From 7d5e5b9aef1ad21c72bdb6b4696e2c8c50a6345b Mon Sep 17 00:00:00 2001 From: "Bryn M. Reeves" Date: Tue, 27 Oct 2026 18:41:04 +0000 Subject: [PATCH 1/2] tests: work around virt-tests AppArmor errors for BIOS guests Resolves: #1046 Signed-off-by: Bryn M. Reeves --- .github/workflows/snapm.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/snapm.yml b/.github/workflows/snapm.yml index 4357ca9e..2d3cec84 100644 --- a/.github/workflows/snapm.yml +++ b/.github/workflows/snapm.yml @@ -159,6 +159,12 @@ jobs: set -euo pipefail sudo apt-get update sudo apt-get install -y qemu-system-x86 qemu-utils seabios ovmf libvirt-daemon-system libvirt-clients libosinfo-bin virtinst wget expect + # Disable AppArmor security driver: Ubuntu 26.04 fails to load + # dynamically generated per-VM AppArmor profiles for QEMU when BIOS + # firmware is in use + if [[ "${{ matrix.firmware }}" == "bios" ]]; then + echo 'security_driver = "none"' | sudo tee -a /etc/libvirt/qemu.conf + fi sudo systemctl enable --now libvirtd # Ensure the default libvirt network is active sudo virsh net-start default || true From 051fea91d014afd1f10958bdce9b09339874d374 Mon Sep 17 00:00:00 2001 From: "Bryn M. Reeves" Date: Tue, 27 Oct 2026 22:32:37 +0000 Subject: [PATCH 2/2] tests: run semgrep and pip-audit from snapm.yaml Signed-off-by: Bryn M. Reeves --- .coderabbit.yaml | 4 +++- .github/workflows/snapm.yml | 8 ++++++++ 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/.coderabbit.yaml b/.coderabbit.yaml index 5e895d45..077ba808 100644 --- a/.coderabbit.yaml +++ b/.coderabbit.yaml @@ -87,7 +87,9 @@ reviews: - No secrets in logs; mask sensitive outputs - Least privilege: minimize GITHUB_TOKEN permissions - No pull_request_target with checkout of PR head - - SAST/SCA steps in pipeline + - SAST/SCA required: bandit, semgrep, pip-audit run on PR code paths + - Semgrep configs: p/owasp-top-ten, p/security-audit + - Report all dependency vulnerabilities, not just latest # ── Security scanners ──────────────────────────────────────── tools: diff --git a/.github/workflows/snapm.yml b/.github/workflows/snapm.yml index 2d3cec84..1f3bb9c1 100644 --- a/.github/workflows/snapm.yml +++ b/.github/workflows/snapm.yml @@ -92,6 +92,14 @@ jobs: - name: Check pylint run: > pylint --jobs 0 snapm + - name: Run semgrep SAST + run: > + pip install semgrep && + semgrep --config=p/owasp-top-ten --config=p/security-audit snapm + - name: Check dependencies for vulnerabilities + run: > + pip install pip-audit && + pip-audit --desc - name: Install Ubuntu stratisd deps env: DEBIAN_FRONTEND: noninteractive