Task 9: Security and Code Inspection

In this task you try out tools that inspect the code and the image, and keep the ones worth a required check.

Scan the code

• CodeQL (GitHub code scanning) for Python.
• Bandit. TODO: or Semgrep.

Scan the dependencies

• Dependabot alerts and version updates.
• The dependency review action on pull requests.
• pip-audit.

Scan for secrets

• GitHub secret scanning and push protection. TODO: or gitleaks in the workflow.

Scan the image

• Trivy on the image built in image-build; fail on high and critical findings.

Plant a finding, and watch it caught

• TODO: an old vulnerable dependency, a hard-coded key, an unsafe call. One per tool.

Choose the required checks

• Which tools block the merge, and which only report. TODO
• Optional: SonarQube Cloud for code quality.