diff --git a/.github/workflows/python-security.yml b/.github/workflows/python-security.yml index fc6bda1..6dbc8ba 100644 --- a/.github/workflows/python-security.yml +++ b/.github/workflows/python-security.yml @@ -3,20 +3,6 @@ name: Python Security on: workflow_call: inputs: - defectdojo-engagement: - description: "DefectDojo Engagement name or id" - default: "" - required: false - type: string - dependency-track-project-name: - description: Project name for Dependency Track. - required: false - type: string - dependency-track-project-version: - description: Project name for Dependency Track. Typically the default branch unless multiple forks are maintained. - default: main - required: false - type: string publish-reports: description: Publish the generated reports to the Security Operation Center. Defaults to false. default: false @@ -32,19 +18,6 @@ on: default: . required: false type: string - secrets: - defectdojo-url: - description: DefectDojo URL - required: false - defectdojo-token: - description: DefectDojo API Token - required: false - dependency-track-url: - description: URL to the Dependency Track instance to publish the SBOM to. - required: false - dependency-track-api-key: - description: API key of the Dependency Track instance. - required: false jobs: secrets: @@ -67,14 +40,9 @@ jobs: uses: actions/checkout@v3 - name: Checks - uses: equisoft-actions/semgrep@v1 + uses: equisoft-actions/codeql@v1 with: - defectdojo-engagement: ${{ inputs.defectdojo-engagement }} - defectdojo-publish: ${{ inputs.publish-reports }} - defectdojo-token: ${{ secrets.defectdojo-token }} - defectdojo-url: ${{ secrets.defectdojo-url }} - language: py - report-retention-days: ${{ inputs.report-retention-days }} + languages: python working-directory: ${{ inputs.working-directory }} sbom: @@ -88,12 +56,8 @@ jobs: uses: equisoft-actions/setup-python@v1 - name: Generate SBOM - uses: equisoft-actions/pipenv-sbom@v1 + uses: equisoft-actions/pipenv-sbom@v2 with: - dependency-track-api-key: ${{ secrets.dependency-track-api-key }} - dependency-track-url: ${{ secrets.dependency-track-url }} - dependency-track-project-name: ${{ inputs.dependency-track-project-name }} - dependency-track-project-version: ${{ inputs.dependency-track-project-version }} publish: ${{ inputs.publish-reports }} report-retention-days: ${{ inputs.report-retention-days }} working-directory: ${{ inputs.working-directory }}