GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Cover live worktrees in security audits

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 03:16:57 +02:00
parent 295b49bb04
commit 0b1506f860
1 changed files with 22 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
tools/checks/check-security-audit.sh
View File

@@ -180,13 +180,17 @@ run_semgrep() {
fi fi
semgrep scan \ semgrep scan \
--metrics=off \ --metrics=off \
--no-git-ignore \
--sarif \ --sarif \
--output "$report" \ --output "$report" \
--exclude .git \
--exclude node_modules \ --exclude node_modules \
--exclude .venv \ --exclude .venv \
--exclude dist \ --exclude dist \
--exclude build \ --exclude build \
--exclude runtime \ --exclude runtime \
--exclude audit-reports \
--exclude '**/.*-test-build/**' \
"${config_args[@]}" \ "${config_args[@]}" \
"${REPOS[@]}" "${REPOS[@]}"
} }
@@ -222,7 +226,16 @@ run_gitleaks() {
gitleaks git \ gitleaks git \
--config "$ROOT/.gitleaks.toml" \ --config "$ROOT/.gitleaks.toml" \
--report-format json \ --report-format json \
--report-path "$REPORTS_DIR/gitleaks-$name.json" \ --report-path "$REPORTS_DIR/gitleaks-history-$name.json" \
--no-banner \
"$repo" || status=1
# History scanning does not include new or modified working-tree files.
# Scan the directory as well so pre-commit audits cover the exact code
# under review, while retaining the history scan above.
gitleaks dir \
--config "$ROOT/.gitleaks.toml" \
--report-format json \
--report-path "$REPORTS_DIR/gitleaks-worktree-$name.json" \
--no-banner \ --no-banner \
"$repo" || status=1 "$repo" || status=1
else else
@@ -261,7 +274,9 @@ run_pip_audit_manifests() {
[[ -f "$repo/requirements.txt" ]] || continue [[ -f "$repo/requirements.txt" ]] || continue
local name local name
name="$(safe_name "$repo")" name="$(safe_name "$repo")"
pip-audit -r "$repo/requirements.txt" --progress-spinner off --format json --output "$REPORTS_DIR/pip-audit-$name.json" || status=1 # Requirements may contain project-relative entries such as `.[server]`.
# Resolve them from the owning repository instead of the meta-repository.
(cd "$repo" && pip-audit -r requirements.txt --progress-spinner off --format json --output "$REPORTS_DIR/pip-audit-$name.json") || status=1
done done
return "$status" return "$status"
} }
@@ -283,7 +298,11 @@ run_osv_scanner() {
local name local name
name="$(safe_name "$repo")" name="$(safe_name "$repo")"
if osv-scanner scan --help >/dev/null 2>&1; then if osv-scanner scan --help >/dev/null 2>&1; then
osv-scanner scan -r --format json --output "$REPORTS_DIR/osv-scanner-$name.json" "$repo" || status=1 osv-scanner scan -r \
--allow-no-lockfiles \
--format json \
--output-file "$REPORTS_DIR/osv-scanner-$name.json" \
"$repo" || status=1
else else
osv-scanner -r --format json --output "$REPORTS_DIR/osv-scanner-$name.json" "$repo" || status=1 osv-scanner -r --format json --output "$REPORTS_DIR/osv-scanner-$name.json" "$repo" || status=1
fi fi