GitHub Actions: Prisma AIRS Model Security

#!/bin/bash
#
# Model Security Private PyPI Authentication Script
# Authenticates with SCM and retrieves PyPI repository URL
#

set -euo pipefail

# Check required environment variables
: "${MODEL_SECURITY_CLIENT_ID:?Error: MODEL_SECURITY_CLIENT_ID not set}"
: "${MODEL_SECURITY_CLIENT_SECRET:?Error: MODEL_SECURITY_CLIENT_SECRET not set}"
: "${TSG_ID:?Error: TSG_ID not set}"

# Set default endpoints
API_ENDPOINT="${MODEL_SECURITY_API_ENDPOINT:-https://api.sase.paloaltonetworks.com/aims}"
TOKEN_ENDPOINT="${MODEL_SECURITY_TOKEN_ENDPOINT:-https://auth.apps.paloaltonetworks.com/oauth2/access_token}"

# Get SCM access token via OAuth2 client credentials
TOKEN_RESPONSE=$(curl -sf -X POST "$TOKEN_ENDPOINT" \
    -H "Content-Type: application/x-www-form-urlencoded" \
    -u "$MODEL_SECURITY_CLIENT_ID:$MODEL_SECURITY_CLIENT_SECRET" \
    -d "grant_type=client_credentials&scope=tsg_id:$TSG_ID") || {
    echo "Error: Failed to obtain SCM access token" >&2
    exit 1
}

SCM_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.access_token')
if [[ -z "$SCM_TOKEN" || "$SCM_TOKEN" == "null" ]]; then
    echo "Error: Failed to extract access token from response" >&2
    exit 1
fi

# Use access token to retrieve private PyPI URL
PYPI_RESPONSE=$(curl -sf -X GET "$API_ENDPOINT/mgmt/v1/pypi/authenticate" \
    -H "Authorization: Bearer $SCM_TOKEN") || {
    echo "Error: Failed to retrieve PyPI URL" >&2
    exit 1
}

PYPI_URL=$(echo "$PYPI_RESPONSE" | jq -r '.url')
if [[ -z "$PYPI_URL" || "$PYPI_URL" == "null" ]]; then
    echo "Error: Failed to extract PyPI URL from response" >&2
    exit 1
fi

echo "$PYPI_URL"

chmod +x scripts/get_pypi_url.sh

#!/usr/bin/env python3
"""
Prisma AIRS Model Security Scanner

Scans an AI model against Palo Alto Prisma AIRS security policies
using the official Model Security SDK. Exits non-zero if the model
fails the security assessment, blocking the CI/CD pipeline.
"""

import argparse
import os
import sys

import yaml
from dotenv import load_dotenv
from model_security_client.api import ModelSecurityAPIClient

load_dotenv()


def print_scan_results(result, model_name):
    """Pretty-print the scan results for CI log visibility."""
    print()
    print("=" * 64)
    print("  PRISMA AIRS MODEL SECURITY SCAN RESULTS")
    print("=" * 64)
    print(f"  Model:        {model_name}")
    print(f"  Scan UUID:    {getattr(result, 'uuid', 'N/A')}")
    print(f"  Outcome:      {result.eval_outcome}")
    print(f"  Summary:      {getattr(result, 'eval_summary', 'N/A')}")
    print(f"  Sec. Group:   {getattr(result, 'security_group_name', 'N/A')}")
    print(f"  Rules:        {getattr(result, 'enabled_rule_count_snapshot', 'N/A')}")
    print(f"  Files Scanned:{getattr(result, 'total_files_scanned', 'N/A')}")
    print(f"  Files Skipped:{getattr(result, 'total_files_skipped', 'N/A')}")

    violations = (
        getattr(result, 'rule_violations', None)
        or getattr(result, 'findings', [])
    )
    if violations:
        print(f"  Violations:   {len(violations)}")
        for v in violations:
            severity = getattr(v, 'severity', getattr(v, 'level', 'unknown'))
            desc = getattr(v, 'description', getattr(v, 'rule_name', 'No description'))
            print(f"    [{str(severity).upper()}] {desc}")

    print("=" * 64)
    print()


def main():
    parser = argparse.ArgumentParser(
        description="Scan an AI model with Prisma AIRS Model Security"
    )
    parser.add_argument(
        "--config", required=True,
        help="Path to the model configuration YAML file",
    )
    args = parser.parse_args()

    with open(args.config) as f:
        config = yaml.safe_load(f)

    if not config.get("security", {}).get("scan_enabled", True):
        print("Security scan is disabled in model config. Skipping.")
        sys.exit(0)

    # Allow overriding security_profile_id from environment variable
    profile_id = os.environ.get("MODEL_SECURITY_PROFILE_ID")
    if profile_id:
        config.setdefault("security", {})["security_profile_id"] = profile_id

    security_group_uuid = config["security"]["security_profile_id"]
    if not security_group_uuid:
        print("ERROR: No security_profile_id configured.")
        sys.exit(1)

    model_name = config["model"]["huggingface_id"]
    model_uri = f"https://huggingface.co/{model_name}"
    api_endpoint = os.environ.get(
        "MODEL_SECURITY_API_ENDPOINT",
        "https://api.sase.paloaltonetworks.com/aims",
    )

    print("Initializing Prisma AIRS Model Security SDK...")
    client = ModelSecurityAPIClient(base_url=api_endpoint)

