name: "CodeQL Security Analysis"
on:
push:
branches: [ "main", "develop" ]
pull_request:
branches: [ "main" ]
schedule:
# Run CodeQL analysis weekly on Sundays at 2 AM UTC
- cron: '0 2 * * 0'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
timeout-minutes: 360
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'python' ]
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
# Override default queries to include security-extended pack
queries: security-extended,security-and-quality
config: |
name: "Moondream MCP CodeQL Config"
queries:
- uses: security-extended
- uses: security-and-quality
paths-ignore:
- "tests/**"
- "examples/**"
- "docs/**"
- "scripts/**"
- ".github/**"
- "*.md"
- name: Autobuild
uses: github/codeql-action/autobuild@v3
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
with:
category: "/language:${{matrix.language}}"
upload: true
security-scan:
name: Additional Security Scans
runs-on: ubuntu-latest
needs: analyze
if: github.event_name == 'push' || github.event_name == 'schedule'
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
- name: Install security tools
run: |
python -m pip install --upgrade pip
pip install bandit[toml] safety semgrep
- name: Run Bandit security linter
run: |
bandit -r src/ -f json -o bandit-report.json || true
bandit -r src/ -f txt
- name: Run Safety check for known vulnerabilities
run: |
safety check --json --output safety-report.json || true
safety check
- name: Run Semgrep security analysis
run: |
semgrep --config=auto src/ --json --output=semgrep-report.json || true
semgrep --config=auto src/
- name: Upload security reports
uses: actions/upload-artifact@v4
if: always()
with:
name: security-reports
path: |
bandit-report.json
safety-report.json
semgrep-report.json
retention-days: 30
dependency-review:
name: Dependency Review
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Dependency Review
uses: actions/dependency-review-action@v4
with:
fail-on-severity: moderate
allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC
