Member 3: Set up GitHub Actions CI/CD Pipeline

.github/workflows/ci-cd.yml

@@ -0,0 +1,70 @@
+name: DevSecOps-Pipeline
+
+on:
+  push:
+    branches: [ "main", "develop", "feature/ci-cd-pipeline" ]
+  pull_request:
+    branches: [ "main", "develop", "feature/ci-cd-pipeline" ]
+
+jobs:
+  security-scan:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+
+    steps:
+      - name: Checkout Code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Dependencies & Setup App
+        run: |
+          pip install "SQLAlchemy<2.0" "itsdangerous<2.1" "Werkzeug<2.1" Pillow
+          pip install flask==2.0.1 flask-sqlalchemy==2.5.1 flask-bcrypt flask-login flask-mail flask-wtf email_validator bandit pytest
+
+          export SECRET_KEY="supersecretkey123"
+          export SQLALCHEMY_DATABASE_URI="sqlite:///site.db"
+          cd Python/Flask_Blog/11-Blueprints
+          python3 -c "from flaskblog import create_app, db; app = create_app(); app.app_context().push(); db.create_all()"
+          python3 run.py & 
+          sleep 10
+
+      - name: Run SAST Scan (Bandit)
+        run: bandit -r ./Python/Flask_Blog/11-Blueprints -lll --exit-zero
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: python
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+
+      - name: Create ZAP workspace
+        run: |
+          mkdir -p ${{ github.workspace }}/zap/wrk
+          chmod -R 777 ${{ github.workspace }}/zap/wrk
+
+      - name: ZAP Scan Action
+        uses: zaproxy/action-baseline@v0.12.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          target: 'http://localhost:5000'
+          fail_action: false 
+
+      - name: Final Critical Check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          count=$(gh api repos/${{ github.repository }}/code-scanning/alerts?state=open \
+            --jq '[.[] | select(.rule.security_severity_level == "high" or .rule.security_severity_level == "critical")] | length')
+          if [ "$count" -gt 0 ]; then
+            echo "FAILURE: $count High/Critical vulnerabilities found."
+            exit 1
+          fi

BeautifulSoup/scrape.py

@@ -2,7 +2,7 @@
 import requests
 import csv
 
-source = requests.get('http://coreyms.com').text
+source = requests.get('http://coreyms.com', timeout=5).text
 
 soup = BeautifulSoup(source, 'lxml')
 

Python-JSON/api.py

@@ -1,8 +1,8 @@
-import json
-from urllib.request import urlopen
+import requests  # Change the import at the top
 
-with urlopen("https://finance.yahoo.com/webservice/v1/symbols/allcurrencies/quote?format=json") as response:
-    source = response.read()
+# Replace the urlopen block with this:
+response = requests.get("https://yahoo.com", timeout=5)
+source = response.content
 
 data = json.loads(source)
 

Python-Unit-Testing/employee.py

@@ -24,7 +24,7 @@ def apply_raise(self):
         self.pay = int(self.pay * self.raise_amt)
 
     def monthly_schedule(self, month):
-        response = requests.get(f'http://company.com/{self.last}/{month}')
+	response = requests.get(f'http://company.com/{self.last}/{month}', timeout=5)
         if response.ok:
             return response.text
         else:

Python/Flask_Blog/01-Getting-Started/flaskblog.py

@@ -14,4 +14,4 @@ def about():
 
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/02-Templates/flaskblog.py

@@ -29,4 +29,4 @@ def about():
 
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/03-Forms-and-Validation/flaskblog.py

@@ -53,4 +53,4 @@ def login():
 
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/04-Database/flaskblog.py

@@ -81,4 +81,4 @@ def login():
 
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/05-Package-Structure/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/06-Login-Auth/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/07-User-Account-Profile-Pic/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/08-Posts/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/09-Pagination/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)

Python/Flask_Blog/10-Password-Reset-Email/run.py

@@ -1,4 +1,4 @@
 from flaskblog import app
 
 if __name__ == '__main__':
-    app.run(debug=True)
+    app.run(debug=False)