifact
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: trivy-results
path: "${{ github.workspace }}/trivy-results.*"
# Use always() to always run this step to publish scan results when there are test failures
if: ${{ always() }}
Bandit:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python
uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
with:
python-version: "3.10"
- name: Install tox
run: |
python -m pip install --require-hashes --no-deps -r .ci/requirements.txt
pip-compile --generate-hashes --output-file=/tmp/requirements.txt --extra=ci_tox pyproject.toml
python -m pip install --require-hashes --no-deps -r /tmp/requirements.txt
rm /tmp/requirements.txt
- name: Bandit Scanning
run: tox -e bandit-scan
- name: Upload Bandit artifact
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: bandit-report
path: .tox/bandit-report.txt
# Use always() to always run this step to publish scan results when there are test failures
if: ${{ always() }}