Skip to content

Set TabularTransform to process clean transform in parallel (#1648) #734

Set TabularTransform to process clean transform in parallel (#1648)

Set TabularTransform to process clean transform in parallel (#1648) #734

Workflow file for this run

name: Code Scanning
on:
workflow_dispatch: # run on request (no need for PR)
push:
branches: [ "develop", "releases/*" ]
schedule:
# every UTC 6PM from Mon to Fri
- cron: "0 18 * * 1-5"
jobs:
Trivy:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Install dependencies
run: python -m pip install pip-tools
- name: Freeze dependencies
run: |
mkdir -p .ci/base
pip-compile -o .ci/base/requirements.txt requirements.txt
mkdir -p .ci/dev/tests
pip-compile -o .ci/dev/tests/requirements.txt tests/requirements.txt
mkdir -p .ci/dev/docker/segment-anything/
pip-compile -o .ci/dev/docker/segment-anything/requirements.txt docker/segment-anything/requirements.txt
mkdir -p .ci/base/docs
pip-compile -o .ci/base/docs/requirements.txt docs/requirements.txt
- name: Run Trivy Scan (full, csv)
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
with:
trivy-config: ".ci/trivy-csv.yaml"
scan-type: 'fs'
scan-ref: ".ci/"
scanners: vuln,secret
- name: Run Trivy Scan (prod, spdx.json)
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
with:
trivy-config: ".ci/trivy-json.yaml"
scan-type: 'fs'
scan-ref: ".ci/base"
- name: Upload Trivy results
uses: actions/upload-artifact@v4
with:
name: trivy-results-prod-json
path: '${{ github.workspace }}/trivy-results-*'
Bandit:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Install dependencies
run: python -m pip install tox
- name: Bandit Scanning
run: tox -e bandit-scan
- name: Upload Bandit artifact
uses: actions/upload-artifact@v4
with:
name: bandit-report
path: .tox/bandit-report.txt
# Use always() to always run this step to publish scan results when there are test failures
if: ${{ always() }}
call-notify-to-teams:
needs: [Trivy, Bandit]
if: |
always() &&
contains(needs.*.result, 'failure')
uses: ./.github/workflows/notify_teams.yml
secrets: inherit