Add security linters

.ci/run-safety.sh → .ci/run-security-linters.sh

@@ -1,4 +1,10 @@
 #! /bin/bash
+
+set -x
+set -eo pipefail
+
+# {{{ security
+
 # 38678: django-celery-results: no update currently available
 # https://github.com/celery/django-celery-results/issues/154
 # 39253:  py.path.svnwc DOS
@@ -15,3 +21,14 @@ poetry run safety check \
         -i 40291 \
         -i 41002 \
         --full-report
+
+# }}}
+
+CODE_DIRS=(relate course accounts)
+
+# FIXME: Also use https://semgrep.dev/p/owasp-top-ten
+poetry run semgrep --config "p/ci" "${CODE_DIRS[@]}"
+
+poetry run bandit -r -c pyproject.toml "${CODE_DIRS[@]}"
+
+# vim: foldmethod=marker

.github/workflows/ci.yml

@@ -44,8 +44,8 @@ jobs:
           poetry run flake8 --extend-ignore Q000 tests
       - name: "Mypy"
         run: poetry run mypy relate course
-      - name: "Safety"
-        run: bash ./.ci/run-safety.sh
+      - name: "Security linters"
+        run: bash ./.ci/run-security-linters.sh
       - name: "Sphinx"
         run: |
             cp local_settings_example.py local_settings.py

.gitlab-ci.yml

@@ -59,9 +59,9 @@ mypy:
   <<: *quality
   script: poetry run mypy relate course
 
-safety:
+security-lint:
   <<: *quality
-  script: bash ./.ci/run-safety.sh
+  script: bash ./.ci/run-security-linters.sh
 
 Python 3:
   <<: *test