Update .gitea/workflows/security.yml

.gitea/workflows/security.yml

@@ -28,6 +28,9 @@ jobs:
         with:
           token: ${{ secrets.CI_BOT_TOKEN }}
 
+      - name: Install jq (for parsing JSON)
+        run: sudo apt-get update && sudo apt-get install -y jq
+
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
@@ -36,20 +39,37 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore safety bandit semgrep
+          # Pin safety to a v2 line where `check --json` is stable
+          pip install --root-user-action=ignore "safety>=2,<3" bandit semgrep
 
       - name: Run Safety check
         run: |
+          if [ -f requirements.txt ]; then
             safety check -r requirements.txt --json --output safety-report.json || true
+          else
+            echo "[]" > safety-report.json
+          fi
+          if [ -f requirements-dev.txt ]; then
             safety check -r requirements-dev.txt --json --output safety-dev-report.json || true
+          else
+            echo "[]" > safety-dev-report.json
+          fi
 
       - name: Run Bandit security scan
         run: |
+          if [ -d src ]; then
             bandit -r src/ -f json -o bandit-report.json || true
+          else
+            echo '{"results":[]}' > bandit-report.json
+          fi
 
       - name: Run Semgrep security scan
         run: |
+          if [ -d src ]; then
             semgrep --config=auto src/ --json --output=semgrep-report.json || true
+          else
+            echo '{"results":[]}' > semgrep-report.json
+          fi
 
       - name: Upload security reports
         uses: actions/upload-artifact@v3
@@ -65,28 +85,43 @@ jobs:
         run: |
           echo "🔍 Checking for critical vulnerabilities..."
 
-          # Check Safety results
+          # --- Safety results (robust to array/object formats) ---
-          if [ -f safety-report.json ]; then
+          summarize_safety () {
-            critical_count=$(jq '.vulnerabilities | length' safety-report.json 2>/dev/null || echo "0")
+            f="$1"
-            if [ "$critical_count" -gt 0 ]; then
+            if [ -f "$f" ]; then
-              echo "⚠️ Found $critical_count dependency vulnerabilities"
+              count=$(jq -r '
-              jq '.vulnerabilities[] | "- \(.package_name) \(.installed_version): \(.vulnerability_id)"' safety-report.json
+                if type=="array" then length
-            else
+                else ((.vulnerabilities // []) | length)
-              echo "✅ No dependency vulnerabilities found"
+                end
-            fi
+              ' "$f" 2>/dev/null || echo "0")
-          fi
 
-          # Check Bandit results
+              if [ "${count:-0}" -gt 0 ]; then
+                echo "⚠️ Found $count dependency vulnerabilities in $f"
+                jq -r '
+                  if type=="array" then
+                    .[] | "- \(.package_name // .name) \(.installed_version // ""): \(.vulnerability_id // .advisory // "N/A")"
+                  else
+                    (.vulnerabilities // [])[] | "- \(.package_name) \(.installed_version): \(.vulnerability_id)"
+                  end
+                ' "$f" || true
+              else
+                echo "✅ No dependency vulnerabilities found in $f"
+              fi
+            fi
+          }
+          summarize_safety safety-report.json
+          summarize_safety safety-dev-report.json
+
+          # --- Bandit results (count HIGH severity properly) ---
           if [ -f bandit-report.json ]; then
-            high_severity=$(jq '.results[] | select(.issue_severity == "HIGH") | length' bandit-report.json 2>/dev/null | wc -l)
+            high_severity=$(jq '[.results[]? | select(.issue_severity=="HIGH")] | length' bandit-report.json 2>/dev/null || echo "0")
-            if [ "$high_severity" -gt 0 ]; then
+            if [ "${high_severity:-0}" -gt 0 ]; then
               echo "⚠️ Found $high_severity high-severity security issues"
             else
               echo "✅ No high-severity security issues found"
             fi
           fi
 
