feat: improve project security posture #99
Draft
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR introduces the following security changes to the project * Dependabot configuration for daily scans/updates from the Python and GitHub Actions ecosystems * Updates to the project CI GHA workflow to improve security * Upgrade reusable actions to latest release versions * Use poetry in CI to ensure consistent dependency version usage between dev and CI * Add execution of bandit and gitleaks checks * pre-commit tooling for contributors now runs `bandit`, `snyk`, `zizmor` and `gitleaks` * CI, codebase and dependency changes made to reflect issues found in scans * `security-insights.yml` added to communicate security changes to project made above Here is the `pre-commit` output from this commit: ``` ruff.....................................................................Passed ruff-format..............................................................Passed bandit...................................................................Passed Detect hardcoded secrets.................................................Passed Snyk Test................................................................Passed - hook id: snyk-test - duration: 3.61s [pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk path: /opt/homebrew/bin/snyk [pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk version: 1.1298.0 [pre-commit-snyk] 2025-07-22 09:00:50 level=info Snyk arguments: test --file=poetry.lock --package-manager=pip --fail-on=upgradable Testing /Users/travistruman/dev/uqlm... Tested 103 dependencies for known issues, found 8 issues, 24 vulnerable paths. Issues with no direct upgrade or patch: ✗ Improper Resource Shutdown or Release [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332643] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Buffer Overflow [High Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332644] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Buffer Overflow [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10332645] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Mismatched Memory Management Routines [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337825] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337826] in torch 7386 @2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337828] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Out-of-bounds Write [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-10337834] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available ✗ Improper Check for Unusual or Exceptional Conditions [Medium Severity][https://security.snyk.io/vuln/SNYK-PYTHON-TORCH-9726944] in torch@2.7.1 introduced by torch@2.7.1 and 2 other path(s) No upgrade or patch available Organization: trumant Package manager: poetry Target file: pyproject.toml Project name: uqlm Open source: no Project path: /Users/travistruman/dev/uqlm Licenses: enabled [pre-commit-snyk] 2025-07-22 09:00:52 level=info Snyk exit code: 0 zizmor...................................................................Passed ```
213f5b0 to
26ad55a
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces the following security changes to the project
bandit,snyk,zizmorandgitleakssecurity-insights.ymladded to communicate security changes to project made aboveHere is the
pre-commitoutput from this commit: