Repository navigation
chore(release): 0.21.0 #1629
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Audit | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| schedule: | |
| # Run security audit daily at 02:00 UTC | |
| - cron: '0 2 * * *' | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_TOOLCHAIN: stable | |
| jobs: | |
| security-audit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@v1 | |
| with: | |
| toolchain: ${{ env.CARGO_TOOLCHAIN }} | |
| - name: Cache Cargo build files | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit and cargo-deny | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-audit,cargo-deny | |
| - name: Audit dependencies for security vulnerabilities | |
| run: | | |
| echo "## Security Audit Report" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| # Run cargo audit and capture output | |
| echo "### Vulnerability Scan (cargo audit)" >> $GITHUB_STEP_SUMMARY | |
| if cargo audit --json > audit-results.json; then | |
| echo "✅ No security vulnerabilities found" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ Security vulnerabilities detected" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "```json" >> $GITHUB_STEP_SUMMARY | |
| cat audit-results.json >> $GITHUB_STEP_SUMMARY | |
| echo "```" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Check licenses and supply chain | |
| run: | | |
| echo "### Supply Chain Analysis (cargo deny)" >> $GITHUB_STEP_SUMMARY | |
| # Check licenses | |
| if cargo deny check licenses --log-level warn; then | |
| echo "✅ All licenses are approved" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ License issues detected" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| # Check for banned/duplicate dependencies | |
| if cargo deny check bans --log-level warn; then | |
| echo "✅ No banned or problematic dependencies" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ Dependency issues detected" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| # Check sources | |
| if cargo deny check sources --log-level warn; then | |
| echo "✅ All dependency sources are approved" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ Unapproved dependency sources detected" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Upload security report | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: security-audit-report | |
| path: | | |
| audit-results.json | |
| retention-days: 30 | |
| # Enhanced security check: fail on high/critical, warn on medium | |
| - name: Check for critical vulnerabilities | |
| run: | | |
| if [ -f audit-results.json ]; then | |
| # Count by severity level | |
| CRITICAL_COUNT=$(cat audit-results.json | jq '[.vulnerabilities[]? | select(.advisory.severity == "Critical")] | length' 2>/dev/null || echo "0") | |
| HIGH_COUNT=$(cat audit-results.json | jq '[.vulnerabilities[]? | select(.advisory.severity == "High")] | length' 2>/dev/null || echo "0") | |
| MEDIUM_COUNT=$(cat audit-results.json | jq '[.vulnerabilities[]? | select(.advisory.severity == "Medium")] | length' 2>/dev/null || echo "0") | |
| if [ "$CRITICAL_COUNT" -gt "0" ] || [ "$HIGH_COUNT" -gt "0" ]; then | |
| echo "❌ Found $CRITICAL_COUNT critical and $HIGH_COUNT high security vulnerabilities" | |
| echo "Please review and update vulnerable dependencies" | |
| exit 1 | |
| elif [ "$MEDIUM_COUNT" -gt "0" ]; then | |
| echo "⚠️ Found $MEDIUM_COUNT medium security vulnerabilities" | |
| echo "Recommendation: Review and update vulnerable dependencies soon" | |
| else | |
| echo "✅ No critical, high, or medium security vulnerabilities found" | |
| fi | |
| fi |