Repository navigation
152 lines (124 loc) · 3.92 KB
/
Copy pathsecurity.yml
File metadata and controls
152 lines (124 loc) · 3.92 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
name: Security
on:
schedule:
- cron: '0 2 * * 1' # Weekly on Monday at 2 AM UTC
push:
branches: [master]
pull_request:
branches: [master]
workflow_dispatch:
jobs:
audit:
name: Security Audit
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Cache dependencies
uses: actions/cache@v5
with:
path: |
~/.cargo/registry
~/.cargo/git
target/
key: ubuntu-latest-cargo-${{ hashFiles('**/Cargo.lock') }}
- name: Install cargo-audit
run: cargo install cargo-audit
- name: Run security audit
run: cargo audit --json > audit-results.json || true
- name: Display audit results
run: |
if [ -f audit-results.json ]; then
echo "Security audit results:"
cat audit-results.json | jq -r '.vulnerabilities[] | "\(.advisory.id): \(.advisory.title) (\(.advisory.severity))"' || echo "No vulnerabilities found"
fi
- name: Upload audit results
uses: actions/upload-artifact@v6
if: always()
with:
name: security-audit-results
path: audit-results.json
dependency-check:
name: Dependency Check
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Cache dependencies
uses: actions/cache@v5
with:
path: |
~/.cargo/registry
~/.cargo/git
target/
key: ubuntu-latest-cargo-${{ hashFiles('**/Cargo.lock') }}
- name: Install cargo-deny
run: cargo install cargo-deny
- name: Create deny.toml if not exists
run: |
if [ ! -f deny.toml ]; then
cat > deny.toml << 'EOF'
[bans]
multiple-versions = "warn"
wildcards = "deny"
[licenses]
copyleft = "deny"
allow-osi-fsf-free = "neither"
default = "deny"
allow = [
"Apache-2.0",
"MIT",
"BSD-2-Clause",
"BSD-3-Clause",
"ISC",
"Unicode-DFS-2016",
]
[advisories]
vulnerability = "deny"
unmaintained = "warn"
yanked = "warn"
notice = "warn"
[sources]
unknown-registry = "warn"
unknown-git = "warn"
EOF
fi
- name: Run cargo deny
run: cargo deny check --hide-inclusion-graph
- name: Check for unused dependencies
run: |
# 0.9.2+ pulls cargo-platform 0.3.3 (MSRV 1.91); pin until toolchain bumps
cargo install cargo-machete --version 0.9.1 --locked
cargo machete --with-metadata || true
supply-chain:
name: Supply Chain Security
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Cache dependencies
uses: actions/cache@v5
with:
path: |
~/.cargo/registry
~/.cargo/git
target/
key: ubuntu-latest-cargo-${{ hashFiles('**/Cargo.lock') }}
- name: Check for suspicious dependencies
run: |
echo "Checking for suspicious dependencies..."
cargo tree --duplicates || true
echo "Checking for potential typosquatting..."
cargo tree --format "{p}" | grep -E "(reqwest|serde|tokio|clap)" | sort | uniq -c | sort -nr
- name: Verify Cargo.lock is valid
run: |
# Verify lockfile is consistent with Cargo.toml (not necessarily latest versions)
cargo check --locked --quiet
echo "Cargo.lock is valid and consistent with Cargo.toml"
- name: Check for overly broad feature flags
run: |
echo "Checking for overly broad feature flags..."
grep -n "features.*=.*\[.*\]" Cargo.toml || true