Cyber Security Update Workflows (CRA)

.github/workflows/codeql.yml

@@ -0,0 +1,23 @@
+name: CodeQL Code Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+
+jobs:
+  codeql:
+    uses: mundialis/github-workflows/.github/workflows/codeql.yml@main
+
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read

.github/workflows/docs.yml

@@ -3,6 +3,10 @@ on:
   push:
     branches:
       - main
+
+# the workflow does not require permissions, but to avoid a code security warning this should be explicitly defined:
+permissions: {}
+
 jobs:
   deploy:
     runs-on: ubuntu-latest

.github/workflows/linting.yml

@@ -0,0 +1,24 @@
+name: Linting and code quality check
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  lint:
+    uses: mundialis/github-workflows/.github/workflows/linting.yml@main
+    with:
+      # exclude everything except flake8 and black
+      pylint-version: ''
+      ruff-version: ''
+      SUPER_LINTER_FILTER_REGEX_EXCLUDE: '.*'
+    # the workflow requires permissions that need to be granted by the parent job:
+    permissions:
+      contents: read
+      packages: read
+      # To report GitHub Actions status checks
+      statuses: write

.github/workflows/python-publish.yml

@@ -4,6 +4,9 @@ on:
   release:
     types: [published]
 
+# the workflow does not require permissions, but to avoid a code security warning this should be explicitly defined:
+permissions: {}
+
 jobs:
   publish-python:
     uses: mundialis/github-workflows/.github/workflows/python-publish.yml@python-publish

.github/workflows/sbom-vulnerability-scan.yml

@@ -0,0 +1,21 @@
+name: SBOM Vulnerability Scan
+
+on:
+  push:
+    branches: [ "main" ]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+  release:
+    types: [published]
+
+
+jobs:
+  sbom-scan:
+    permissions:
+      contents: read
+      security-events: write
+
+    uses: mundialis/github-workflows/.github/workflows/sbom-vulnerability-scan.yml@main
+    with:
+      pyproject: pyproject.toml

.github/workflows/tests.yml

@@ -7,6 +7,9 @@ on:
     # The branches below must be a subset of the branches above
     branches: [ main ]
 
+# the workflow does not require permissions, but to avoid a code security warning this should be explicitly defined:
+permissions: {}
+
 jobs:
 
   integration-tests:

.github/workflows/third-party-licenses.yml

@@ -0,0 +1,13 @@
+name: Generate Third-Party Licenses
+
+on:
+  release:
+    types: [published]
+
+permissions: {}
+
+jobs:
+  generate-third-party-licenses:
+    uses: mundialis/github-workflows/.github/workflows/third-party-licenses.yml@main
+    with:
+      pyproject: pyproject.toml