From 8b60eacc2d25cd146330317087362726fe06ec51 Mon Sep 17 00:00:00 2001 From: Byron Williams Date: Wed, 2 Sep 2026 13:46:22 -0700 Subject: [PATCH] ci(security): remove GHAS-dependent CodeQL and dependency-review CI GitHub now bills Advanced Security (Code Security), so CodeQL code scanning, the dependency-review action, and SARIF ingestion into the Security tab no longer function. - Remove standalone codeql.yml and dependency-review.yml workflows - Replace cifuzzy.yml's github/codeql-action/upload-sarif step (its only SARIF publication path) with a plain actions/upload-artifact step, and drop the now-unused security-events: write permission - Update SECURITY.md, CLAUDE.md, workflows/README.md, docs/OPENSSF_COMPLIANCE.md, docs/PROJECT_SETUP.md, and docs/ossf-badge-checklist.md to stop citing CodeQL/dependency-review as active controls, and cite CHANGELOG.md for the removal - Add a CHANGELOG [Unreleased] > Removed entry security-analysis.yml still passes run-codeql: true and run-dependency-review: true to the shared org reusable workflow (ByronWilliamsCPA/.github); those inputs are intentionally left alone here since the shared workflow defaults them to true, and removing the caller lines first would silently re-enable a job that cannot succeed. A follow-up PR removes them once the shared workflow changes. docs/template_feedback.md was reviewed but left untouched: it documents historical feedback about the upstream cookiecutter template, not live claims about this repo's active controls. --- .github/workflows/README.md | 10 ++- .github/workflows/cifuzzy.yml | 15 ++-- .github/workflows/codeql.yml | 72 --------------- .github/workflows/dependency-review.yml | 113 ------------------------ CHANGELOG.md | 3 + CLAUDE.md | 2 +- SECURITY.md | 2 +- docs/OPENSSF_COMPLIANCE.md | 8 +- docs/PROJECT_SETUP.md | 2 +- docs/ossf-badge-checklist.md | 6 +- 10 files changed, 31 insertions(+), 202 deletions(-) delete mode 100644 .github/workflows/codeql.yml delete mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/README.md b/.github/workflows/README.md index c5bf682..e9b2d23 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -66,12 +66,18 @@ CI pipeline with: **Calls**: `ByronWilliamsCPA/.github/.github/workflows/python-security-analysis.yml@main` Security scanning with: -- CodeQL advanced analysis - Bandit static security analysis - pip-audit and OSV-Scanner for dependency CVE scanning - OSV Scanner - OWASP dependency check -- Dependency review (PRs only) + +> **Note (2026-09):** CodeQL advanced analysis and the dependency-review +> action no longer function; GitHub now bills Advanced Security / Code +> Security. The `run-codeql` and `run-dependency-review` inputs above are +> still passed to the shared reusable workflow and are left for a +> coordinated follow-up (removing them here first would silently flip +> their defaults to `true` upstream). The standalone `codeql.yml` and +> `dependency-review.yml` workflow files have been removed from this repo. **Triggers**: Push/PR to main, weekly schedule, manual dispatch diff --git a/.github/workflows/cifuzzy.yml b/.github/workflows/cifuzzy.yml index 5196a49..c84a6ac 100644 --- a/.github/workflows/cifuzzy.yml +++ b/.github/workflows/cifuzzy.yml @@ -12,7 +12,9 @@ # # Duration: 600 seconds per run # Sanitizer: AddressSanitizer for memory safety -# Reporting: SARIF format uploaded to Security tab +# Reporting: SARIF results archived as a workflow artifact (GitHub Advanced +# Security billing changes removed Security-tab SARIF ingestion; see +# CHANGELOG.md, 2026-09) name: Continuous Fuzzing on: @@ -25,7 +27,6 @@ on: permissions: contents: read - security-events: write # For SARIF upload concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -67,12 +68,14 @@ jobs: sanitizer: ${{ matrix.sanitizer }} output-sarif: true - - name: Upload SARIF + - name: Upload SARIF as artifact if: always() - uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: - sarif_file: results.sarif - category: fuzzing-${{ matrix.sanitizer }} + name: fuzzing-sarif-${{ matrix.sanitizer }} + path: results.sarif + retention-days: 30 + if-no-files-found: ignore - name: Upload Crash Artifacts if: failure() diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml deleted file mode 100644 index 653fbf5..0000000 --- a/.github/workflows/codeql.yml +++ /dev/null @@ -1,72 +0,0 @@ -# CodeQL Security Analysis -# CI-013: security-analysis.yml passes run-codeql: true to the org reusable, which also -# runs CodeQL. Review whether this standalone workflow creates a duplicate scan. If so, -# consider removing this file and relying solely on security-analysis.yml. -# Performs static application security testing (SAST) using GitHub CodeQL. -# -# IMPORTANT: GitHub's CodeQL "default setup" must remain DISABLED for this repo. -# Default setup and custom advanced configuration cannot both upload SARIF to the -# Security tab. To verify or disable: Settings > Code security > Code scanning > Default setup. -name: CodeQL Analysis - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - schedule: - - cron: "0 7 * * 1" - workflow_dispatch: - -permissions: - contents: read - -concurrency: - group: codeql-${{ github.ref }} - cancel-in-progress: false - -jobs: - analyze: - name: CodeQL Analyze (Python) - runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - actions: read - contents: read - security-events: write - - steps: - - name: Harden the runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 - with: - egress-policy: audit - - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Set up Python - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: "3.12" - - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - enable-cache: true - - - name: Install dependencies - run: uv sync --no-dev - - - name: Initialize CodeQL - uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 - with: - languages: python - build-mode: none - queries: security-extended,security-and-quality - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 - with: - category: "/language:python" diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml deleted file mode 100644 index ba60481..0000000 --- a/.github/workflows/dependency-review.yml +++ /dev/null @@ -1,113 +0,0 @@ -# Dependency Review - Analyzes dependency changes in PRs -# CI-013: security-analysis.yml passes run-dependency-review: true to the org reusable. -# Review whether this standalone workflow duplicates that check. -# Checks for vulnerabilities and license compliance -# -# Features: -# - Vulnerability detection in dependency changes -# - License compliance checking -# - Blocks PRs with high severity vulnerabilities -name: Dependency Review - -on: - pull_request: - branches: [main, master, develop] - -permissions: - contents: read - pull-requests: write - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - dependency-review: - name: Dependency Review - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - name: Harden runner - uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3 - with: - egress-policy: audit - # NOTE: tighten to block after 2026-06-30 (cross-workflow egress migration). - # The dependency-review action queries the GitHub API for dependency - # metadata. When flipping to block, uncomment: - # allowed-endpoints: > - # api.github.com:443 - # github.com:443 - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - - name: Dependency Review - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 - with: - fail-on-severity: high - # Allow common permissive and compatible licenses. - # NOTE: Cannot use both allow-licenses and deny-licenses - using allow-list approach. - # Composite license entries (added 2026-05-17 during lockfile refresh): - # - MIT-CMU: Pillow's MIT-style license (CMU variant) - # - LicenseRef-scancode-protobuf: Google protobuf upstream license, BSD-3-Clause