CI/CD & Security Scanning
Relevant source files
The following files were used as context for generating this wiki page:
CI/CD and Security Scanning in the Financial Asset Relationship Database project ensures code quality, architectural consistency, and vulnerability management. The system automates testing, linting, and security audits across Python and Frontend environments to maintain a "Project Health" score of 8.5/10.
The pipeline integrates static analysis tools like Codacy, Snyk, Bandit, and Safety into GitHub Actions workflows. This automation enforces engineering mandates, such as idempotency and resource safety, before code reaches production gates.
Sources: SUMMARY.md:5-7, AUDIT_REPORT.md:465-468, GEMINI.md:3-5
CI/CD Pipeline Architecture
The primary CI/CD pipeline, defined in .github/workflows/ci.yml, centralizes testing and security checks. It utilizes a matrix strategy to test across multiple Python versions (3.9 to 3.12) and employs caching to optimize build speeds.
The diagram shows the standard flow of the automated pipeline from code submission to final reporting.
Sources: SUMMARY.md:120-130, AUDIT_REPORT.md:175-185
Dependency Management
Automated scripts handle dependency installation to ensure consistency between local development and CI environments. The ci_install_python_deps.sh script installs both runtime and development requirements using pip.
- Runtime Dependencies: Defined in
requirements.txt. - Development Dependencies: Defined in
requirements-dev.txt, includingpytest,flake8,mypy, andblack.
Sources: scripts/ci_install_python_deps.sh:1-15, AUDIT_REPORT.md:162-171
Security Scanning Framework
The project employs a multi-layered security strategy to detect vulnerabilities in code and third-party dependencies.
| Tool | Focus Area | Description |
|---|---|---|
| Snyk | Dependency Vulnerabilities | Scans manifest files (requirements.txt) for known security flaws. |
| CodeQL | Semantic Code Analysis | Performs advanced security scanning for injection and logic flaws. |
| Bandit | Python Static Analysis | Checks Python code for common security issues (e.g., hardcoded passwords). |
| Safety | Dependency Audit | Checks installed dependencies against a database of known vulnerabilities. |
| Dependency Review | Pull Requests | Analyzes dependency changes in PRs before merging. |
Sources: AUDIT_REPORT.md:405-415, .github/instructions/snyk_rules.instructions.md:1-10, SUMMARY.md:204-210
Static Analysis Rules
The project enforces strict coding standards via Codacy and specialized instruction files.
- Codacy Integration: Automates code review by checking for complexity, style, and security patterns. It specifically targets the avoidance of
eval()orexec()calls. - Snyk Policies: Prioritizes "Critical" and "High" severity issues. If a vulnerability has an available fix, the pipeline flags it for immediate remediation.
Sources: .cursor/rules/codacy.mdc:1-15, .github/instructions/snyk_rules.instructions.md:12-25, AUDIT_REPORT.md:200-203
Quality Control and Linting
The pipeline executes a suite of linting tools to maintain code consistency. All configuration for these tools is centralized in pyproject.toml and .flake8.
The diagram represents the quality gates that Python code must pass before testing begins.
Sources: SUMMARY.md:105-115, AUDIT_REPORT.md:144-159
Linting Constraints
- Line Length: Max 120 characters for Python files.
- Complexity: Max Cyclomatic complexity of 15.
- Type Safety:
mypychecks untyped definitions and warns on return values. - Formatting:
blackenforces a consistent coding style.
Sources: SUMMARY.md:106-112, AUDIT_REPORT.md:150-155
Production Gates and Promotion
Code must satisfy "Enterprise Readiness" mandates before promotion. This includes durable persistence checks and API contract normalization.
- PR Triage: Every PR must describe Upstream Source, Downstream Impact, and Failure Mode.
- Commit Tag Halts: Pipelines pause if tags like
[manual-stop]are detected, requiring manual sign-off in an ephemeral environment. - Durable Persistence: Promotion to staging/production requires passing durable graph-persistence smoke procedures.
Sources: GEMINI.md:7-14, GEMINI.md:18-21, GEMINI.md:43-46
Summary
The CI/CD and Security Scanning infrastructure transforms a manual development process into an automated, high-integrity pipeline. By consolidating 26 disparate workflows into three core pipelines—Main CI, CodeQL, and Dependency Review—the project reduces resource waste while significantly increasing test coverage and security posture. The enforcement of architectural invariants through these automated gates ensures the system remains robust and production-ready.
Sources: AUDIT_REPORT.md:464-475, SUMMARY.md:15-25