ci: pin actions to commit SHAs, guard Docker jobs from forks, scan the image, gate publish on security (SEC-06, SEC-07, SEC-14, SEC-15, SEC-16)

2026-10-14 17:40:16 +02:00
1 parent 6f7a3c0e5b
commit 766968fa42
@@ -0,0 +1,68 @@
+name: scan
+
+# Weekly vulnerability check that does not depend on a push. The base image digests
+# in docker/Dockerfile are pinned and refreshed by hand, so a new fixable HIGH or
+# CRITICAL advisory in the pinned image, or a new advisory in the locked
+# dependencies, turns this run red: the reminder to refresh the digests (see the
+# comment at the top of docker/Dockerfile) or bump the dependency.
+#
+# Same rules as ci.yml: third-party actions pinned to a commit SHA, resources named
+# per run and removed by name, no pruning.
+
+on:
+  schedule:
+    - cron: '17 5 * * 1'
+  workflow_dispatch:
+
+env:
+  UV_PYTHON_DOWNLOADS: never
+  UV_NO_PROGRESS: "1"
+
+jobs:
+  image-scan:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    env:
+      SCAN_IMAGE: aegis-ci-${{ github.run_id }}-scan:test
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Build image
+        run: docker build -f docker/Dockerfile -t "${SCAN_IMAGE}" .
+      - name: Install Trivy
+        shell: bash
+        run: |
+          bin_dir="${RUNNER_TEMP:-/tmp}/trivy-bin"
+          bash scripts/ci/install_trivy.sh "${bin_dir}"
+          echo "${bin_dir}" >> "$GITHUB_PATH"
+      - name: Scan image
+        shell: bash
+        run: bash scripts/ci/scan_image.sh "${SCAN_IMAGE}"
+      - name: Cleanup
+        if: always()
+        shell: bash
+        run: bash scripts/ci/cleanup_job_resources.sh "${SCAN_IMAGE}"
+
+  dependency-audit:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.12"
+      - name: Set up uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+        with:
+          version: "0.12.5"
+          enable-cache: false
+      - name: Install dependencies
+        run: uv sync --locked
+      - name: Dependency audit
+        run: bash scripts/ci/pip_audit.sh