snapif 0.1.2

Snapif scores one tool call and returns Auto, Review, or Escalate.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179

name: CI

on:
  pull_request:
  merge_group: {}
  workflow_dispatch: {}

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

permissions:
  contents: read

env:
  CARGO_INCREMENTAL: "0"
  RUSTFLAGS: "-D warnings"

jobs:
  stealth:
    name: Stealth
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Assert stealth surfaces
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash scripts/assert-stealth.sh snapif/snapif

  lint:
    name: Lint
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      CARGO_TARGET_DIR: target/ci-lint
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
        with:
          toolchain: "1.95"
          components: rustfmt, clippy
      - uses: taiki-e/install-action@9983c65e42da123ff25d1f78505eb6de315aa172 # v2
        with:
          tool: cargo-deny@0.20.2
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || github.event_name == 'workflow_dispatch' }}
      - run: cargo fmt --check
      - name: Full clippy
        if: >-
          github.event_name != 'pull_request' ||
          !startsWith(github.head_ref, 'release-please')
        run: |
          cargo clippy --locked --all-targets -- -D warnings
          cargo clippy --locked --all-targets --features http -- -D warnings
          cargo clippy --locked --all-targets --features cli -- -D warnings
          cargo clippy --locked --all-targets --features http,cli -- -D warnings
      - name: Rustdoc
        if: >-
          github.event_name != 'pull_request' ||
          !startsWith(github.head_ref, 'release-please')
        run: RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps
      - name: Release-please check
        if: >-
          github.event_name == 'pull_request' &&
          startsWith(github.head_ref, 'release-please')
        run: cargo check --locked --all-targets
      - run: cargo deny check
      - run: bash scripts/forbid-deps.sh
      - run: python3 scripts/test_workflow_triggers.py
      - run: python3 scripts/test_forbid_deps.py

  workflows:
    name: Workflows
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
      - uses: taiki-e/install-action@9983c65e42da123ff25d1f78505eb6de315aa172 # v2
        with:
          tool: zizmor@1.16.0
      - run: zizmor --min-severity=high .github/workflows

  test:
    name: Test
    runs-on: ubuntu-latest
    timeout-minutes: 15
    env:
      CARGO_TARGET_DIR: target/ci-test
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # master
        with:
          toolchain: "1.95"
      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
        with:
          save-if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository) || github.event_name == 'workflow_dispatch' }}
      - name: Unit and integration tests
        if: >-
          github.event_name != 'pull_request' ||
          !startsWith(github.head_ref, 'release-please')
        run: |
          cargo test --locked
          cargo test --locked --features http
          cargo test --locked --features cli
          cargo test --locked --features http,cli
      - name: Release-please check
        if: >-
          github.event_name == 'pull_request' &&
          startsWith(github.head_ref, 'release-please')
        run: cargo check --locked --all-targets

  gitleaks:
    name: Gitleaks
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
          fetch-depth: 0
      - name: Install gitleaks
        run: |
          set -euo pipefail
          curl -fsSL -o /tmp/gitleaks.tar.gz \
            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz
          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  /tmp/gitleaks.tar.gz" | sha256sum -c -
          tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
          /tmp/gitleaks version
      - run: /tmp/gitleaks detect --source . --exit-code 1 --no-banner

  ci:
    name: CI
    needs: [stealth, lint, workflows, test, gitleaks]
    if: always()
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2
        with:
          egress-policy: audit
      - name: All required jobs passed
        env:
          STEALTH: ${{ needs.stealth.result }}
          LINT: ${{ needs.lint.result }}
          WORKFLOWS: ${{ needs.workflows.result }}
          TEST: ${{ needs.test.result }}
          GITLEAKS: ${{ needs.gitleaks.result }}
        run: |
          test "$STEALTH" = success
          test "$LINT" = success
          test "$WORKFLOWS" = success
          test "$TEST" = success
          test "$GITLEAKS" = success