Resolve "2 automate video downloading" #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security and Code Quality | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| codeql-analysis: | |
| name: CodeQL SAST Analysis | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 # Add this line | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'python' ] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| # Optional: specify additional queries | |
| queries: security-extended,security-and-quality | |
| - name: Setup Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.x' | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| if [ -f setup.py ]; then pip install -e .; fi | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{matrix.language}}" | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| # Fail on critical vulnerabilities | |
| fail-on-severity: critical | |
| # Comment on PRs with findings | |
| comment-summary-in-pr: true | |
| basic-quality-checks: | |
| name: Basic Code Quality | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.x' | |
| - name: Check Python syntax | |
| run: | | |
| python -m py_compile $(find . -name "*.py" -not -path "./.git/*") | |
| - name: Check for common security issues | |
| run: | | |
| # Check for hardcoded secrets (basic patterns) | |
| echo "Checking for potential hardcoded secrets..." | |
| if grep -r -i -E "(password|pwd|secret|key|token|api_key)\s*=\s*['\"][^'\"]{8,}" --include="*.py" . ; then | |
| echo "⚠️ Potential hardcoded secrets found!" | |
| exit 1 | |
| fi | |
| # Check for SQL injection patterns | |
| echo "Checking for potential SQL injection patterns..." | |
| if grep -r -E "(execute|query|cursor)\s*\(\s*['\"].*%.*['\"]" --include="*.py" . ; then | |
| echo "⚠️ Potential SQL injection patterns found!" | |
| exit 1 | |
| fi | |
| # Check for eval/exec usage | |
| echo "Checking for dangerous eval/exec usage..." | |
| if grep -r -E "(^|[^a-zA-Z])(eval|exec)\s*\(" --include="*.py" . ; then | |
| echo "⚠️ Dangerous eval/exec usage found!" | |
| exit 1 | |
| fi | |
| echo "✅ Basic security checks passed" | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [codeql-analysis, dependency-review, basic-quality-checks] | |
| if: always() | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - name: Security Scan Summary | |
| run: | | |
| echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "- **CodeQL Analysis**: ${{ needs.codeql-analysis.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Dependency Review**: ${{ needs.dependency-review.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "- **Basic Quality Checks**: ${{ needs.basic-quality-checks.result }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "Check the Security tab for detailed CodeQL findings." >> $GITHUB_STEP_SUMMARY |