Include SAST and SCA

.github/dependabot.yml

@@ -0,0 +1,26 @@
+version: 2
+
+updates:
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:00"
+      timezone: America/Vancouver
+    groups:
+      python-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "09:15"
+      timezone: America/Vancouver
+    groups:
+      github-actions:
+        patterns:
+          - "*"

.github/workflows/alembic.yml

@@ -1,6 +1,9 @@
 name: Alembic Upgrade Head
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   alembic_upgrade_head:
     runs-on: ubuntu-latest

.github/workflows/pytest_unit.yml

@@ -1,6 +1,9 @@
 name: Unit Tests
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   unit_tests:
     runs-on: ubuntu-latest

.github/workflows/ruff.yml

@@ -1,5 +1,9 @@
 name: Ruff
 on: pull_request
+
+permissions:
+  contents: read
+
 jobs:
   ruff:
     runs-on: ubuntu-latest

.github/workflows/security.yml

@@ -0,0 +1,112 @@
+name: Security
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  OPENGREP_VERSION: v1.27.1
+  TRIVY_VERSION: v0.74.0
+
+jobs:
+  sast:
+    name: Opengrep SAST
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Opengrep
+        run: |
+          curl --fail --location --silent --show-error \
+            "https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_manylinux_x86" \
+            --output "$RUNNER_TEMP/opengrep"
+          chmod 0555 "$RUNNER_TEMP/opengrep"
+          "$RUNNER_TEMP/opengrep" --version
+
+      - name: Scan source code
+        run: |
+          mkdir -p reports
+          "$RUNNER_TEMP/opengrep" scan \
+            --config auto \
+            --no-rewrite-rule-ids \
+            --disable-version-check \
+            --error \
+            --sarif-output=reports/opengrep.sarif \
+            src/
+
+      - name: Upload Opengrep report
+        if: always()
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: opengrep-sarif
+          path: reports/opengrep.sarif
+          if-no-files-found: error
+          retention-days: 14
+
+  sca:
+    name: Trivy SCA
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install Trivy
+        uses: aquasecurity/setup-trivy@v0.3.1
+        with:
+          version: ${{ env.TRIVY_VERSION }}
+          cache: true
+
+      - name: Scan locked dependencies
+        run: |
+          mkdir -p reports
+
+          trivy fs \
+            --scanners vuln \
+            --include-dev-deps \
+            --format sarif \
+            --output reports/trivy.sarif \
+            uv.lock
+
+          trivy fs \
+            --scanners vuln \
+            --include-dev-deps \
+            --skip-db-update \
+            --format cyclonedx \
+            --output reports/sbom.cdx.json \
+            uv.lock
+
+          trivy fs \
+            --scanners vuln \
+            --include-dev-deps \
+            --skip-db-update \
+            --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            uv.lock
+
+      - name: Upload Trivy reports
+        if: always()
+        uses: actions/upload-artifact@v7.0.1
+        with:
+          name: trivy-reports
+          path: |
+            reports/trivy.sarif
+            reports/sbom.cdx.json
+          if-no-files-found: error
+          retention-days: 14

pyproject.toml

@@ -5,13 +5,12 @@ requires-python = "~=3.13.0"
 
 dependencies = [
     # major
-    "fastapi==0.135.4",
+    "fastapi==0.139.2",
     "gunicorn==25.3.0",
     "uvicorn[standard]==0.46.0",
     "sqlalchemy[asyncio]==2.0.49",
     "asyncpg==0.31.0",
     "alembic==1.18.4",
-    "google-api-python-client==2.194.0",
     # minor
     "xmltodict==0.13.0",
     "httpx==0.28.1",

src/translink/crud.py

@@ -359,9 +359,7 @@ async def get_or_fetch_realtime_feed(db_session: DBSession, client: AsyncClient)
 
         # Transaction lock, released on commit or rollback.
         # This prevents multiple requests from fetching the feed at the same time.
-        await db_session.execute(
-            sqlalchemy.text("SELECT pg_advisory_xact_lock(:lock_id)"), {"lock_id": REALTIME_CACHE_LOCK_ID}
-        )
+        await db_session.execute(sqlalchemy.select(sqlalchemy.func.pg_advisory_xact_lock(REALTIME_CACHE_LOCK_ID)))
         cached_feed = await db_session.scalar(
             sqlalchemy.select(TransLinkRealtimeCacheDB).where(TransLinkRealtimeCacheDB.id == REALTIME_CACHE_ID)
         )