GovOPlaN/govoplan
1
0
Fork 0
Code Issues 10 Pull Requests Actions 3 Packages Projects Releases Wiki Activity

Harden security audit result contracts

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-21 12:29:53 +02:00
parent a15a74c54c
commit 676030b993
5 changed files with 699 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
tools/checks/security-audit/Dockerfile
View File

@@ -31,19 +31,24 @@ RUN apt-get update \
COPY --from=go-tools /go/bin/gitleaks /usr/local/bin/gitleaks
COPY --from=go-tools /go/bin/osv-scanner /usr/local/bin/osv-scanner
COPY requirements-audit.txt /tmp/requirements-audit.txt
COPY tools/checks/security-audit/semgrep-govoplan.yml /tmp/semgrep-govoplan.yml
COPY tools/checks/check-version-alignment.py /tmp/semgrep-smoke.py
RUN python -m pip install --upgrade pip \
&& python -m pip install --no-cache-dir -r /tmp/requirements-audit.txt \
&& python -m pip install --no-cache-dir "semgrep>=1.140,<2" \
&& python -m pip install --no-cache-dir --upgrade --no-deps "click>=8.3.3" \
&& python -m pip install --no-cache-dir --upgrade --no-deps "click==8.3.3" \
&& python -m pip install --no-cache-dir --upgrade --no-deps "mcp==1.28.1" \
&& npm install -g jscpd \
&& semgrep --version \
&& semgrep scan --metrics=off --config /tmp/semgrep-govoplan.yml /tmp/semgrep-smoke.py \
&& bandit --version \
&& ruff --version \
&& gitleaks version \
&& osv-scanner --version \
&& trivy --version \
&& jscpd --version
&& jscpd --version \
&& pip-audit --progress-spinner off
RUN mkdir -p /workspace \
&& chmod 0777 /workspace