chore: Enhance DevSecOps pipeline

.github/workflows/devsecops-pipeline.yml

@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+
   pull_request:
     branches:
       - main
@@ -12,19 +13,59 @@ jobs:
   security-checks:
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: read
+      security-events: write
+
     steps:
-    - name: Checkout Code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      - name: Checkout Code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Set up Python
+        uses: actions/setup-python@28f2168f4d98ee0445e3c6321f6e6616c83dd5ec
+        with:
+          python-version: '3.13'
+
+      - name: Install Dependencies
+        run: |
+          pip install --require-hashes --only-binary :all: -r requirements.txt
+
+      # -------------------------
+      # Bandit (Python SAST)
+      # -------------------------
+      - name: Run Bandit
+        run: |
+          bandit -r .
 
-    - name: Set up Python
-      uses: actions/setup-python@v6
-      with:
-        python-version: '3.x'
+      # -------------------------
+      # pip-audit (Dependency Audit)
+      # -------------------------
+      - name: Run pip-audit
+        run: |
+          pip-audit
 
-    - name: Install Dependencies
-      run: |
-        python -m pip install pip==26.1.1
-        pip install --require-hashes --only-binary :all: -r requirements.txt
+      # -------------------------
+      # Ruff (Modern Linting)
+      # -------------------------
+      - name: Run Ruff
+        run: |
+          ruff check .
 
-    - name: Run DevSecOps Pipeline
-      run: python devsecops_pipeline.py
+      # -------------------------
+      # Trivy IaC Scan
+      # -------------------------
+      - name: Run Trivy IaC Scan
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
+        with:
+          scan-type: 'config'
+          scan-ref: '.'
+
+      # -------------------------
+      # TruffleHog Secret Scan
+      # -------------------------
+      - name: TruffleHog Secret Scan
+        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab
+        with:
+          path: ./
+          base: main
+          head: HEAD

devsecops_pipeline.py

@@ -1,64 +1,34 @@
-import os
 import subprocess
 import sys
 
-# Helper function to run shell commands
-def run_command(command, cwd=None):
-    result = subprocess.run(command, shell=True, cwd=cwd, text=True, capture_output=True)
+def run_command(command):
+    result = subprocess.run(
+        command,
+        shell=True,
+        text=True,
+        capture_output=True
+    )
+
     if result.returncode != 0:
-        print(f"Error: Command '{command}' failed with exit code {result.returncode}")
+        print(f"FAILED: {command}")
         print(result.stdout)
         print(result.stderr)
         sys.exit(result.returncode)
-    return result.stdout
-
-# Static Code Analysis (using Bandit)
-def run_bandit(path):
-    print("Running Bandit for static code analysis...")
-    run_command(f"bandit -r {path}")
-
-# Dependency Checking (using Safety)
-def run_safety():
-    print("Running Safety for dependency checking...")
-    run_command("safety check --full-report")
 
-# Secret Scanning (using TruffleHog)
-def run_trufflehog(path):
-    print("Running TruffleHog for secret scanning...")
-    run_command(f"trufflehog {path}")
+    print(result.stdout)
 
-# Infrastructure as Code Scanning (using Terraform and Snyk)
-def run_terraform_scan(path):
-    print("Running Snyk for Terraform IaC scanning...")
-    run_command(f"snyk iac test {path}")
-
-# Code Coverage and Linting (using Pylint)
-def run_pylint(path):
-    print("Running Pylint for code linting...")
-    run_command(f"pylint {path}")
-
-# Main function to orchestrate the DevSecOps pipeline
 def main():
-    project_path = os.getcwd()
+    print("Running Bandit...")
+    run_command("bandit -r .")
+
+    print("Running pip-audit...")
+    run_command("pip-audit")
 
-    # Static Analysis
-    run_bandit(project_path)
-
-    # Dependency Checking
-    run_safety()
-
-    # Secret Scanning
-    run_trufflehog(project_path)
-
-    # Terraform IaC Scanning
-    terraform_path = os.path.join(project_path, 'terraform')
-    if os.path.exists(terraform_path):
-        run_terraform_scan(terraform_path)
-
-    # Linting
-    run_pylint(project_path)
+    print("Running Ruff...")
+    run_command("ruff check .")
 
     print("DevSecOps pipeline completed successfully!")
 
 if __name__ == "__main__":
     main()
+

requirements.in

@@ -1,4 +1,6 @@
 bandit
+ruff
+pip-audit
 safety
-trufflehog
-pylint
+trufflehog3
+pylint