-
   # License compliance check
   license-check:
     name: License Compliance
@@ -98,6 +133,9 @@ jobs:
         with:
           token: ${{ secrets.CI_BOT_TOKEN }}
 
+      - name: Install jq (for parsing JSON)
+        run: sudo apt-get update && sudo apt-get install -y jq
+
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
@@ -107,7 +145,9 @@ jobs:
         run: |
           python -m pip install --upgrade pip --root-user-action=ignore
           pip install --root-user-action=ignore pip-licenses
+          if [ -f requirements.txt ]; then
             pip install --root-user-action=ignore -r requirements.txt
+          fi
 
       - name: Check licenses
         run: |
@@ -115,11 +155,10 @@ jobs:
           pip-licenses --format=json --output-file=licenses.json
           pip-licenses --format=markdown --output-file=licenses.md
 
-          # Check for problematic licenses
+          # Check for potentially problematic licenses
           problematic_licenses=("GPL" "AGPL" "LGPL")
-
           for license in "${problematic_licenses[@]}"; do
-            if grep -i "$license" licenses.json; then
+            if grep -iq "$license" licenses.json; then
               echo "⚠️ Found potentially problematic license: $license"
             fi
           done
@@ -145,25 +184,26 @@ jobs:
         with:
           token: ${{ secrets.CI_BOT_TOKEN }}
 
+      - name: Install jq (for parsing JSON)
+        run: sudo apt-get update && sudo apt-get install -y jq
+
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
-      - name: Install pip-check-updates equivalent
-        run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore pip-review
-
       - name: Check for outdated packages
         run: |
           echo "📦 Checking for outdated packages..."
+          if [ -f requirements.txt ]; then
+            python -m pip install --upgrade pip --root-user-action=ignore
             pip install --root-user-action=ignore -r requirements.txt
+          fi
           pip list --outdated --format=json > outdated-packages.json || true
 
-          if [ -s outdated-packages.json ]; then
+          if [ -s outdated-packages.json ] && [ "$(cat outdated-packages.json)" != "[]" ]; then
             echo "📋 Outdated packages found:"
-            cat outdated-packages.json | jq -r '.[] | "- \(.name): \(.version) -> \(.latest_version)"'
+            jq -r '.[] | "- \(.name): \(.version) -> \(.latest_version)"' outdated-packages.json
           else
             echo "✅ All packages are up to date"
           fi
@@ -173,164 +213,9 @@ jobs:
         run: |
           if [ -s outdated-packages.json ] && [ "$(cat outdated-packages.json)" != "[]" ]; then
             echo "📝 Creating dependency update issue..."
-            
-            # Create issue body
             cat > issue-body.md << 'EOF'
 ## 📦 Dependency Updates Available
 