compatible - # - ZPL-2.1: Zope Public License (BSD-style permissive), used by pytz - # - HPND-Markus-Kuhn: Historical Permission Notice and Disclaimer variant, used by wcwidth - # Audio-preprocessing entries (added 2026-05-19 with Phase 1 preprocessing pipeline): - # - MPL-1.1: older MPL variant used by hypothesis (paired with MPL-2.0) - # - 0BSD: zero-clause BSD, used by numba - # - BSD-4-Clause: 4-clause BSD, used by numba - # - BSD-2-Clause-Views: 2-clause BSD variant, used by rq - # - Zlib: zlib license, permissive, used by numpy - # - LicenseRef-scancode-python-cwi: Python CWI license, BSD-style, used by numba - # - LicenseRef-scancode-secret-labs-2011: Secret Labs license, BSD-style, used by numba - # - LicenseRef-scancode-unicode: Unicode license, permissive, used by numba - allow-licenses: MIT, MIT-CMU, Apache-2.0, BSD-2-Clause, BSD-2-Clause-Views, BSD-3-Clause, BSD-4-Clause, 0BSD, ISC, MPL-1.1, MPL-2.0, LGPL-2.1, LGPL-3.0, Python-2.0, Unlicense, CC0-1.0, GPL-3.0-or-later, ZPL-2.1, Zlib, HPND-Markus-Kuhn, LicenseRef-scancode-protobuf, LicenseRef-scancode-python-cwi, LicenseRef-scancode-secret-labs-2011, LicenseRef-scancode-unicode - # Packages whose license metadata is not indexed by GitHub's dependency - # API (action sees "no license"). These all have known permissive - # licenses that would be allowed under allow-licenses if metadata was - # present: - # - torch, lxml, silero-vad, onnxruntime, deepgram-sdk: BSD-3-Clause / MIT - # - protobuf: BSD-3-Clause (LicenseRef-scancode-protobuf upstream) - # - jaraco-functools, ruamel-yaml, ruamel-yaml-clib: MIT - # - mkdocs-git-revision-date-localized-plugin: MIT - # - llvmlite: BSD-2-Clause with LLVM exception (permissive). GitHub's - # dependency API resolves it to an unparseable composite ref - # (LicenseRef-bad-...), so it is bypassed by package name. Pulled - # transitively by numba. (added 2026-06-04, PR #60) - # - nvidia-*/cuda-* CUDA stack: NVIDIA Software License Agreement - # (proprietary EULA, accepted as dependency of torch which is - # required for VAD). Package names migrated from the cu12 suffix to - # the CUDA 13 names during the 2026-06-04 lockfile refresh (PR #60). - allow-dependencies-licenses: >- - pkg:pypi/torch, - pkg:pypi/lxml, - pkg:pypi/silero-vad, - pkg:pypi/onnxruntime, - pkg:pypi/deepgram-sdk, - pkg:pypi/protobuf, - pkg:pypi/jaraco-functools, - pkg:pypi/ruamel-yaml, - pkg:pypi/ruamel-yaml-clib, - pkg:pypi/mkdocs-git-revision-date-localized-plugin, - pkg:pypi/llvmlite, - pkg:pypi/cuda-bindings, - pkg:pypi/cuda-pathfinder, - pkg:pypi/cuda-toolkit, - pkg:pypi/nvidia-cublas, - pkg:pypi/nvidia-cuda-cupti, - pkg:pypi/nvidia-cuda-nvrtc, - pkg:pypi/nvidia-cuda-runtime, - pkg:pypi/nvidia-cudnn-cu13, - pkg:pypi/nvidia-cufft, - pkg:pypi/nvidia-cufile, - pkg:pypi/nvidia-curand, - pkg:pypi/nvidia-cusolver, - pkg:pypi/nvidia-cusparse, - pkg:pypi/nvidia-cusparselt-cu13, - pkg:pypi/nvidia-nccl-cu13, - pkg:pypi/nvidia-nvjitlink, - pkg:pypi/nvidia-nvshmem-cu13, - pkg:pypi/nvidia-nvtx - # Comment on PR with findings - comment-summary-in-pr: on-failure diff --git a/CHANGELOG.md b/CHANGELOG.md index 5681e7a..a604aef 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Removed +- ci(security): remove `codeql.yml` and `dependency-review.yml`; GitHub now bills Advanced Security (Code Security), so CodeQL code scanning, the dependency-review action, and SARIF ingestion into the Security tab no longer function. `cifuzzy.yml` no longer uploads its ClusterFuzzLite SARIF via `github/codeql-action/upload-sarif`; the results are now published as a plain workflow artifact instead. `security-analysis.yml` still passes `run-codeql: true` and `run-dependency-review: true` to the shared org reusable workflow; removing those inputs is a coordinated follow-up so the shared workflow's `true` defaults do not silently re-enable a job that cannot succeed. + ### Added - Initial project setup and structure - feat(preprocessing): audio preprocessing pipeline phases 1-4: FFmpeg-based format conversion and video audio extraction (`AudioConverter`), signal conditioning with resampling/normalization/DC-offset removal (`AudioConditioner`), SNR-based quality assessment (`QualityAssessor`), Silero VAD voice activity detection (`VADProcessor`), Deepgram Nova-2 transcription with diarization and summarization (`DeepgramTranscriptionClient`), multi-format transcript output (`ArtifactGenerator`), and ARQ background job orchestration (`process_audio_job`) with Redis-backed status tracking diff --git a/CLAUDE.md b/CLAUDE.md index 7c5c3ae..33b373c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -603,7 +603,7 @@ uv run pytest tests/unit/test_example.py::test_function_name -v **GitHub Actions Workflows**: 1. **CI** (`.github/workflows/ci.yml`): Tests, linting, type checking -2. **Security** (`.github/workflows/security-analysis.yml`): CodeQL, Bandit, pip-audit, OSV +2. **Security** (`.github/workflows/security-analysis.yml`): Bandit, pip-audit, OSV (CodeQL removed 2026-09, GitHub Advanced Security billing; see CHANGELOG) 3. **Docs** (`.github/workflows/docs.yml`): Build and deploy documentation 4. **Publish** (`.github/workflows/publish-pypi.yml`): PyPI release automation diff --git a/SECURITY.md b/SECURITY.md index 3746117..832b412 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -101,7 +101,7 @@ scanning runs via `detect-secrets` and TruffleHog pre-commit hooks. ## Security Practices -- Static analysis: CodeQL, Bandit, Ruff security rules (`S` category) +- Static analysis: Bandit, Ruff security rules (`S` category) (CodeQL removed 2026-09: GitHub now bills Advanced Security / Code Security; see CHANGELOG) - Dependency scanning: `pip-audit` in CI - Container scanning: Trivy on Docker images in CI - SBOM generation for tagged releases (CycloneDX format) diff --git a/docs/OPENSSF_COMPLIANCE.md b/docs/OPENSSF_COMPLIANCE.md index 46b67d5..036d9f7 100644 --- a/docs/OPENSSF_COMPLIANCE.md +++ b/docs/OPENSSF_COMPLIANCE.md @@ -24,7 +24,7 @@ This template implements the following security controls: - ✅ Continuous fuzzing with ClusterFuzzLite - ✅ Branch protection with scoped permissions - ✅ Automated dependency updates -- ✅ Multi-tool security scanning (Bandit, pip-audit, CodeQL, Trivy) +- ✅ Multi-tool security scanning (Bandit, pip-audit, Trivy) --- @@ -191,14 +191,16 @@ Automated dependency updates and vulnerability scanning. ### 7. Security Scanning (SAST) 🔍 -Static analysis (Bandit, CodeQL, Semgrep) runs on every commit. +Static analysis (Bandit, Semgrep) runs on every commit. CodeQL was +removed 2026-09 (GitHub now bills Advanced Security / Code Security, +so CodeQL code scanning and SARIF ingestion into the Security tab no +longer function); see `CHANGELOG.md`. **Tools**: - **Ruff**: Python linting with security rules - **Bandit**: Python security issue detection - **BasedPyright**: Type safety (prevents entire classes of bugs) -- **CodeQL**: Advanced semantic code analysis **Workflow**: `.github/workflows/security-analysis.yml` diff --git a/docs/PROJECT_SETUP.md b/docs/PROJECT_SETUP.md index e0d3919..f4455d8 100644 --- a/docs/PROJECT_SETUP.md +++ b/docs/PROJECT_SETUP.md @@ -390,7 +390,7 @@ Your project includes several GitHub Actions workflows: | Workflow | File | Purpose | |----------|------|---------| | CI Pipeline | `ci.yml` | Tests, linting, type checking | -| Security Analysis | `security-analysis.yml` | Dependency scanning, CodeQL | +| Security Analysis | `security-analysis.yml` | Bandit, pip-audit, OSV-Scanner dependency scanning | | PR Validation | `pr-validation.yml` | Lock file and requirements sync validation | | OpenSSF Scorecard | `scorecard.yml` | Supply chain security assessment | | SBOM & Security Scan | `sbom.yml` | Software Bill of Materials generation | diff --git a/docs/ossf-badge-checklist.md b/docs/ossf-badge-checklist.md index 1911415..febbee2 