|
8 | 8 |
|
9 | 9 | permissions: |
10 | 10 | contents: read |
11 | | - pull-requests: write |
| 11 | + pull-requests: read |
12 | 12 |
|
13 | 13 | jobs: |
14 | 14 | build: |
@@ -39,29 +39,99 @@ jobs: |
39 | 39 | name: test-results |
40 | 40 | path: '**/test-results.trx' |
41 | 41 |
|
42 | | - ai-pr-review: |
| 42 | + ai-security-scan: |
43 | 43 | if: github.event_name == 'pull_request' |
44 | 44 | runs-on: ubuntu-latest |
45 | 45 | needs: build |
46 | 46 |
|
47 | | - permissions: |
48 | | - contents: read |
49 | | - pull-requests: write |
50 | | - |
51 | 47 | steps: |
52 | 48 | - name: Checkout |
53 | 49 | uses: actions/checkout@v4 |
54 | | - |
55 | | - - name: AI PR Review |
56 | | - uses: github/copilot-code-review-action@v1 |
57 | 50 | with: |
58 | | - model: gpt-4o |
59 | | - custom_instructions: | |
60 | | - You are a rigorous senior code reviewer tasked with preventing security vulnerabilities in code submissions. |
61 | | - Your assessment must be based on the code diffs of each commit. |
62 | | - - Language: English |
63 | | - - Focus on .NET security policy and best practices |
64 | | - - Flag any potential SQL injection, XSS, path traversal, insecure deserialization, or other OWASP Top 10 risks |
65 | | - - Check for hardcoded secrets, credentials, or sensitive data exposure |
66 | | - - Verify proper input validation and output encoding |
67 | | - - Ensure secure file I/O patterns (no arbitrary file access) |
| 51 | + fetch-depth: 0 |
| 52 | + |
| 53 | + - name: Get PR diff |
| 54 | + id: diff |
| 55 | + run: | |
| 56 | + DIFF=$(git diff origin/${{ github.base_ref }}...HEAD -- '*.cs' '*.csproj' || true) |
| 57 | + if [ -z "$DIFF" ]; then |
| 58 | + echo "No code changes detected." |
| 59 | + echo "skip=true" >> $GITHUB_OUTPUT |
| 60 | + else |
| 61 | + # Save diff to file to avoid shell escaping issues |
| 62 | + echo "$DIFF" > /tmp/pr_diff.txt |
| 63 | + echo "skip=false" >> $GITHUB_OUTPUT |
| 64 | + fi |
| 65 | +
|
| 66 | + - name: AI Security Review |
| 67 | + if: steps.diff.outputs.skip != 'true' |
| 68 | + env: |
| 69 | + AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }} |
| 70 | + AZURE_OPENAI_ENDPOINT: ${{ secrets.AZURE_OPENAI_ENDPOINT }} |
| 71 | + AZURE_OPENAI_DEPLOYMENT: ${{ secrets.AZURE_OPENAI_DEPLOYMENT }} |
| 72 | + run: | |
| 73 | + DIFF=$(cat /tmp/pr_diff.txt) |
| 74 | + |
| 75 | + # Truncate diff if too large (max ~12000 chars to fit in context) |
| 76 | + if [ ${#DIFF} -gt 12000 ]; then |
| 77 | + DIFF="${DIFF:0:12000}... [truncated]" |
| 78 | + fi |
| 79 | + |
| 80 | + INSTRUCTIONS=$(cat .github/copilot-code-review.md 2>/dev/null || echo "Review for security issues.") |
| 81 | + |
| 82 | + API_VERSION="2025-01-01-preview" |
| 83 | + URL="${AZURE_OPENAI_ENDPOINT%/}/openai/deployments/${AZURE_OPENAI_DEPLOYMENT}/chat/completions?api-version=${API_VERSION}" |
| 84 | + |
| 85 | + # Build JSON payload safely using jq |
| 86 | + PAYLOAD=$(jq -n \ |
| 87 | + --arg instructions "$INSTRUCTIONS" \ |
| 88 | + --arg diff "$DIFF" \ |
| 89 | + '{ |
| 90 | + messages: [ |
| 91 | + { role: "system", content: $instructions }, |
| 92 | + { role: "user", content: ("Review this code diff for security vulnerabilities in APPLICATION SOURCE CODE ONLY. Respond ONLY with a JSON object (no markdown, no code blocks): {\"passed\": true/false, \"issues\": [\"description1\", \"description2\"]}. Set passed=true if no security issues found in application code, passed=false only for real security concerns like SQL injection, XSS, path traversal, hardcoded credentials in source code, etc. Do NOT flag CI/CD workflow configuration or documentation changes as issues.\n\nDiff:\n" + $diff) } |
| 93 | + ], |
| 94 | + temperature: 0.1 |
| 95 | + }') |
| 96 | + |
| 97 | + RESPONSE=$(curl -s "$URL" \ |
| 98 | + -H "Content-Type: application/json" \ |
| 99 | + -H "api-key: $AZURE_OPENAI_API_KEY" \ |
| 100 | + -d "$PAYLOAD") |
| 101 | + |
| 102 | + # Extract content |
| 103 | + CONTENT=$(echo "$RESPONSE" | jq -r '.choices[0].message.content // empty') |
| 104 | + |
| 105 | + if [ -z "$CONTENT" ]; then |
| 106 | + echo "::error::Failed to get AI review response" |
| 107 | + echo "$RESPONSE" | jq . |
| 108 | + exit 1 |
| 109 | + fi |
| 110 | + |
| 111 | + echo "=== AI Security Review Result ===" |
| 112 | + echo "$CONTENT" |
| 113 | + echo "=================================" |
| 114 | + |
| 115 | + # Parse JSON from response: strip markdown code blocks, then parse with jq |
| 116 | + CLEAN_CONTENT=$(echo "$CONTENT" | sed '/^```/d') |
| 117 | + # Use 'if .passed then "true" else "false" end' to handle boolean false correctly |
| 118 | + PASSED=$(echo "$CLEAN_CONTENT" | jq -r 'if .passed == true then "true" elif .passed == false then "false" else "unknown" end' 2>/dev/null) |
| 119 | + |
| 120 | + if [ "$PASSED" = "false" ]; then |
| 121 | + echo "" |
| 122 | + echo "::error::AI Security Review FAILED - security issues detected" |
| 123 | + echo "$CLEAN_CONTENT" | jq -r '.issues[]?' 2>/dev/null | while read -r issue; do |
| 124 | + echo "::warning::$issue" |
| 125 | + done |
| 126 | + exit 1 |
| 127 | + elif [ "$PASSED" = "true" ]; then |
| 128 | + echo "" |
| 129 | + echo "✅ AI Security Review PASSED - no security issues found" |
| 130 | + else |
| 131 | + echo "::warning::Could not parse AI review result, treating as FAIL for safety" |
| 132 | + exit 1 |
| 133 | + fi |
| 134 | +
|
| 135 | + - name: Skip notice |
| 136 | + if: steps.diff.outputs.skip == 'true' |
| 137 | + run: echo "✅ No code changes to review" |
0 commit comments