Skip to content
CI/CD Pipeline (PR Safe)

ci(docker): build images, enforce size budget, and scan final images with Trivy #32

Sign in to view logs

ci(docker): build images, enforce size budget, and scan final images with Trivy

ci(docker): build images, enforce size budget, and scan final images with Trivy #32

Workflow file for this run

.github/workflows/ci-pr.yml at 65f9b3a
name: CI/CD Pipeline (PR Safe)
# This workflow mirrors ci.yml but uses pull_request instead of
# pull_request_target so it works for fork PRs without requiring
# allow-unsafe-pr-checkout.
#
# The original ci.yml uses pull_request_target which blocks fork PR
# checkouts by default for security reasons.
#
# See: https://gh.io/securely-using-pull_request_target
on:
pull_request:
types: [opened, synchronize, reopened]
jobs:
build-contracts:
name: Build Smart Contracts
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Cache Cargo dependencies
uses: actions/cache@v4
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
contracts/target/
key: ${{ runner.os }}-cargo-${{ hashFiles('contracts/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo-
- name: Check formatting
run: |
cd contracts
cargo fmt --all -- --check
- name: Run Clippy
run: |
cd contracts
cargo clippy -- -D warnings
- name: Build contracts
run: |
cd contracts
cargo build --release
- name: Run contract tests
run: |
cd contracts
cargo test
build-backend:
name: Build Backend
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Verify lock file
run: |
if [ ! -f package-lock.json ]; then
echo "Error: root package-lock.json is missing. Run 'npm install --package-lock-only' in the project root"
exit 1
fi
- name: Install dependencies
run: |
npm config set fetch-retries 5
npm config set fetch-retry-mintimeout 20000
npm config set fetch-retry-maxtimeout 120000
npm ci -w backend
- name: Build backend
run: npm run build -w backend
build-frontend:
name: Build Frontend
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Verify lock file
run: |
if [ ! -f package-lock.json ]; then
echo "Error: root package-lock.json is missing. Run 'npm install --package-lock-only' in the project root"
exit 1
fi
- name: Install dependencies
run: |
npm config set fetch-retries 5
npm config set fetch-retry-mintimeout 20000
npm config set fetch-retry-maxtimeout 120000
npm ci -w frontend
- name: Build frontend
run: npm run build -w frontend
env:
NEXT_PUBLIC_STELLAR_RECEIVER_ADDRESS: ${{ secrets.NEXT_PUBLIC_STELLAR_RECEIVER_ADDRESS || 'GAAZI4TCR3TY5OJHCTJC2A4QSY6CJWJH5IAJTGKIN2ER7LBNVKOCCWNA' }}
security-scan:
name: Security Scan
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Install root dependencies (for audit)
run: npm ci --ignore-scripts
- name: npm audit (report only, non-blocking)
run: npm audit --audit-level=critical --workspaces --include-workspace-root || echo "npm audit found issues (non-blocking)"
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
with:
toolchain: stable
- name: Cache Cargo dependencies
uses: actions/cache@v4
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
key: ${{ runner.os }}-cargo-audit-${{ hashFiles('contracts/Cargo.lock') }}
restore-keys: |
${{ runner.os }}-cargo-audit-
- name: Install cargo-audit
run: |
if ! command -v cargo-audit &> /dev/null; then
cargo install --locked cargo-audit --version 0.21.2
fi
- name: cargo audit (Rust dependencies, non-blocking)
working-directory: contracts
run: cargo audit || echo "cargo audit found issues (non-blocking)"
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '.'
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy scan results
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: 'trivy-results.sarif'