Skip to content

Commit 5ec4f88

Browse files
author
ChengyuZhu6
committed
CI: Add Bandit security check to lint workflow
- Integrate Bandit to scan for security issues in the codebase. - Configure Bandit to fail the workflow if any high-severity issues are found. e.g.: ```bash >> Issue: [B605:start_process_with_a_shell] Starting a process with a shell, possible injection detected, security issue. Severity: High Confidence: High CWE: CWE-78 (https://cwe.mitre.org/data/definitions/78.html) More Info: https://bandit.readthedocs.io/en/1.7.9/plugins/b605_start_process_with_a_shell.html Location: ./binaries/build.py:52:30 51 if not args.dry_run: 52 build_exit_code = os.system(cur_wheel_cmd) 53 # If any one of the steps fail, exit with error ``` Fixes: #3311 Signed-off-by: ChengyuZhu6 <[email protected]>
1 parent e212294 commit 5ec4f88

File tree

1 file changed

+19
-0
lines changed

1 file changed

+19
-0
lines changed

.github/workflows/lint.yml

+19
Original file line numberDiff line numberDiff line change
@@ -109,3 +109,22 @@ jobs:
109109
run: |
110110
echo "Please fix the misspellings. If you are sure about some of them, "
111111
echo "so append those to ts_scripts/spellcheck_conf/wordlist.txt"
112+
113+
security-check:
114+
runs-on: ubuntu-20.04
115+
steps:
116+
- name: Setup Python 3.9
117+
uses: actions/setup-python@v5
118+
with:
119+
python-version: 3.9
120+
architecture: x64
121+
- name: Checkout TorchServe
122+
uses: actions/checkout@v3
123+
- name: Install Bandit
124+
run: |
125+
python -m pip install --upgrade pip
126+
pip install bandit
127+
- name: Run bandit
128+
run: |
129+
# Skip the B501 rule related to SSL certificate validation checks
130+
bandit -r . --severity-level high -s B501

0 commit comments

Comments
 (0)