ci(security): add secret scan and SBOM

2026-08-30 22:22:19 +02:00
parent 9ad812e9ba
commit 8c3822c440
9 changed files with 330 additions and 6 deletions
@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+
+import importlib.util
+import json
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+SPEC = importlib.util.spec_from_file_location("supply_chain", ROOT / "scripts" / "supply-chain.py")
+assert SPEC and SPEC.loader
+SUPPLY_CHAIN = importlib.util.module_from_spec(SPEC)
+SPEC.loader.exec_module(SUPPLY_CHAIN)
+
+
+class SecretScanTests(unittest.TestCase):
+    def test_detects_canaries_without_returning_secret_values(self):
+        canaries = [
+            "-----BEGIN " + "PRIVATE KEY-----",
+            "eyJ" + "a" * 12 + "." + "b" * 12 + "." + "c" * 12,
+            "AKIA" + "A" * 16,
+            "ghp_" + "a" * 36,
+            "AIza" + "a" * 35,
+            "xoxb-" + "a" * 24,
+            "sk_" + "live_" + "a" * 20,
+        ]
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            (root / "fixture.txt").write_text("\n".join(canaries), encoding="utf-8")
+            findings = SUPPLY_CHAIN.scan_files(root, ["fixture.txt"])
+
+        self.assertEqual(len(SUPPLY_CHAIN.SECRET_PATTERNS), len(findings))
+        rendered = "\n".join(f"{kind} {path}:{line}" for kind, path, line in findings)
+        for canary in canaries:
+            self.assertNotIn(canary, rendered)
+
+    def test_ignores_binary_and_oversized_files(self):
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            binary_canary = b"\0-----BEGIN " + b"PRIVATE KEY-----"
+            (root / "binary.dat").write_bytes(binary_canary)
+            (root / "large.txt").write_bytes(b"a" * (SUPPLY_CHAIN.MAX_SCANNED_FILE_BYTES + 1))
+            self.assertEqual([], SUPPLY_CHAIN.scan_files(root, ["binary.dat", "large.txt"]))
+
+
+class SbomTests(unittest.TestCase):
+    def test_generates_deterministic_multi_ecosystem_cyclonedx(self):
+        first = SUPPLY_CHAIN.generate_sbom(ROOT)
+        second = SUPPLY_CHAIN.generate_sbom(ROOT)
+        self.assertEqual(first, second)
+        self.assertEqual("CycloneDX", first["bomFormat"])
+        self.assertEqual("1.5", first["specVersion"])
+
+        components = first["components"]
+        purls = {component["purl"] for component in components}
+        self.assertTrue(any(purl.startswith("pkg:npm/react@") for purl in purls))
+        self.assertTrue(any(purl.startswith("pkg:nuget/Microsoft.EntityFrameworkCore@") for purl in purls))
+        self.assertTrue(any(purl.startswith("pkg:pypi/fastapi@") for purl in purls))
+        self.assertEqual(len(purls), len(components))
+        json.dumps(first)
+
+
+if __name__ == "__main__":
+    unittest.main()