 The following packages have updates available:
-
 EOF
-            
+            jq -r '.[] | "- **\(.name)**: \(.version) →
-            cat outdated-packages.json | jq -r '.[] | "- **\(.name)**: \(.version) → \(.latest_version)"' >> issue-body.md
-            
-            cat >> issue-body.md << 'EOF'
-
-          ## 🔍 Security Impact
-
-          Please review each update for:
-          - Security fixes
-          - Breaking changes
-          - Compatibility issues
-
-          ## ✅ Action Items
-
-          - [ ] Review changelog for each package
-          - [ ] Test updates in development environment
-          - [ ] Update requirements.txt
-          - [ ] Run full test suite
-          - [ ] Deploy to staging for validation
-
-          ---
-          *This issue was automatically created by the security workflow.*
-          EOF
-            
-            echo "Issue body created. In a real implementation, you would create a Gitea issue here."
-            cat issue-body.md
-          fi
-
-      - name: Upload dependency reports
-        uses: actions/upload-artifact@v3
-      with:
-          name: dependency-reports-${{ github.run_number }}
-          path: |
-            outdated-packages.json
-            issue-body.md
-
-  # Code quality metrics
-  code-quality:
-    name: Code Quality Metrics
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-      with:
-        token: ${{ secrets.CI_BOT_TOKEN }}
-
-      - name: Set up Python
-        uses: actions/setup-python@v4
-      with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      - name: Install quality tools
-        run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
-          pip install --root-user-action=ignore radon xenon vulture
-          pip install --root-user-action=ignore -r requirements.txt
-
-      - name: Calculate code complexity
-        run: |
-          echo "📊 Calculating code complexity..."
-          radon cc src/ --json > complexity-report.json
-          radon mi src/ --json > maintainability-report.json
-
-          echo "🔍 Complexity Summary:"
-          radon cc src/ --average
-
-          echo "🔧 Maintainability Summary:"
-          radon mi src/
-
-      - name: Find dead code
-        run: |
-          echo "🧹 Checking for dead code..."
-          vulture src/ --json > dead-code-report.json || true
-
-      - name: Check for code smells
-        run: |
-          echo "👃 Checking for code smells..."
-          xenon --max-absolute B --max-modules A --max-average A src/ || true
-
-      - name: Upload quality reports
-        uses: actions/upload-artifact@v3
-      with:
-          name: code-quality-reports-${{ github.run_number }}
-          path: |
-            complexity-report.json
-            maintainability-report.json
-            dead-code-report.json
-
-  # Security summary
-  security-summary:
-    name: Security Summary
-    runs-on: ubuntu-latest
-    needs: [dependency-scan, docker-security-scan, license-check, code-quality]
-    if: always()
-
-    steps:
-      - name: Download all artifacts
-        uses: actions/download-artifact@v3
-
-      - name: Generate security summary
-        run: |
-          echo "# 🔒 Security Scan Summary" > security-summary.md
-          echo "" >> security-summary.md
-          echo "**Scan Date:** $(date -u)" >> security-summary.md
-          echo "**Repository:** ${{ github.repository }}" >> security-summary.md
-          echo "**Commit:** ${{ github.sha }}" >> security-summary.md
-          echo "" >> security-summary.md
-
-          echo "## 📊 Results" >> security-summary.md
-          echo "" >> security-summary.md
-
-          # Dependency scan results
-          if [ -f security-reports-*/safety-report.json ]; then
-            vuln_count=$(jq '.vulnerabilities | length' security-reports-*/safety-report.json 2>/dev/null || echo "0")
-            if [ "$vuln_count" -eq 0 ]; then
-              echo "- ✅ **Dependency Scan**: No vulnerabilities found" >> security-summary.md
-            else
-              echo "- ⚠️ **Dependency Scan**: $vuln_count vulnerabilities found" >> security-summary.md
-            fi
-          else
-            echo "- ❓ **Dependency Scan**: Results not available" >> security-summary.md
-          fi
-
-          # Docker scan results (removed Trivy)
-          echo "- ⏭️ **Docker Scan**: Skipped (Trivy removed)" >> security-summary.md
-
-          # License check results
-          if [ -f license-report-*/licenses.json ]; then
-            echo "- ✅ **License Check**: Completed" >> security-summary.md
-          else
-            echo "- ❓ **License Check**: Results not available" >> security-summary.md
-          fi
-
-          # Code quality results
-          if [ -f code-quality-reports-*/complexity-report.json ]; then
-            echo "- ✅ **Code Quality**: Analyzed" >> security-summary.md
-          else
-            echo "- ❓ **Code Quality**: Results not available" >> security-summary.md
-          fi
-
-          echo "" >> security-summary.md
-          echo "## 🔗 Detailed Reports" >> security-summary.md
-          echo "" >> security-summary.md
-          echo "Detailed reports are available in the workflow artifacts." >> security-summary.md
-
-          cat security-summary.md
-
-      - name: Upload security summary
-        uses: actions/upload-artifact@v3
-      with:
-          name: security-summary-${{ github.run_number }}
-          path: security-summary.md