capsec/.github/workflows/ci.yml at 8c7539005353a5e8b28fd9f1418b936567db2f0e · auths-dev/capsec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  check:
    name: Check
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.94.0"
          components: clippy, rustfmt
      - run: cargo check --workspace

  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.94.0"
          components: rust-src
      - run: cargo test --workspace

  clippy:
    name: Clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.94.0"
          components: clippy
      - run: cargo clippy --workspace -- -D warnings

  fmt:
    name: Format
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.94.0"
          components: rustfmt
      - run: cargo fmt --check --all

  lean-proofs:
    name: Lean 4 Proofs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install elan
        run: |
          curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y --default-toolchain none
          echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
      - name: Regenerate Perm.lean from perms.toml
        run: python3 proofs/scripts/gen_perm.py
      - name: Build and verify proofs
        run: cd proofs && lake build

  deep-driver:
    name: Deep Analysis Driver (nightly)
    runs-on: ubuntu-latest
    # Only run when capsec-deep changes
    if: contains(github.event.pull_request.title, 'deep') || contains(join(github.event.commits.*.modified, ','), 'capsec-deep')
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustc-dev, llvm-tools
      - run: cd crates/capsec-deep && cargo build
      - run: cd crates/capsec-deep && CAPSEC_DEEP_DEBUG=1 cargo run -- --edition 2024 tests/fixtures/simple_fs.rs 2>&1 | grep "Found 1 findings"

  capsec-audit:
    name: Capability Audit
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: "1.94.0"
      - uses: bordumb/capsec-github-action@v1
        with:
          fail-on: high