ci: Add back static analysis and checking Python deps for CVEs

Accidentally removed during: freedomofpress#3909
zenmonkeykstop · Feb 9, 2019 · 0832e29 · 0832e29
1 parent fddd021
commit 0832e29
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -112,6 +112,19 @@ jobs:
             cd journalist_gui
             xvfb-run -a pipenv run python3 test_gui.py
 
+  static-analysis-and-no-known-cves:
+    machine:
+      enabled: true
+    steps:
+      - checkout
+      - run:
+          name: Check Python dependencies for CVEs
+          command: make safety
+
+      - run:
+          name: Run static security testing on source code
+          command: make bandit
+
   staging-test-with-rebase:
     machine:
       enabled: true
@@ -149,6 +162,7 @@ workflows:
       - tests
       - admin-tests
       - updater-gui-tests
+      - static-analysis-and-no-known-cves
       - staging-test-with-rebase:
           requires:
             - lint