feat: add FIPS compatibility reusable workflow#4
Conversation
Add org-level reusable workflow for FIPS 140-2/140-3 compliance checking in Python projects. Features: - Configurable inputs (strict mode, test inclusion, Python version) - Static analysis for non-FIPS cryptographic usage - Dependency scanning for FIPS compatibility issues - PR comment integration with summary tables - Optional runtime FIPS testing - Comprehensive documentation and examples Also fixes python-reuse.yml to use latest fsfe/reuse-action v6.0.0 (updated from v4.0.0 with invalid commit hash). Files added: - .github/workflows/python-fips-compatibility.yml (reusable workflow) - workflow-templates/python-fips-compatibility.yml (usage template) - workflow-templates/python-fips-compatibility.properties.json (metadata) - docs/workflows/python-fips-compatibility.md (documentation) Files modified: - .github/workflows/python-reuse.yml (update to v6.0.0) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
WalkthroughAdds a reusable GitHub Actions workflow for Python FIPS 140-2/140-3 compatibility checking, documentation and template files, and updates a REUSE action version in an existing workflow. Changes
Sequence DiagramsequenceDiagram
participant GH as GitHub Actions
participant Runner as Hardened Runner
participant Checkout as Code Checkout
participant Tools as Tool Setup (UV, Python)
participant FIPS as FIPS Check Script
participant Reports as Report Generation
participant Artifacts as Artifact Upload
participant PR as PR Commenter
GH->>Runner: start job
Runner->>Checkout: checkout repository
Checkout-->>Runner: repo ready
Runner->>Tools: install UV, setup Python
Tools-->>Runner: tools ready
Runner->>FIPS: verify script exists
alt script present
Runner->>FIPS: run FIPS check with inputs
FIPS->>Reports: produce text + JSON reports
Reports->>Artifacts: upload reports/artifacts
Runner->>PR: create/update PR comment with summary
else script missing
FIPS-->>Runner: error -> fail job
end
alt enable-runtime-test == true
Runner->>FIPS: run runtime import simulation (hashlib tests)
FIPS-->>Runner: runtime test summary appended
end
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
🧰 Additional context used📓 Path-based instructions (1)**/*📄 CodeRabbit inference engine (.github/instructions/sonarqube_mcp.instructions.md)
Files:
🪛 LanguageTooldocs/workflows/python-fips-compatibility.md[uncategorized] ~25-~25: The official name of this software platform is spelled with a capital “H”. (GITHUB) [uncategorized] ~385-~385: The official name of this software platform is spelled with a capital “H”. (GITHUB) 🪛 markdownlint-cli2 (0.18.1)docs/workflows/python-fips-compatibility.md192-192: Fenced code blocks should have a language specified (MD040, fenced-code-language) 197-197: Fenced code blocks should have a language specified (MD040, fenced-code-language) Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/python-fips-compatibility.yml (1)
119-170: Verify JSON parsing robustness when report generation fails.The workflow attempts JSON report generation with
|| true(line 153) to suppress errors, but then parses the (potentially non-existent) file on line 159. If jq fails silently or the file is malformed, the summary extraction defaults to "0" values (lines 165-169). Confirm that this graceful degradation doesn't mask actual failures that should be reported.The current implementation is defensive, but consider whether silently defaulting to zero counts might hide scenarios where JSON generation partially failed. Would you like me to suggest enhanced error handling that logs warnings when JSON parsing is skipped?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
.github/workflows/python-fips-compatibility.yml(1 hunks).github/workflows/python-reuse.yml(1 hunks)docs/workflows/python-fips-compatibility.md(1 hunks)workflow-templates/python-fips-compatibility.properties.json(1 hunks)workflow-templates/python-fips-compatibility.yml(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.github/instructions/sonarqube_mcp.instructions.md)
After generating or modifying any code files, call the
analyze_file_listtool to analyze the files you created or modified
Files:
workflow-templates/python-fips-compatibility.properties.jsonworkflow-templates/python-fips-compatibility.ymldocs/workflows/python-fips-compatibility.md
🪛 LanguageTool
docs/workflows/python-fips-compatibility.md
[uncategorized] ~25-~25: The official name of this software platform is spelled with a capital “H”.
