Cyber Security Update Workflows (CRA)

.github/workflows/codeql.yml

@@ -0,0 +1,25 @@
+---
+name: CodeQL Code Scan
+
+on:
+  push:
+    branches: ["main"]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+
+jobs:
+  codeql:
+    uses: mundialis/github-workflows/.github/workflows/codeql.yml@main
+    # the workflow requires permissions that need to be granted by the parent job:
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+

.github/workflows/flake8.yml

@@ -4,6 +4,9 @@ on:
 - push
 - pull_request
 
+permissions:
+  contents: read
+
 jobs:
 
   flake8-actinia:

.github/workflows/python-publish.yml

@@ -5,6 +5,10 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
 
   publish-python-test-pypi:

.github/workflows/sbom-vulnerability-scan.yml

@@ -0,0 +1,21 @@
+---
+name: SBOM Vulnerability Scan
+
+on:
+  push:
+    branches: ["main"]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+  release:
+    types: [published]
+
+jobs:
+  sbom-scan:
+    permissions:
+      contents: read
+      security-events: write
+
+    uses: mundialis/github-workflows/.github/workflows/sbom-vulnerability-scan.yml@main
+    with:
+      pyproject: pyproject.toml 

.github/workflows/third-party-licenses.yml

@@ -0,0 +1,14 @@
+---
+name: Generate Third-Party Licenses
+
+on:
+  release:
+    types: [published]
+
+permissions: { }
+
+jobs:
+  generate-third-party-licenses:
+    uses: mundialis/github-workflows/.github/workflows/third-party-licenses.yml@main
+    with:
+      pyproject: pyproject.toml