LoopifyBot/.github/workflows/security.yml at main · Isma-L154/LoopifyBot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
name: Security

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gitleaks:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read # gitleaks-action lists the pull request's commits
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITLEAKS_ENABLE_COMMENTS: false

  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
      - run: uvx semgrep@1.178.0 scan --config p/default --metrics=off --error .

  # pip-audit rather than osv-scanner: there is no lockfile, and osv-scanner
  # guesses transitive versions from requirements.txt (it reported idna 3.9.0
  # and Pygments 2.9.0, which nothing installs). pip-audit resolves the files
  # the way `pip install` does and audits what would really be installed.
  pip-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.14"
      - run: pip install pip-audit==2.10.1
      # The two ignored IDs are PyNaCl 1.5.0's libsodium ed25519 issue, which
      # voice never reaches; discord.py 2.7.1 caps PyNaCl below the fix. See
      # requirements.txt, and drop these once that cap is lifted.
      - run: >-
          pip-audit -r requirements.txt -r requirements-dev.txt --progress-spinner off
          --ignore-vuln PYSEC-2026-1448 --ignore-vuln PYSEC-2026-3002

  zizmor:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
        with:
          advanced-security: false