Skip to content

ci: add OSV-Scanner, license compliance, and semantic PR title guards #437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
carlitotate12160-tech merged 2 commits into from
Aug 17, 2026
Merged

ci: add OSV-Scanner, license compliance, and semantic PR title guards #437

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
acc65bb
ci: add OSV-Scanner, license compliance, and semantic PR title guards…
carlitotate12160-tech Aug 17, 2026
fab6013
ci: refine license audit ignore-packages and pull_request trigger on …
carlitotate12160-tech Aug 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 41 additions & 0 deletions .github/workflows/license-compliance.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,41 @@
name: License & Dependency Compliance

on:
push:
branches: [main]
pull_request:
branches: [main]
workflow_dispatch:

permissions:
contents: read

jobs:
license-check:
name: License Compliance Audit
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'

- name: Install dependencies + pip-licenses
run: |
python -m pip install --upgrade pip
pip install -e .
pip install pip-licenses
Comment on lines +34 to +37

@qodo-code-review qodo-code-review Bot Aug 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

3. License audit will drift 🐞 Bug ☼ Reliability

license-compliance installs dependencies on an ephemeral runner via pip install -e ., but most
dependencies in pyproject.toml are unpinned, so license results can change over time without code
changes and can unexpectedly start failing when upstream releases/metadata change.
Agent Prompt 
## Issue description
The license audit workflow resolves dependencies at runtime on a fresh runner (`pip install -e .`). Because the project dependencies are mostly unpinned, the installed dependency graph can change between runs, making compliance results non-reproducible and prone to unexpected failures.

## Issue Context
`pyproject.toml` declares many dependencies without fixed versions, so `pip` will select whatever is current at install time.

## Fix (recommended)
- Introduce and commit a reproducible lock/constraints file for CI compliance checks (e.g., `requirements.lock` generated from `pyproject.toml`), then install from that in the workflow before running `pip-licenses`.
- Alternatively, if `requirements.txt` is intended to be authoritative, expand it to fully capture the dependency set and install from it in the workflow.

## Fix Focus Areas
- .github/workflows/license-compliance.yml[33-41]
- pyproject.toml[5-37]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


- name: Verify Allowed Open-Source Licenses
run: |
pip-licenses --allow-only="MIT License;Apache Software License;Apache 2.0;BSD License;BSD-2-Clause;BSD-3-Clause;ISC License (ISCL);Python Software Foundation License;The Unlicense (Unlicense);CC0 1.0 Universal (CC0 1.0) Public Domain Dedication;Mozilla Public License 2.0 (MPL 2.0)" --format=markdown
36 changes: 36 additions & 0 deletions .github/workflows/osv-scanner.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
name: Supply Chain Security (OSV-Scanner)

on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: '0 3 * * 1' # Weekly on Monday at 03:00 UTC
workflow_dispatch:

permissions:
contents: read

jobs:
osv-scan:
name: OSV-Scanner
runs-on: ubuntu-latest
steps:
- name: Harden Runner
uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
with:
egress-policy: audit

- name: Checkout
uses: actions/checkout@v4
with:
persist-credentials: false

- name: Run OSV-Scanner
uses: google/osv-scanner-action/osv-scanner-action@v1.9.2
Comment on lines +30 to +31

@sourcery-ai sourcery-ai Bot Aug 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): OSV scanner action reference looks incorrect and may not resolve to the intended action.

GitHub Actions should be referenced as owner/repo@version. For OSV Scanner, the correct identifier is google/osv-scanner-action@v1.9.2. The extra /osv-scanner-action segment will prevent the workflow from running because GitHub will look for a nested repository that doesn’t exist. Please update the uses value accordingly.

@aikido-pr-checks aikido-pr-checks Bot Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3rd party Github Actions should be pinned - high severity
A third-party GitHub Action was imported, and is not pinned via a hash. This leaves your CI/CD at risk for potential supply chain attacks, if the affected GitHub Action is compromised.