Context: ...# Basic Usage Add to your repository's .github/workflows/fips-compatibility.yml: ```...
(GITHUB)
[uncategorized] ~385-~385: The official name of this software platform is spelled with a capital “H”.
Context: ... 1. Submit issues to [ByronWilliamsCPA/.github](https://github.com/ByronWilliamsCPA/.g...
(GITHUB)
🪛 markdownlint-cli2 (0.18.1)
docs/workflows/python-fips-compatibility.md
192-192: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
197-197: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🔇 Additional comments (8)
workflow-templates/python-fips-compatibility.properties.json (1)
1-15: Metadata structure is well-formed.The template metadata is correctly structured for GitHub's workflow template discovery system. File patterns appropriately trigger on Python, configuration, and dependency files.
workflow-templates/python-fips-compatibility.yml (1)
16-66: Template configuration is sound and well-structured.The trigger conditions, input handling, and workflow job definition are correctly configured. Input mapping properly converts between naming conventions (underscores to hyphens), and conditional logic for
enable-runtime-testappropriately defaults to true for scheduled runs.docs/workflows/python-fips-compatibility.md (1)
1-390: Documentation is comprehensive and well-organized.The guide effectively covers workflow purpose, features, usage patterns, inputs, outputs, common issues with fixes, and integration guidance. The example FIPS checker script and troubleshooting section add significant value for downstream users.
.github/workflows/python-fips-compatibility.yml (4)
86-180: FIPS check job logic is sound with appropriate error handling.The workflow correctly verifies script existence before execution, gracefully degrades when the script is missing, and includes defensive fallbacks for JSON parsing (lines 165-169). Artifact uploads are conditional and properly configured with retention days.
182-268: PR commenting logic is well-implemented.The script effectively finds and updates existing bot comments to prevent spam, constructs clear status summaries with metrics, and provides actionable FIPS information in collapsed details. The status determination logic (PASSED/NEEDS REVIEW/FAILED based on errors/warnings) is appropriate.
269-318: Step summary provides clear status reporting.The summary correctly reflects the FIPS check outcome with conditional status messages based on errors/warnings counts, includes a metrics table, and provides helpful FIPS resources. The defensive check for missing script (line 275) prevents misleading summary output.
326-394: Runtime test job is appropriately scoped and documented.The optional FIPS runtime test simulates basic cryptographic operations (MD5 with
usedforsecurity, SHA-256) and correctly disclaims that it is not a true FIPS mode test (line 394 note). Condition onenable-runtime-testinput and dependency onfips-checkjob are properly configured..github/workflows/python-reuse.yml (1)
78-78: Commit hash for v6.0.0 is valid; however, document the breaking changes for downstream users.The commit hash
6ac5c823270d369f01e3c491c708f706f2bdc355correctly corresponds to fsfe/reuse-action v6.0.0. The upgrade from v4.0.0 to v6.0.0 introduces significant behavioral changes: reuse-tool v6 now reads entire files, detects file encodings, and surfaces invalid SPDX expressions. This may expose previously hidden metadata and require downstream repositories using this workflow to addREUSE-IgnoreStart/REUSE-IgnoreEndtags to avoid new false positives. Consider adding a comment in the workflow documenting these breaking changes for users.
| ``` | ||
| bcrypt==4.1.2 # ❌ Uses Blowfish (not FIPS-approved) | ||
| ``` | ||
|
|
||
| **Fix:** | ||
| ``` | ||
| argon2-cffi==23.1.0 # ✅ Argon2 can work in FIPS mode | ||
| # Or use passlib with bcrypt_sha256 for FIPS compliance | ||
| ``` |
There was a problem hiding this comment.
Add language specifications to code blocks.
