Security & Supply Chain Automation
Relevant source files
The following files were used as context for generating this wiki page:
The Security & Supply Chain Automation system in flext-quality orchestrates tools and rules to protect the project's integrity. It integrates external security analyzers and internal validation logic to detect vulnerabilities, maintain dependency health, and enforce coding standards across the FLEXT ecosystem.
This system operates as a unified orchestration platform that executes security-focused "Quality Gates" during development and CI/CD workflows. It specifically targets security vulnerability detection, supply chain safety, and adherence to enterprise engineering standards.
Sources: README.md:21-25, AGENTS.md:12-15, examples/README.md:158-161
Automated Security Orchestration
The platform integrates multiple specialized security tools into a single command surface. The FlextQualityCli provides Check and Validate commands that execute a curated suite of analyzers.
Security Tool Integration
The system natively supports and orchestrates the following security and validation tools:
- Bandit: Scans for common security issues in Python code.
- Ruff: Performs fast linting and security-related code transformations.
- basedpyright: Provides static type checking to prevent type-related safety bugs.
- GitHub Actions: Automates quality gates in CI/CD pipelines to block insecure code from merging.
Sources: AGENTS.md:27-29, examples/README.md:38-41, pyproject.toml:57
Analysis Execution Flow
The following diagram illustrates how the CodeAnalyzer orchestrates a security-inclusive project assessment:
The CodeAnalyzer enables security vulnerability detection via the include_security flag during project analysis.
Sources: examples/basic/simple_analysis/README.md:43-46, examples/basic/simple_analysis/README.md:118-125
Supply Chain Hardening
The project enforces strict supply chain policies via pyproject.toml and automated rules to prevent dependency confusion and malicious updates.
Dependency Management
The system maintains a locked dependency tree using the following mechanisms:
- Pinning: Sensitive internal dependencies, such as
flext-apiandflext-core, use exact git commits or version tags. - Dev-Tool Isolation: Heavy development tools like
flext-infraare classified as development-only to minimize the production attack surface. - Governance Audits: Automated skills like
governance-auditverify that project dependencies align with the canonicalpyproject.toml.
Sources: pyproject.toml:29-33, config/rules/mod/sed.yaml:12-14, AGENTS.md:92
Supply Chain Security Rules
The project implements specific rules to prevent common supply chain attacks.
| Rule ID | Objective | Description |
|---|---|---|
security-triage | Vulnerability Response | Analyzes and prioritizes reported security issues in dependencies. |
governance-audit | Compliance | Verifies dependency versions against authorized project baselines. |
security--supply-chain | Supply Chain Protection | Detects attempts to add unauthorized external dependencies. |
Sources: AGENTS.md:103, .claude/rules/security--supply-chain.md
Rule-Based Validation Engine
The FlextQualityRulesEngine executes declarative security and quality checks defined in YAML. This engine allows for real-time validation of code and documentation against custom security patterns.
Validation Logic
The engine compiles regex patterns to find violations in files or strings. If a pattern matches, it assigns a severity level and designates a resolution action.
Issue Classification
Identified security and style issues are categorized by severity levels using a standardized model.
| Severity | Definition | Impact |
|---|---|---|
| Critical | Major Security Breach | Immediate fix required; blocks CI/CD landing. |
| High | Probable Vulnerability | High-priority fix for security vulnerabilities. |
| Medium | Dangerous Pattern | Potential risk that should be addressed in the next sprint. |
| Low | Surface Warning | Minor hardening or best-practice suggestion. |
Sources: src/flext_quality/_models/flextqualitymodels_part_01.py:101-112, src/flext_quality/_models/flextqualitymodels_part_01.py:339-354
Security Quality Gates
Quality gates are automated enforcement points that ensure code meets security standards before it is promoted.
CI/CD Enforcement
In GitHub workflows, the system runs flext-quality analyze with specific thresholds. If the project score falls below the minimum (e.g., 85.0) or security issues are detected, the pipeline fails.
# Automated Quality Gate Execution
- name: Run Quality Analysis
run: |
flext-quality analyze . \
--min-score 85.0 \
--max-complexity 10
Sources: examples/README.md:100-104, examples/README.md:158-160
Security Testing Standards
The test suite includes dedicated markers for security-related validation. The security marker distinguishes tests that specifically validate vulnerability detection accuracy and false positive rates.
Sources: tests/README.md:135, tests/README.md:161
Conclusion
Security & Supply Chain Automation in flext-quality provides a robust, multi-layered defense. By orchestrating established security tools, enforcing strict dependency governance, and applying a declarative rules engine, the system ensures that every contribution adheres to the project's high security and quality standards. This automation protects the FLEXT ecosystem from vulnerabilities while maintaining a zero-debt baseline for enterprise deployments.
Sources: README.md:21-25, AGENTS.md:92, examples/README.md:166-172