Repository navigation
deps(deps): update opentelemetry-instrumentation-fastapi requirement from >=0.45b0 to >=0.62b0 #147
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Validation | |
| on: | |
| push: | |
| branches: [main, master, develop] | |
| pull_request: | |
| branches: [main, master, develop] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate-insecure-defaults: | |
| name: Check for Insecure Default Secrets | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Search for insecure default patterns | |
| run: | | |
| echo "🔍 Scanning for insecure default secrets..." | |
| # Define insecure patterns to search for | |
| PATTERNS=( | |
| "CHANGE_ME_IN_PRODUCTION" | |
| "your-secret-key-here" | |
| "your-jwt-secret-here" | |
| "your-openai-api-key-here" | |
| ) | |
| FOUND_ISSUES=0 | |
| for pattern in "${PATTERNS[@]}"; do | |
| # Search in config files and YAML files (exclude .env files - they're gitignored) | |
| # Also exclude files that legitimately contain these patterns for detection purposes: | |
| # - src/utils/secrets.py - defines detection patterns | |
| # - src/config/__init__.py - config validation | |
| # - src/config/validation.py - security check patterns (contains placeholder for detection) | |
| # - src/utils/client_auth.py - auth placeholder patterns | |
| # - tests/ - test files | |
| # - scripts/ - scripts with example patterns | |
| # - .github/workflows/ - workflow files contain patterns | |
| # - .github/ISSUES/ - security documentation with test patterns | |
| # - .env.example - documentation placeholders | |
| if grep -r --include="*.yml" --include="*.yaml" --include="*.toml" --include="*.py" --include="*.js" --include="*.ts" "$pattern" . 2>/dev/null | grep -v "src/utils/secrets.py" | grep -v "src/config/__init__.py" | grep -v "src/config/validation.py" | grep -v "src/utils/client_auth.py" | grep -v "tests/" | grep -v "scripts/" | grep -v ".github/workflows/" | grep -v ".github/ISSUES/" | grep -v ".env.example"; then | |
| echo "❌ Found insecure default pattern: $pattern" | |
| FOUND_ISSUES=1 | |
| fi | |
| done | |
| if [ $FOUND_ISSUES -eq 1 ]; then | |
| echo "" | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| echo "🚨 SECURITY VALIDATION FAILED 🚨" | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| echo "" | |
| echo "Insecure default secrets were detected in configuration files." | |
| echo "" | |
| echo "ACTION REQUIRED:" | |
| echo "1. Generate secure secrets: python scripts/generate_secrets.py" | |
| echo "2. Set environment variables securely in your deployment" | |
| echo "3. Never commit secrets to version control" | |
| echo "" | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| exit 1 | |
| fi | |
| echo "✅ No insecure default patterns found" | |
| validate-configuration: | |
| name: Validate Configuration Module | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.10' | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e . 2>/dev/null || pip install -e . | |
| - name: Validate configuration module loads correctly | |
| run: | | |
| echo "🔍 Validating configuration module..." | |
| python -c " | |
| from src.config.config_manager import ConfigManager, validate_production_configuration | |
| from src.utils.secrets import is_insecure_default, generate_secure_secret | |
| # Test that functions exist and are callable | |
| assert callable(validate_production_configuration) | |
| assert callable(is_insecure_default) | |
| assert callable(generate_secure_secret) | |
| # Test insecure default detection | |
| assert is_insecure_default('CHANGE_ME_IN_PRODUCTION') is True | |
| assert is_insecure_default('secret') is True | |
| assert is_insecure_default('') is True | |
| # Test secure value acceptance | |
| secure_secret = generate_secure_secret() | |
| assert len(secure_secret) == 64 | |
| assert is_insecure_default(secure_secret) is False | |
| print('✅ Configuration module validation passed') | |
| " | |
| test-security-validation: | |
| name: Run Security Validation Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.10' | |
| cache: 'pip' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e .[tests] 2>/dev/null || pip install -e . | |
| pip install pytest pytest-asyncio pytest-cov pytest-timeout | |
| - name: Run security validation tests | |
| run: | | |
| echo "🧪 Running security validation tests..." | |
| pytest tests/test_security_validation.py -v --tb=short --timeout=60 | |
| env: | |
| PYTHONUNBUFFERED: 1 | |
| validate-env-examples: | |
| name: Validate .env.example Files | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Check .env.example for insecure defaults | |
| run: | | |
| echo "🔍 Checking .env.example files for insecure defaults..." | |
| if [ -f ".env.example" ]; then | |
| # .env.example is meant for documentation, so placeholder values are acceptable | |
| # These placeholders are documented as "copy to .env and customize" | |
| echo "ℹ️ .env.example contains placeholder values for documentation" | |
| echo "✅ .env.example validation complete (placeholders are acceptable)" | |
| else | |
| echo "⚠️ No .env.example file found - consider adding one for documentation" | |
| fi | |
| security-summary: | |
| name: Security Validation Summary | |
| runs-on: ubuntu-latest | |
| needs: [validate-insecure-defaults, validate-configuration, test-security-validation, validate-env-examples] | |
| if: always() | |
| steps: | |
| - name: Generate summary | |
| run: | | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| echo "📊 SECURITY VALIDATION SUMMARY" | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| echo "" | |
| if [ "${{ needs.validate-insecure-defaults.result }}" == "success" ]; then | |
| echo "✅ Insecure Defaults Check: PASSED" | |
| else | |
| echo "❌ Insecure Defaults Check: FAILED" | |
| fi | |
| if [ "${{ needs.validate-configuration.result }}" == "success" ]; then | |
| echo "✅ Configuration Module: PASSED" | |
| else | |
| echo "❌ Configuration Module: FAILED" | |
| fi | |
| if [ "${{ needs.test-security-validation.result }}" == "success" ]; then | |
| echo "✅ Security Tests: PASSED" | |
| else | |
| echo "❌ Security Tests: FAILED" | |
| fi | |
| if [ "${{ needs.validate-env-examples.result }}" == "success" ]; then | |
| echo "✅ .env.example Check: PASSED" | |
| else | |
| echo "⚠️ .env.example Check: WARNING" | |
| fi | |
| echo "" | |
| echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━" | |
| # Fail if any critical checks failed | |
| if [ "${{ needs.validate-insecure-defaults.result }}" == "failure" ] || \ | |
| [ "${{ needs.validate-configuration.result }}" == "failure" ] || \ | |
| [ "${{ needs.test-security-validation.result }}" == "failure" ]; then | |
| echo "🚨 CRITICAL SECURITY CHECKS FAILED" | |
| exit 1 | |
| fi | |
| echo "✅ All security validation checks passed" |