Per markdown linting standards, fenced code blocks should specify a language. The "Problem:" and "Fix:" examples showing bcrypt==4.1.2 and argon2-cffi==23.1.0 should be marked as text or configuration format (e.g., ```text).
Apply this diff to add language specifications:
**Problem:**
-```
+```text
bcrypt==4.1.2 # ❌ Uses Blowfish (not FIPS-approved)Fix:
- +text
argon2-cffi==23.1.0 # ✅ Argon2 can work in FIPS mode
Or use passlib with bcrypt_sha256 for FIPS compliance
🧰 Tools
🪛 markdownlint-cli2 (0.18.1)
192-192: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
197-197: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
docs/workflows/python-fips-compatibility.md around lines 192 to 200: the fenced
code blocks showing the "Problem" and "Fix" examples lack language annotations;
update the opening fences to "```text" for both blocks (the bcrypt example and
the argon2/passlib example) so they conform to markdown linting standards and
render as plain text, keeping the existing content and closing fences unchanged.
Fix incorrect workflow path references and simplify boolean expressions: - Remove duplicate `.github/` in workflow uses paths - Correct workflow filename reference in trigger paths - Simplify boolean expressions (remove unnecessary == 'true' checks) Changes: - docs/workflows/python-fips-compatibility.md: Fix workflow path - workflow-templates/python-fips-compatibility.yml: Fix paths and booleans 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 (1M context) <noreply@anthropic.com>
## Changes ### python-sonarcloud.yml - Change default `extra-dependencies` from 'dev' to 'all' - Add support for 'all' keyword to use `--all-extras` flag - Fixes ModuleNotFoundError for optional dependencies like FastAPI ### python-performance-regression.yml - Fix NameError: move `regression_threshold` variable definition outside conditional block so it's always defined before use - Add auto-detection of benchmark script capabilities (--output, --warmup, --iterations flags) - Support minimal benchmark scripts that output JSON to stdout - Document expected benchmark script interface in workflow header ### python-compatibility.yml - Add `system-deps-ubuntu`, `system-deps-macos`, `system-deps-windows` inputs for installing system dependencies before tests - Enables cross-platform testing for packages that require system libraries (e.g., python-magic requires libmagic) - Document usage example in workflow header Resolves issues from rag-processor PR #4 CI failures. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
…11) ## Changes ### python-sonarcloud.yml - Change default `extra-dependencies` from 'dev' to 'all' - Add support for 'all' keyword to use `--all-extras` flag - Fixes ModuleNotFoundError for optional dependencies like FastAPI ### python-performance-regression.yml - Fix NameError: move `regression_threshold` variable definition outside conditional block so it's always defined before use - Add auto-detection of benchmark script capabilities (--output, --warmup, --iterations flags) - Support minimal benchmark scripts that output JSON to stdout - Document expected benchmark script interface in workflow header ### python-compatibility.yml - Add `system-deps-ubuntu`, `system-deps-macos`, `system-deps-windows` inputs for installing system dependencies before tests - Enables cross-platform testing for packages that require system libraries (e.g., python-magic requires libmagic) - Document usage example in workflow header Resolves issues from rag-processor PR #4 CI failures. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
1 participant
Summary
Add org-level reusable workflow for FIPS 140-2/140-3 compliance checking in Python projects, converted from the homelab-infra repository workflow.
Changes
New Features
Files Added
.github/workflows/python-fips-compatibility.yml- Reusable workflow definitionworkflow-templates/python-fips-compatibility.yml- Template for downstream reposworkflow-templates/python-fips-compatibility.properties.json- GitHub template metadatadocs/workflows/python-fips-compatibility.md- Complete documentationBug Fixes
fsfe/reuse-actionfrom v4.0.0 (invalid commit hash) to v6.0.0 (latest stable)Usage Example
Downstream repositories can now use:
Benefits
Test Plan
🤖 Generated with Claude Code
Summary by CodeRabbit
New Features
Documentation
Chores
✏️ Tip: You can customize this high-level summary in your review settings.