Automate safety scan with project config

.circleci/config.yml

@@ -142,6 +142,38 @@ jobs:
             export PATH="$HOME/.local/bin:$PATH"
             PYTHONPATH="$CIRCLE_WORKING_DIRECTORY/src" python3 -m pytest --version
             echo "✅ Test framework ready"
+  # Safety scan job - security vulnerability scanning
+  safety-scan:
+    executor: python-simple
+    steps:
+      - checkout
+      - run:
+          name: Install Safety CLI
+          command: |
+            python3 -m pip install --upgrade pip
+            python3 -m pip install safety==3.2.8
+      - run:
+          name: Run Safety scan with constraints (fail on high/critical)
+          command: |
+            # Pre-configure safety to avoid interactive prompts
+            # Safety will use .safety-project.ini if it exists
+            if [ -f .safety-policy.yml ]; then
+              echo "✅ Using .safety-policy.yml for vulnerability control"
+            fi
+
+            # Run safety scan - will fail on high/critical vulnerabilities based on policy
+            safety scan --continue-on-error || {
+              EXIT_CODE=$?
+              if [ $EXIT_CODE -eq 64 ]; then
+                echo "❌ High/Critical vulnerabilities found - failing CI"
+                exit 1
+              elif [ $EXIT_CODE -ne 0 ]; then
+                echo "⚠️ Safety scan completed with warnings"
+              fi
+            }
+
+            echo "✅ Safety scan passed - no high/critical vulnerabilities"
+
   docker-build:
     docker:
       - image: cimg/base:stable
@@ -210,6 +242,9 @@ workflows:
       - code-quality:
           requires:
             - basic-setup
+      - safety-scan:
+          requires:
+            - basic-setup
       - unit-tests:
           requires:
             - basic-setup

.safety-policy.yml

@@ -0,0 +1,107 @@
+# Safety Policy Configuration for SAMO-DL
+# This policy controls how Safety CLI handles vulnerability scanning in CI/CD
+# Version: Safety v3.x compatible
+
+version: "3.0"
+
+# Project metadata
+project:
+  name: "SAMO-DL"
+  description: "Deep Learning project with security-first approach"
+
+# Scanning configuration
+scanning:
+  # Fail the scan based on vulnerability severity
+  # Exit code 64 is returned when vulnerabilities exceed threshold
+  fail_scan_with_exit_code: 64
+
+  # Severity levels to fail on (Safety v3 format)
+  # Options: critical, high, medium, low, unknown
+  fail_on_severity_levels:
+    - critical
+    - high
+
+  # Continue scanning even if vulnerabilities are found
+  # This ensures we get a complete report
+  continue_on_vulnerability_error: true
+
+# Vulnerability handling
+vulnerabilities:
+  # Ignore specific vulnerabilities by ID if needed
+  # Format: vulnerability ID with optional expiry date
+  ignore:
+    # Example (uncomment to use):
+    # - vulnerability_id: "51457"  # numpy vulnerability
+    #   reason: "False positive - not applicable to our use case"
+    #   expires: "2025-12-31"
+
+  # Ignore entire packages if needed (use with caution)
+  ignore_packages: []
+    # Example:
+    # - package_name: "some-package"
+    #   reason: "Development only dependency"
+
+# Environment-specific settings
+environments:
+  production:
+    # Stricter settings for production
+    fail_on_severity_levels:
+      - critical
+      - high
+    continue_on_vulnerability_error: false
+
+  development:
+    # More lenient for development
+    fail_on_severity_levels:
+      - critical
+    continue_on_vulnerability_error: true
+
+  ci:
+    # CI/CD specific settings (default)
+    fail_on_severity_levels:
+      - critical
+      - high
+    continue_on_vulnerability_error: true
+
+# Reporting configuration
+reporting:
+  # Output format for reports
+  format: "json"
+
+  # Include detailed information
+  detailed: true
+
+  # Show only vulnerabilities (hide safe packages)
+  only_vulnerabilities: false
+
+  # Include remediation advice
+  include_remediation: true
+
+# Auto-fix configuration (use with caution)
+auto_fix:
+  # Do not auto-fix in CI - require manual review
+  enabled: false
+
+  # If enabled, only fix these severity levels
+  fix_severity_levels:
+    - critical
+
+# Audit trail
+audit:
+  # Log all scans for compliance
+  enabled: true
+
+  # Include timestamp in reports
+  include_timestamp: true
+
+  # Include scanner version
+  include_scanner_version: true
+
+# Custom rules (optional)
+custom_rules: []
+  # Example:
+  # - rule_id: "CUSTOM-001"
+  #   description: "Ensure all ML packages are from trusted sources"
+  #   severity: "high"
+  #   pattern: "torch|tensorflow|transformers"
+  #   action: "warn"

.safety-project.ini

@@ -0,0 +1,40 @@
+# Safety Project Configuration
+# This file pre-configures Safety CLI to prevent interactive prompts in CI environments
+
+[project]
+# Project name - prevents the "Enter a name for this codebase" prompt
+name = samo-dl
+
+# Project ID - optional but helps with consistency
+id = samo-dl-project
+
+# Organization - optional
+organization = SAMO
+
+[scan]
+# Default scan targets
+targets = 
+    requirements.txt
+    dependencies/requirements.txt
+    dependencies/requirements-api.txt
+    dependencies/requirements-dev.txt
+    dependencies/requirements-ml.txt
+    dependencies/requirements_production.txt
+    dependencies/requirements_secure.txt
+    dependencies/requirements_unified.txt
+
+# Skip interactive prompts
+interactive = false
+
+# Continue on error to get full report
+continue_on_error = true
+
+[policy]
+# Reference to policy file for vulnerability severity control
+policy_file = .safety-policy.yml
+
+[output]
+# Output format for CI
+format = screen
+# Detailed output for debugging
+detailed = true