1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# Security scanning for zakuro-ai/zc.
#
# Closes #44. Hardened per #99.
#
# Three lanes:
# - cargo-audit + cargo-deny — Rust advisory DB + licence/source policy.
# cargo-audit is a REQUIRED check: a new CVE
# in the dependency tree blocks merge. The
# cargo-deny sub-steps remain advisory.
# - gitleaks — secrets in history / working tree (advisory).
# - trivy fs — filesystem-level CVEs (catches Dockerfile
# base-image issues + lockfile vulns; advisory).
#
# To finish the rollout: add the `cargo-audit` job to branch-protection
# required checks (see the PR for the gh api command), then drop the
# remaining `continue-on-error` blocks lane-by-lane as each baseline is
# confirmed.
name: security
on:
# cargo-audit gates pull requests (blocking); gitleaks + trivy run
# alongside but stay advisory. Also runs post-merge on the trunk (master)
# and on release branches, plus a weekly cron, plus on demand.
push:
branches:
- master
- main
- 'release/**'
paths-ignore:
- "**.md"
- "docs/**"
pull_request:
paths-ignore:
- "**.md"
- "docs/**"
schedule:
# Weekly Monday 07:00 UTC re-scan against the latest advisory DBs so
# newly-disclosed CVEs are surfaced even on a quiet week.
- cron: "0 7 * * 1"
workflow_dispatch:
concurrency:
group: security-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ !startsWith(github.ref, 'refs/heads/master') && !startsWith(github.ref, 'refs/heads/main') && !startsWith(github.ref, 'refs/heads/release/') }}
jobs:
cargo-audit:
runs-on: cpu
timeout-minutes: 10
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Install Rust toolchain
uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
with:
toolchain: "stable"
- uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
# Pull prebuilt cargo-audit / cargo-deny binaries instead of
# `cargo install --locked` (which compiled both from source and was
# ~8 min of this job's runtime). taiki-e/install-action fetches
# pinned release binaries in seconds.
- name: Install cargo-audit + cargo-deny
uses: taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9 # v2
with:
tool: cargo-audit,cargo-deny
- name: cargo audit
run: cargo audit --ignore RUSTSEC-0000-0000
- name: cargo deny check advisories
run: cargo deny check advisories
continue-on-error: true
- name: cargo deny check bans + licenses + sources
run: cargo deny check bans licenses sources
continue-on-error: true
gitleaks:
runs-on: cpu
timeout-minutes: 10
continue-on-error: true
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
fetch-depth: 0
- name: gitleaks
uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
with:
args: detect --source . --report-format sarif --report-path gitleaks.sarif
continue-on-error: true
- name: Upload gitleaks SARIF
if: always()
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
with:
sarif_file: gitleaks.sarif
category: gitleaks
continue-on-error: true
trivy-fs:
runs-on: cpu
timeout-minutes: 10
continue-on-error: true
permissions:
contents: read
security-events: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Trivy filesystem scan
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
scan-type: fs
scan-ref: .
format: sarif
output: trivy.sarif
severity: CRITICAL,HIGH
ignore-unfixed: true
- name: Upload Trivy SARIF
if: always()
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
with:
sarif_file: trivy.sarif
category: trivy-fs
continue-on-error: true