Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix vulnerability check scanning packages not used by the project #105

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Fix vulnerability check scanning packages not used by the project #105

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1a1883b
Fix vulnerability check scanning packages not used by the project
davitmamrikishvili Dec 20, 2024
52414c0
Change branch to vulnerability-scan-fix for testing purposes
davitmamrikishvili Dec 20, 2024
917e606
Return branch name to main
davitmamrikishvili Dec 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions .github/workflows/python-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,11 +40,8 @@ jobs:
version: ${{ inputs.poetry-version }}
virtualenvs-create: false

- name: Install modules
run: |
pip install virtualenv
python -m venv venv
source venv/bin/activate
- name: Store packages in a file
run: pip freeze > before.txt

- name: Generate requirements.txt from Poetry
if: steps.check-poetry-file.outputs.files_exists == 'true'
Expand All @@ -53,9 +50,15 @@ jobs:
- name: Install requirements
run: pip install -r requirements.txt

- name: Store requirements in other file
run: pip freeze --local > file_to_check.txt

- name: Store updated list of packages in another file
run: pip freeze > after.txt

- name: Get only the project dependencies
run: diff before.txt after.txt | grep '^>' | sed 's/^> //' > diff.txt

- name: Output the list of packages to be checked
run: cat diff.txt

- name: Download safety-policy
run: |
wget -q -O .safety-policy.yaml https://raw.githubusercontent.com/th2-net/.github/main/vulnerability-compliance/python-safety-check/.safety-policy.yaml
Expand All @@ -64,4 +67,4 @@ jobs:
run: pip install --upgrade pip && pip install safety

- name: Run Vulnerability check
run: safety check -r file_to_check.txt ${{ inputs.safety-args }} --policy-file .safety-policy.yaml
run: safety check -r diff.txt ${{ inputs.safety-args }} --policy-file .safety-policy.yaml