100644 --- a/docs/ossf-badge-checklist.md +++ b/docs/ossf-badge-checklist.md @@ -81,7 +81,7 @@ tags: | Criterion | Status | Evidence | |-----------|--------|----------| | `security_know_secure_design` | MET | Self-attestation. `CLAUDE.md` documents FIPS 140-2/3 compliance rules, OWASP tooling, and RAD tagging. `SECURITY.md` has a Security Surface section. File for this criterion on the questionnaire by selecting "Met" and citing these docs. | -| `security_know_common_errors` | MET | Self-attestation. CI runs Bandit (CWE coverage), CodeQL (`.github/workflows/codeql.yml`), and pip-audit. File on questionnaire by selecting "Met" and citing the security workflow. | +| `security_know_common_errors` | MET | Self-attestation. CI runs Bandit (CWE coverage) and pip-audit. CodeQL was removed 2026-09 (GitHub Advanced Security billing); see `CHANGELOG.md`. File on questionnaire by selecting "Met" and citing the security workflow. | | `security_crypto_published` | MET | No custom cryptographic algorithms; the project uses the Python `cryptography` library and FIPS-approved algorithms only (per `CLAUDE.md` FIPS rules). | | `security_crypto_keylength` | MET | Default key lengths from `cryptography` library (AES-256, RSA-2048+ for signing) meet NIST recommendations. | | `security_crypto_working` | MET | SHA-1 and MD5 are not used for security purposes; project follows FIPS-approved algorithm list. | @@ -91,7 +91,7 @@ tags: | `security_assurance_case` | PARTIAL | `SECURITY.md` has a "Security Surface" section naming attack vectors and controls. `CLAUDE.md` documents security-first development. A formal assurance case document does not yet exist. To fully meet this criterion, add a `docs/security-assurance-case.md` that traces each threat from the Security Surface section to its control and residual risk. | | `security_centralized_authn` | N/A | Project is a CLI/library, not a multi-user application with authentication. Select N/A on the questionnaire. | | `security_context` | MET | Least-privilege workflow tokens in GitHub Actions; Pydantic Settings for secrets; see `SECURITY.md`. | -| `security_static_analysis` | MET | Bandit, Ruff `S`-category rules, CodeQL (`.github/workflows/codeql.yml`), and Semgrep run in CI. | +| `security_static_analysis` | MET | Bandit, Ruff `S`-category rules, and Semgrep run in CI. CodeQL was removed 2026-09 (GitHub Advanced Security billing). | | `security_static_analysis_fixed` | MET | CI fails on any HIGH/CRITICAL Bandit finding; `CLAUDE.md` prohibits suppression without documented justification. | | `security_dynamic_analysis` | MET | ClusterFuzzLite (`cifuzzy.yml`) runs fuzz targets on every PR; Atheris instrumentation in `.clusterfuzzlite/`. | | `security_dynamic_analysis_unsafe` | MET | Atheris fuzz targets use ASan/UBSan instrumentation enabled by the ClusterFuzzLite base builder. | @@ -104,7 +104,7 @@ These criteria are PARTIAL or require a questionnaire self-attestation before th 1. **`change_control_release_notes_vulns`** (PARTIAL): Ensure future `CHANGELOG.md` security entries include assigned CVE IDs. 2. **`security_know_secure_design`** (self-attestation on questionnaire): Select "Met" and cite `CLAUDE.md` + `SECURITY.md`. -3. **`security_know_common_errors`** (self-attestation on questionnaire): Select "Met" and cite `codeql.yml` + `security-analysis.yml`. +3. **`security_know_common_errors`** (self-attestation on questionnaire): Select "Met" and cite `security-analysis.yml` (Bandit/pip-audit/OSV); `codeql.yml` was removed 2026-09, see `CHANGELOG.md`. 4. **`security_assurance_case`** (PARTIAL): Either create `docs/security-assurance-case.md` or self-attest "Met" if the existing `SECURITY.md` Security Surface section is deemed sufficient. 5. **`reporting_vulnerability_report_private`**: Confirm GitHub Private Vulnerability Reporting is active at `https://github.com/ByronWilliamsCPA/audio-processor/settings/security_analysis`.