OParl MCP Server

name: Security Scanning on: push: branches: [ main, dev ] pull_request: branches: [ main, dev ] schedule: - cron: '0 2 * * 1' # Weekly on Monday at 2 AM jobs: security: runs-on: ubuntu-latest permissions: security-events: write actions: read contents: read steps: - name: Checkout repository uses: actions/checkout@v6 - name: Set up Python uses: actions/setup-python@v6 with: python-version: '3.11' - name: Install dependencies run: | python -m pip install --upgrade pip pip install -r requirements.txt pip install bandit safety - name: Run Bandit security linter run: | bandit -r src/ -f json -o bandit-report.json || true bandit -r src/ -f txt - name: Run Safety dependency check run: | safety check --json --output safety-report.json || true safety check - name: Run Trivy filesystem scan uses: aquasecurity/trivy-action@master with: scan-type: 'fs' scan-ref: '.' format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: 'trivy-results.sarif' - name: Upload security reports uses: actions/upload-artifact@v4 if: always() with: name: security-reports path: | bandit-report.json safety-report.json trivy-results.sarif