    labels = {
        "deployment_target": "vertex_ai",
        "machine_type": config["deployment"]["machine_type"],
        "version": config["model"].get("version", "unknown").replace(".", "-"),
        "pipeline": "github-actions",
    }

    print(f"Scanning model: {model_name}")
    print(f"  URI: {model_uri}")
    print(f"  Security Group: {security_group_uuid}")
    print(f"  Labels: {labels}")

    result = client.scan(
        security_group_uuid=security_group_uuid,
        model_uri=model_uri,
        labels=labels,
    )

    print_scan_results(result, model_name)

    outcome = str(result.eval_outcome)
    if "BLOCKED" in outcome:
        print("BLOCKED: Model blocked by Prisma AIRS security policy.")
        print("The model will NOT be deployed.")
        sys.exit(1)
    elif "ALLOWED" in outcome:
        print("ALLOWED: Model approved by Prisma AIRS security policy.")
        print("The model is cleared for deployment.")
    else:
        print(f"WARNING: Unexpected scan outcome '{outcome}'. Blocking deployment.")
        sys.exit(1)


if __name__ == "__main__":
    main()

name: Model Security Scan & Deploy

on:
  push:
    branches: [main]
    paths:
      - 'config/model-config.yaml'
  pull_request:
    branches: [main]
    paths:
      - 'config/model-config.yaml'
  workflow_dispatch:

jobs:

  # Detect whether the model config file changed
  detect-changes:
    name: Detect Model Changes
    runs-on: ubuntu-latest
    outputs:
      model_changed: ${{ steps.filter.outputs.model }}
    steps:
      - uses: actions/checkout@v4

      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            model:
              - 'config/model-config.yaml'

  # ── Prisma AIRS Model Security Scan ──────────────────────────
  # This job authenticates with Prisma AIRS via OAuth2,
  # installs the Model Security SDK from a private PyPI,
  # and scans the model. BLOCKED = pipeline failure.
  security-scan:
    name: Prisma AIRS Model Security Scan
    needs: detect-changes
    if: >
      needs.detect-changes.outputs.model_changed == 'true'
      || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # Authenticate and get private PyPI URL
      - name: Get Model Security SDK PyPI URL
        id: pypi
        env:
          MODEL_SECURITY_CLIENT_ID: ${{ secrets.MODEL_SECURITY_CLIENT_ID }}
          MODEL_SECURITY_CLIENT_SECRET: ${{ secrets.MODEL_SECURITY_CLIENT_SECRET }}
          MODEL_SECURITY_API_ENDPOINT: ${{ secrets.MODEL_SECURITY_API_ENDPOINT }}
          TSG_ID: ${{ secrets.TSG_ID }}
        run: echo "url=$(bash scripts/get_pypi_url.sh)" >> "$GITHUB_OUTPUT"

      # Install SDK from private PyPI
      - name: Install dependencies
        run: |
          pip install -r requirements.txt
          pip install "model-security-client[all]" \
            --extra-index-url "${{ steps.pypi.outputs.url }}"

      # Run the scan — exits non-zero on BLOCKED
      - name: Run Prisma AIRS Model Security Scan
        env:
          MODEL_SECURITY_CLIENT_ID: ${{ secrets.MODEL_SECURITY_CLIENT_ID }}
          MODEL_SECURITY_CLIENT_SECRET: ${{ secrets.MODEL_SECURITY_CLIENT_SECRET }}
          MODEL_SECURITY_API_ENDPOINT: ${{ secrets.MODEL_SECURITY_API_ENDPOINT }}
          MODEL_SECURITY_PROFILE_ID: ${{ secrets.MODEL_SECURITY_PROFILE_ID }}
          TSG_ID: ${{ secrets.TSG_ID }}
        run: python scripts/scan_model.py --config config/model-config.yaml

  # ── Deploy (replace with your infrastructure) ────────────────
  deploy-model:
    name: Deploy Model
    needs: security-scan
    if: >
      (github.event_name == 'push' && github.ref == 'refs/heads/main')
      || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "Add your deployment logic here"

# Model Configuration
# Changing this file triggers the Prisma AIRS Model Security Scan pipeline.

model:
  huggingface_id: "google/gemma-3-1b-it"
  display_name: "gemma-3-1b-it"
  description: "Google Gemma 3 1B Instruction-Tuned model deployed via Vertex AI Model Garden"
  version: "2.1"

deployment:
  machine_type: "g2-standard-12"
  accelerator_type: "NVIDIA_L4"
  accelerator_count: 1
  region: "us-central1"

security:
  scan_enabled: true
  security_profile_id: ""  # Set via MODEL_SECURITY_PROFILE_ID env var or GitHub Variable

pyyaml>=6.0
python-dotenv>=1.0

labels = {
    "pipeline": "github-actions",
    "deployment_target": "vertex_ai",        # Replace with target platform
    "version": config["model"].get("version", "unknown").replace(".", "-"),
    "team": "ml-platform",                   # Optional: owning team
    "environment": "production",             # Optional: target environment
}

git add config/model-config.yaml
git commit -m "chore: bump model version to trigger security scan"
git push origin main

================================================================
  PRISMA AIRS MODEL SECURITY SCAN RESULTS
================================================================
  Model:        google/gemma-3-1b-it
  Scan UUID:    a1b2c3d4-e5f6-7890-abcd-ef1234567890
  Outcome:      EvalOutcome.ALLOWED
  Summary:      Model passed all security checks
  ...
================================================================

ALLOWED: Model approved by Prisma AIRS security policy.
The model is cleared for deployment.