Security #25
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| - cron: "0 13 * * 1" | |
| workflow_dispatch: | |
| concurrency: | |
| group: security-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| cargo-audit: | |
| name: cargo-audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| - uses: rustsec/audit-check@v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| cargo-deny: | |
| name: cargo-deny | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| arguments: --all-features | |
| osv-scan: | |
| name: osv-scanner | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: google/osv-scanner-action/osv-scanner-action@v2.0.0 | |
| with: | |
| scan-args: | | |
| --recursive | |
| --skip-git | |
| ./ | |
| trivy-fs: | |
| name: trivy-filesystem | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: fs | |
| severity: HIGH,CRITICAL | |
| exit-code: "1" | |
| ignore-unfixed: true | |
| semgrep: | |
| name: semgrep | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| # Fail the job on Semgrep findings (`--error`) while still emitting SARIF | |
| # for the Security tab (upload step uses `if: always()`). | |
| - name: Install Semgrep and scan | |
| id: scan | |
| run: | | |
| python3 -m pip install --upgrade pip | |
| pip install "semgrep>=1.75.0" | |
| set +e | |
| semgrep scan --config auto --sarif --output semgrep.sarif --error | |
| code=$? | |
| if [ -f semgrep.sarif ]; then | |
| echo "have_sarif=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "have_sarif=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| exit "$code" | |
| # Mandatory alternate signal for GitHub code scanning (Security → Code scanning alerts). | |
| # Fork PRs and orgs without code scanning may deny upload; never fail the job on upload alone. | |
| - name: Upload Semgrep SARIF | |
| if: always() && steps.scan.outputs.have_sarif == 'true' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| continue-on-error: true | |
| with: | |
| sarif_file: semgrep.sarif |