Skip to content

test(ci): align release governance tests with central Security Scan (#926) #1025

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
seonghobae wants to merge 1 commit into from
Closed

test(ci): align release governance tests with central Security Scan (#926) #1025

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 9 additions & 10 deletions backend/tests/test_release_governance.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,11 +224,14 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None:
harden_runner_ref = (
"step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4"
)
# dependency-review.yml was intentionally removed in #926: the org-wide
# central Security Scan already runs dependency-review on every PR, so the
# per-repo PR-only workflow was a duplicate. Only workflows that still exist
# in this repository are asserted here.
hardened_workflows = [
".github/workflows/app-ci.yml",
".github/workflows/bandit.yml",
".github/workflows/codeql.yml",
".github/workflows/dependency-review.yml",
".github/workflows/docker-publish.yml",
".github/workflows/mail-smoke.yml",
".github/workflows/pr-governance.yml",
Expand All @@ -241,14 +244,6 @@ def test_stepsecurity_remediation_adds_pinned_audit_hardening() -> None:
assert harden_runner_ref in workflow
assert "egress-policy: audit" in workflow

dependency_review_workflow = read_repo_text(
".github/workflows/dependency-review.yml"
)
assert (
"actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0"
in dependency_review_workflow
)

pre_commit = read_repo_text(".pre-commit-config.yaml")
assert "https://github.com/gitleaks/gitleaks" in pre_commit
assert "rev: v8.16.3" in pre_commit
Expand Down Expand Up @@ -355,8 +350,12 @@ def test_required_code_scanning_workflows_upload_scorecard_and_trivy_sarif() ->
scorecard_workflow = read_repo_text(".github/workflows/scorecard.yml")
trivy_workflow = read_repo_text(".github/workflows/trivy.yml")

# PR-triggered scorecard/trivy runs were removed in #926 because the org-wide
# central Security Scan already runs scorecard and trivy-fs on every PR. These
# per-repo workflows now cover the default branch only (push/schedule), so the
# PR trigger is intentionally absent and must NOT be asserted here.
for workflow in (scorecard_workflow, trivy_workflow):
assert "pull_request:" in workflow
assert "pull_request:" not in workflow
assert "push:" in workflow
assert "- develop" in workflow
assert "- master" in workflow
Expand Down
Loading