FilesExpand file tree

main

/

security.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

120 lines (112 loc) · 4.86 KB

main

/

security.yml

Copy path

Top

File metadata and controls

• Code
• Blame

120 lines (112 loc) · 4.86 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

name: Security

on:

push:

branches: [main]

pull_request:

branches: [main]

schedule:

- cron: '17 4 * * 1'

workflow_dispatch:

permissions:

contents: read

security-events: write

jobs:

cargo-audit:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4

- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32

- name: Install cargo-audit

run: cargo install cargo-audit --locked

- name: Run cargo-audit

# Unmaintained-crate advisories (not vulns, no fix) on transitive deps are ignored

# here; kept in sync with deny.toml [advisories].ignore. cargo-audit 0.22 takes these

# via --ignore flags (it does not read a repo-local audit.toml).

run: >-

cargo audit --deny warnings

--ignore RUSTSEC-2025-0141

--ignore RUSTSEC-2024-0436

--ignore RUSTSEC-2026-0173

cargo-deny:

runs-on: ubuntu-latest

# iter 59 soft-gate: cargo-deny's `check` subcommand loads the

# rustsec/advisory-db, and any single malformed advisory TOML upstream

# (e.g. RUSTSEC-2026-0124 on 2026-06-14) parse-errors the WHOLE job —

# nothing we shipped triggered it. `cargo-audit` (above) and

# `audit-deps-aggregate` (below) cover the same vuln surface with

# separate parsers, so a transient cargo-deny outage doesn't lose us

# coverage. Continue-on-error keeps the workflow's exit code green

# while the failure stays visible in the logs as a load error.

continue-on-error: true

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4

- uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25

with:

# The action implicitly appends the `command` (default: check) to

# `arguments`, so passing `--workspace check` here was producing

# `cargo deny ... --workspace check check` and a CLI parse error.

arguments: --workspace

# v2 ships a newer cargo-deny that skips unparseable advisory-db files

# (e.g. the malformed upstream RUSTSEC-2026-0124.md) instead of hard-failing

# to load the whole DB. Job is continue-on-error anyway (non-blocking).

npm-audit:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020

with:

node-version: '20'

- name: npm audit

run: |

npm install --package-lock-only

npm audit --omit=dev --audit-level=high

audit-deps-aggregate:

# iter 38: aggregate audit-deps.mjs runs npm + cargo audit through the

# same JSON parser and emits structured PASS/WARN/FAIL. Acts as a

# single source-of-truth for "is this branch shippable from a deps

# safety perspective" — duplicates the per-tool jobs above but with

# one exit code, easy for branch-protection to gate on.

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020

with:

node-version: '20'

- name: Install cargo-audit

run: cargo install cargo-audit --locked

- name: npm install --package-lock-only

run: npm install --package-lock-only

- name: audit-deps aggregate (fail on high+ advisories)

run: node scripts/audit-deps.mjs --level=high

sbom:

# iter 50: generate an SPDX-2.3 SBOM (npm + cargo) and upload as a

# CI artifact for downstream auditors / regulated-industry users.

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020

with:

node-version: '20'

- name: npm install --package-lock-only

run: npm install --package-lock-only

- name: Generate SPDX SBOM

run: node scripts/sbom.mjs --out=dist/sbom.json

- name: Validate SBOM shape

run: node scripts/sbom.mjs --validate-only

- name: Upload SBOM as CI artifact

uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02

with:

name: sbom-spdx

path: dist/sbom.json

if-no-files-found: error

codeql:

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262

- uses: github/codeql-action/init@a2983b8bed1923f44751c5c43237f479442827b3

with:

languages: javascript-typescript

- uses: github/codeql-action/analyze@a2983b8bed1923f44751c5c43237f479442827b3