Suggested change
uses: google/osv-scanner-action/osv-scanner-action@v1.9.2
uses: google/osv-scanner-action/osv-scanner-action@764c91816374ff2d8fc2095dab36eecd42d61638 # v1.9.2

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

with:
scan-args: |-
--lockfile=pyproject.toml
--recursive
.
Comment on lines +33 to +36

@qodo-code-review qodo-code-review Bot Aug 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Action required

2. Wrong osv lockfile 🐞 Bug ≡ Correctness

The OSV workflow passes "--lockfile=pyproject.toml", but this repo does not contain a resolved
lockfile and pyproject.toml mostly declares unpinned dependencies, so the scan may be ineffective
(no concrete versions) or fail depending on OSV-Scanner’s supported lockfile formats.
Agent Prompt 
## Issue description
The OSV workflow uses `--lockfile=pyproject.toml`, but `pyproject.toml` is not a resolved lockfile in this repo. This can lead to OSV-Scanner not having concrete versions to assess (or rejecting the input) and therefore not delivering the intended vulnerability coverage.

## Issue Context
- The repo contains `pyproject.toml` (dependency declarations) and `requirements.txt`, but no actual lockfile (e.g., `poetry.lock`, `uv.lock`, `requirements.lock`).

## Fix (recommended)
Choose one of:
1) **Remove the explicit lockfile flag** and rely on recursive scanning of supported manifests/requirements, OR
2) **Point `--lockfile` at an actual resolved input** (e.g., add/commit a lockfile generated from `pyproject.toml` and scan that), OR
3) If `requirements.txt` is intended to be the source of truth, scan it explicitly.

## Fix Focus Areas
- .github/workflows/osv-scanner.yml[30-36]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

38 changes: 38 additions & 0 deletions .github/workflows/semantic-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
name: Semantic PR Linter

on:
pull_request_target:

@qodo-code-review qodo-code-review Bot Aug 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

1. Non-security semantic pr workflow 📘 Rule violation § Compliance

The new Semantic PR Linter workflow enforces Conventional Commit title formatting, which is not a
cybersecurity-focused capability. This violates the requirement that Agent-Alpha changes stay scoped
to cybersecurity-related functionality.
Agent Prompt 
## Issue description
A new CI workflow (`.github/workflows/semantic-pr.yml`) was added to enforce PR title semantics (Conventional Commits). This is developer governance/formatting rather than cybersecurity functionality, which violates the repo’s scope restriction.

## Issue Context
The PR is intended to add security guards (OSV scanning, license compliance). The semantic PR title linter is orthogonal to those security controls.

## Fix Focus Areas
- .github/workflows/semantic-pr.yml[1-38]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

types:
- opened
- edited
- synchronize
- reopened

permissions:
pull-requests: read
statuses: write

jobs:
validate-pr-title:
name: Validate PR Title
runs-on: ubuntu-latest
steps:
- name: Validate PR Title Format
uses: amannn/action-semantic-pull-request@v5

@aikido-pr-checks aikido-pr-checks Bot Aug 17, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3rd party Github Actions should be pinned - high severity
A third-party GitHub Action was imported, and is not pinned via a hash. This leaves your CI/CD at risk for potential supply chain attacks, if the affected GitHub Action is compromised.

Suggested change
uses: amannn/action-semantic-pull-request@v5
uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5

Reply @AikidoSec ignore: [REASON] to ignore this issue.
More info

env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Comment on lines +20 to +23

@qodo-code-review qodo-code-review Bot Aug 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Remediation recommended

4. Unpinned third-party actions 🐞 Bug ⛨ Security

The new workflows reference third-party GitHub Actions via mutable tags (e.g.,
amannn/action-semantic-pull-request@v5, google/osv-scanner-action@v1.9.2), which can change
without review and increases CI supply-chain risk.
Agent Prompt 
## Issue description
Workflows should reference actions by immutable commit SHA to prevent tag retargeting (supply-chain hardening). This PR introduces new third-party action references via tags.

## Issue Context
`step-security/harden-runner` is already pinned to a commit SHA in the same workflows, indicating an existing hardening pattern.

## Fix
- Replace tagged action refs with commit-SHA-pinned refs, leaving the human-readable version as a comment, e.g.:
  - `uses: amannn/action-semantic-pull-request@<sha> # v5.x.x`
  - `uses: google/osv-scanner-action/osv-scanner-action@<sha> # v1.9.2`

## Fix Focus Areas
- .github/workflows/semantic-pr.yml[20-23]
- .github/workflows/osv-scanner.yml[20-32]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

with:
types: |
feat
fix
docs
style
refactor
perf
test
build
ci
chore
revert
requireScope: false
validateSingleCommit: false
Loading