mirror of
https://github.com/getnora-io/nora.git
synced 2026-04-12 09:10:32 +00:00
devitway
233b83f902
- gitleaks, cargo audit, trivy fs now block pipeline on findings - add smoke test (docker run + curl /health) in release workflow - deny.toml: add review date to RUSTSEC-2025-0119 ignore - remove unused validation functions (maven, npm, crate) - replace blanket #![allow(dead_code)] with targeted allows
88 lines
2.9 KiB
YAML
88 lines
2.9 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
jobs:
|
|
test:
|
|
name: Test
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Cache cargo
|
|
uses: Swatinem/rust-cache@v2
|
|
|
|
- name: Check formatting
|
|
run: cargo fmt --check
|
|
|
|
- name: Clippy
|
|
run: cargo clippy --package nora-registry -- -D warnings
|
|
|
|
- name: Run tests
|
|
run: cargo test --package nora-registry
|
|
|
|
security:
|
|
name: Security
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
security-events: write # for uploading SARIF to GitHub Security tab
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0 # full history required for gitleaks
|
|
|
|
- name: Install Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Cache cargo
|
|
uses: Swatinem/rust-cache@v2
|
|
|
|
# ── Secrets ────────────────────────────────────────────────────────────
|
|
- name: Gitleaks — scan for hardcoded secrets
|
|
run: |
|
|
curl -sL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz \
|
|
| tar xz -C /usr/local/bin gitleaks
|
|
gitleaks detect --source . --exit-code 1 --report-format sarif --report-path gitleaks.sarif
|
|
|
|
# ── CVE in Rust dependencies ────────────────────────────────────────────
|
|
- name: Install cargo-audit
|
|
run: cargo install cargo-audit --locked
|
|
|
|
- name: cargo audit — RustSec advisory database
|
|
run: cargo audit --ignore RUSTSEC-2025-0119 # known: number_prefix via indicatif
|
|
|
|
# ── Licenses, banned crates, supply chain policy ────────────────────────
|
|
- name: cargo deny — licenses and banned crates
|
|
uses: EmbarkStudios/cargo-deny-action@v2
|
|
with:
|
|
command: check
|
|
arguments: --all-features
|
|
|
|
# ── CVE scan of source tree and Cargo.lock ──────────────────────────────
|
|
- name: Trivy — filesystem scan (Cargo.lock + source)
|
|
if: always()
|
|
uses: aquasecurity/trivy-action@0.35.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
format: sarif
|
|
output: trivy-fs.sarif
|
|
severity: HIGH,CRITICAL
|
|
exit-code: 1 # block pipeline on HIGH/CRITICAL vulnerabilities
|
|
|
|
- name: Upload Trivy fs results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v4
|
|
if: always()
|
|
with:
|
|
sarif_file: trivy-fs.sarif
|
|
category: trivy-fs
|