engineering/unrhodecode
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Initial implementation of security scan for PRs

Browse source
This commit is contained in:
Andrii V 2026-01-15 16:48:04 +01:00
parent 511c54b606
commit 9ce6ca8fd8
13 changed files with 273 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

62
rhodecode/apps/repository/views/repo_pull_requests.py
View file

@ -450,6 +450,11 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
if ai_pr_state:
c.ai_code_review_state = ai_pr_state.get("review_state", None)
# Add security audit state
c.security_audit_state = None
if security_state := pull_request.security_audit_state:
c.security_audit_state = security_state
# inject latest version
latest_ver = PullRequest.get_pr_display_object(pull_request_latest, pull_request_latest)
c.versions = versions + [latest_ver]
@ -1274,6 +1279,35 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
auth_user=self._rhodecode_user,
settings=settings,
)
# Handle security audit if requested (EE only)
run_security_audit = _form.get("run_security_audit", False)
if run_security_audit:
try:
from rc_ee.lib.celerylib import tasks as ee_tasks
from rhodecode.lib.celerylib import run_task
import datetime
# Initialize security audit state
pull_request.security_audit_state = {
"status": "pending",
"started_at": datetime.datetime.utcnow().isoformat(),
"started_by": self._rhodecode_user.user_id,
}
# Trigger async security audit task
run_task(
ee_tasks.audit_pull_request_diff, pull_request.pull_request_id, self._rhodecode_user.user_id
)
log.debug(
"Security audit triggered for PR #%s by user %s",
pull_request.pull_request_id,
self._rhodecode_user.username,
)
except ImportError:
log.warning("EE security audit tasks not available, skipping")
Session().commit()
h.flash(_("Successfully opened new pull request"), category="success")
@ -1550,6 +1584,34 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
)
h.flash(msg, category="success")
channelstream.pr_update_channelstream_push(self.request, c.pr_broadcast_channel, self._rhodecode_user, msg)
# Re-run security audit if it was enabled for this PR
if pull_request.security_audit_state and pull_request.security_audit_state.get("status"):
try:
from rc_ee.lib.celerylib import tasks as ee_tasks
from rhodecode.lib.celerylib import run_task
import datetime
# Reset state to pending for re-scan
pull_request.security_audit_state = {
"status": "pending",
"started_at": datetime.datetime.utcnow().isoformat(),
"started_by": self._rhodecode_user.user_id,
}
Session().commit()
# Trigger async security audit task
run_task(
ee_tasks.audit_pull_request_diff, pull_request.pull_request_id, self._rhodecode_user.user_id
)
log.debug(
"Security audit re-triggered for PR #%s after update by user %s",
pull_request.pull_request_id,
self._rhodecode_user.username,
)
except ImportError:
log.warning("EE security audit tasks not available, skipping re-scan")
else:
msg = PullRequestModel.UPDATE_STATUS_MESSAGES[resp.reason]
warning_reasons = [