fix: resolve critical security gaps (#206, #209, #211), add audit logging (#205) and request timeout (#190) #319
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI/CD Pipeline | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| NODE_VERSION: '18' | |
| jobs: | |
| # ─── Smart Contracts ───────────────────────────────────────────── | |
| contracts: | |
| name: Contracts | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: 1.85.0 | |
| - name: Build contracts | |
| continue-on-error: true | |
| run: cd contracts && cargo build --lib | |
| - name: Run contract tests | |
| continue-on-error: true | |
| run: cd contracts && cargo test | |
| - name: Run gas benchmarks | |
| run: cd contracts && cargo test bench_ -- --nocapture | |
| - name: Generate gas report artifact | |
| if: always() | |
| run: | | |
| echo "=== StarkEd Contracts Gas Report ===" > contracts/gas-report.txt | |
| echo "Generated: $(date -u)" >> contracts/gas-report.txt | |
| echo "Commit: ${{ github.sha }}" >> contracts/gas-report.txt | |
| cd contracts && cargo test bench_gas_report -- --nocapture 2>&1 | tee -a gas-report.txt | |
| continue-on-error: true | |
| - name: Upload gas report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: gas-report | |
| path: contracts/gas-report.txt | |
| continue-on-error: true | |
| # ─── Backend ───────────────────────────────────────────────────── | |
| backend: | |
| name: Backend | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:15 | |
| env: | |
| POSTGRES_PASSWORD: postgres | |
| POSTGRES_DB: starked_test | |
| options: >- | |
| --health-cmd pg_isready | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 5432:5432 | |
| redis: | |
| image: redis:7 | |
| options: >- | |
| --health-cmd "redis-cli ping" | |
| --health-interval 10s | |
| --health-timeout 5s | |
| --health-retries 5 | |
| ports: | |
| - 6379:6379 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js ${{ env.NODE_VERSION }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: backend/package-lock.json | |
| - name: Install dependencies | |
| uses: nick-fields/retry@v3 | |
| with: | |
| timeout_minutes: 5 | |
| max_attempts: 2 | |
| retry_on: error | |
| command: cd backend && npm ci | |
| - name: Type check | |
| run: cd backend && npm run typecheck | |
| - name: Lint | |
| continue-on-error: true | |
| run: cd backend && npm run lint | |
| - name: Test | |
| timeout-minutes: 10 | |
| run: cd backend && npm run test:ci | |
| env: | |
| DATABASE_URL: postgresql://postgres:postgres@localhost:5432/starked_test | |
| REDIS_URL: redis://localhost:6379 | |
| JWT_SECRET: test_secret | |
| - name: Build | |
| run: cd backend && npm run build | |
| # ─── Frontend ──────────────────────────────────────────────────── | |
| frontend: | |
| name: Frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js ${{ env.NODE_VERSION }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| uses: nick-fields/retry@v3 | |
| with: | |
| timeout_minutes: 5 | |
| max_attempts: 2 | |
| retry_on: error | |
| command: cd frontend && npm ci | |
| - name: Type check | |
| continue-on-error: true | |
| run: cd frontend && npm run type-check | |
| - name: Lint | |
| continue-on-error: true | |
| run: cd frontend && npm run lint | |
| - name: Test | |
| timeout-minutes: 10 | |
| run: cd frontend && npm run test:ci | |
| - name: Build | |
| timeout-minutes: 15 | |
| run: cd frontend && NODE_OPTIONS="--max-old-space-size=4096" npm run build | |
| # ─── Dependency Audit ──────────────────────────────────────────── | |
| dependency-audit: | |
| name: Dependency Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js ${{ env.NODE_VERSION }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ env.NODE_VERSION }} | |
| cache: 'npm' | |
| - name: Audit backend dependencies (high/critical) | |
| continue-on-error: true | |
| run: cd backend && npm audit --audit-level=high | |
| - name: Audit frontend dependencies (high/critical) | |
| continue-on-error: true | |
| run: cd frontend && npm audit --audit-level=high | |
| # ─── Cargo Audit (contracts) ───────────────────────────────────── | |
| cargo-audit: | |
| name: Cargo Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: 1.85.0 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --version 0.21.1 --locked | |
| - name: Audit contract dependencies | |
| continue-on-error: true | |
| run: cd contracts && cargo audit | |
| # ─── Gas Comparison (PR vs main) ───────────────────────────────── | |
| gas-comparison: | |
| name: Gas Comparison | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.base.sha }} | |
| path: base | |
| - uses: actions/checkout@v4 | |
| with: | |
| path: pr | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Run benchmarks on base (main) | |
| run: | | |
| cd base/contracts | |
| cargo test bench_ -- --nocapture 2>&1 | tee ../base-gas.txt | |
| continue-on-error: true | |
| - name: Run benchmarks on PR | |
| run: | | |
| cd pr/contracts | |
| cargo test bench_ -- --nocapture 2>&1 | tee ../pr-gas.txt | |
| continue-on-error: true | |
| - name: Compare gas reports | |
| run: | | |
| echo "### Gas Comparison Report" >> $GITHUB_STEP_SUMMARY | |
| echo "| Operation | Base (main) | PR | Change |" >> $GITHUB_STEP_SUMMARY | |
| echo "|-----------|-------------|-----|--------|" >> $GITHUB_STEP_SUMMARY | |
| echo "| (see artifacts) | - | - | - |" >> $GITHUB_STEP_SUMMARY | |
| continue-on-error: true | |
| - name: Upload base gas report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: gas-report-base | |
| path: base/contracts/base-gas.txt | |
| continue-on-error: true | |
| - name: Upload PR gas report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: gas-report-pr | |
| path: pr/contracts/pr-gas.txt | |
| continue-on-error: true | |
| # ─── Security Scan ─────────────────────────────────────────────── | |
| security-scan: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scan | |
| uses: aquasecurity/trivy-action@master | |
| continue-on-error: true | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| ignore-unfixed: true | |
| - name: Upload scan results | |
| # Only upload SARIF on push so code-scanning results | |
| # do not block pull requests with pre-existing deps. | |
| if: always() && github.event_name == 'push' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' |