https://github.com/stephrobert/test-sigstore
https://github.com/stephrobert/test-sigstore
Last synced: 3 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/stephrobert/test-sigstore
- Owner: stephrobert
- License: mit
- Created: 2025-12-29T17:30:47.000Z (6 months ago)
- Default Branch: main
- Last Pushed: 2025-12-29T22:15:21.000Z (6 months ago)
- Last Synced: 2026-01-02T01:10:32.939Z (5 months ago)
- Language: Dockerfile
- Size: 89.8 KB
- Stars: 1
- Watchers: 0
- Forks: 0
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
Awesome Lists containing this project
README
# Secure Python Pipeline
[](https://github.com/stephrobert/test-sigstore/actions/workflows/ci.yml)
[](https://scorecard.dev/viewer/?uri=github.com/stephrobert/test-sigstore)
[](https://github.com/stephrobert/test-sigstore/actions/workflows/verify-slsa.yml)
API Python de démonstration avec pipeline CI/CD hautement sécurisé.
## 🔒 Sécurité
Ce projet implémente les bonnes pratiques de supply chain security :
| Protection | Outil | Status |
|------------|-------|--------|
| Attestation SLSA L3 | GitHub Attestations | ✅ |
| Signature d'image | Cosign (Sigstore) | ✅ |
| SBOM | Syft (SPDX + CycloneDX) | ✅ |
| Scan vulnérabilités | Trivy, pip-audit | ✅ |
| Analyse statique | Bandit, Ruff | ✅ |
| Dépendances épinglées | Hash pinning | ✅ |
### Vérifier l'image
```bash
# Vérifier la signature Cosign
cosign verify \
--certificate-identity-regexp="https://github.com/VOTRE_USER/secure-python-pipeline" \
--certificate-oidc-issuer="https://token.actions.githubusercontent.com" \
ghcr.io/VOTRE_USER/secure-python-pipeline:latest
# Vérifier l'attestation SLSA
gh attestation verify oci://ghcr.io/VOTRE_USER/secure-python-pipeline:latest \
--owner VOTRE_USER
```
## 🚀 Démarrage rapide
### Prérequis
- Python 3.11+
- Docker 24+
### Installation locale
```bash
git clone
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
```
### Lancer l'application
```bash
uvicorn app.main:app --reload
```
L'API est disponible sur http://localhost:8000
### Avec Docker
```bash
docker pull ghcr.io/VOTRE_USER/secure-python-pipeline:latest
docker run -p 8000:8000 ghcr.io/VOTRE_USER/secure-python-pipeline:latest
```
## 📚 API
| Endpoint | Méthode | Description |
|----------|---------|-------------|
| `/` | GET | Message de bienvenue |
| `/health` | GET | Health check pour Kubernetes |
## 🧪 Tests
```bash
# Installer les dépendances de dev
pip install -r requirements-dev.txt
# Lancer les tests
pytest
# Linting
ruff check src/ tests/
# Analyse de sécurité
bandit -r src/
```
## 📝 Licence
[MIT](LICENSE)
## 🤝 Contribuer
Voir [CONTRIBUTING.md](CONTRIBUTING.md)
## 🔐 Signaler une vulnérabilité
Voir [SECURITY.md](SECURITY.md)