Feat/emergency sweep #146

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main, "feat/", "fix/"]
	pull_request:

	env:
	CARGO_TERM_COLOR: always

	jobs:
	# ── Smart contract ────────────────────────────────────────────────────────
	contract:
	name: Contract (Rust / Soroban)
	runs-on: ubuntu-latest
	env:
	RUSTFLAGS: "-D warnings"
	steps:
	- uses: actions/checkout@v4

	- uses: dtolnay/rust-toolchain@stable
	with:
	targets: wasm32-unknown-unknown
	components: rustfmt, clippy

	- uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}

	- run: cargo fmt --all -- --check
	- run: cargo clippy --target wasm32-unknown-unknown --release -- -D warnings
	- run: cargo test
	- run: cargo build --target wasm32-unknown-unknown --release

	- name: Record wasm SHA-256
	run: sha256sum target/wasm32-unknown-unknown/release/niffyinsure.wasm \| tee niffyinsure.wasm.sha256

	- name: Simulate wasm drift (staging acceptance test)
	run: \|
	ACTUAL=$(cat niffyinsure.wasm.sha256 \| awk '{print $1}')
	EXPECTED=$(jq -r '.contracts[0].expectedWasmHash' contracts/deployment-registry.json)
	# In CI the registry holds a placeholder; drift is detected when they differ.
	# In staging, set NIFFYINSURE_EXPECTED_WASM_HASH to a known-wrong value to
	# verify the alert path fires. Exit 0 here — alerting is runtime, not build-time.
	if [ "$EXPECTED" = "\${NIFFYINSURE_EXPECTED_WASM_HASH}" ]; then
	echo "Registry uses env placeholder — skipping drift comparison in CI"
	elif [ "$ACTUAL" != "$EXPECTED" ]; then
	echo "::warning::Wasm drift detected: expected=$EXPECTED actual=$ACTUAL"
	else
	echo "Wasm hash matches registry: $ACTUAL"
	fi

	- uses: actions/upload-artifact@v4
	with:
	name: niffyinsure-wasm-${{ github.sha }}
	path: \|
	target/wasm32-unknown-unknown/release/niffyinsure.wasm
	niffyinsure.wasm.sha256
	retention-days: 30

	# ── Backend ───────────────────────────────────────────────────────────────
	backend:
	name: Backend (Node / TypeScript)
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: backend

	services:
	redis:
	image: redis:7-alpine
	ports:
	- 6379:6379
	options: >-
	--health-cmd "redis-cli ping"
	--health-interval 5s
	--health-timeout 3s
	--health-retries 5
	--health-start-period 5s

	env:
	REDIS_HOST: 127.0.0.1
	REDIS_PORT: 6379
	NODE_ENV: test

	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22

	- run: npm install
	- run: npm run lint
	- run: npm run build
	- run: npm test

	# ── Dependency audit / supply-chain ─────────────────────────────────────
	# Policy: CRITICAL CVEs fail the build. HIGH CVEs produce a warning and
	# must be triaged within 7 days. Accepted risks require a signed-off entry
	# in docs/ops/audit-exceptions.md before the override label is applied.
	# Override process:
	# 1. Engineer opens a PR adding the CVE to audit-exceptions.md with
	# justification, mitigations, and a review-by date.
	# 2. A second engineer approves the PR.
	# 3. Add the GitHub label `audit-exception-approved` to the failing PR.
	# 4. Re-run this job — it will pass once the exception is documented.
	dependency-audit:
	name: Dependency Audit (npm / SBOM)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22

	- name: Audit backend dependencies
	working-directory: backend
	run: \|
	npm install --ignore-scripts
	# Fail on critical; warn on high (exit 0 so we can capture output)
	npm audit --audit-level=critical
	npm audit --audit-level=high \|\| echo "::warning::High-severity advisories found — triage within 7 days per audit policy"

	- name: Audit frontend dependencies
	working-directory: frontend
	run: \|
	npm ci --ignore-scripts
	npm audit --audit-level=critical
	npm audit --audit-level=high \|\| echo "::warning::High-severity advisories found — triage within 7 days per audit policy"

	- name: Generate SBOM (backend)
	working-directory: backend
	run: npx --yes @cyclonedx/cyclonedx-npm --output-format JSON --output-file ../sbom-backend.json

	- name: Generate SBOM (frontend)
	working-directory: frontend
	run: npx --yes @cyclonedx/cyclonedx-npm --output-format JSON --output-file ../sbom-frontend.json

	- uses: actions/upload-artifact@v4
	with:
	name: sbom-${{ github.sha }}
	path: \|
	sbom-backend.json
	sbom-frontend.json
	retention-days: 90

	# ── Frontend ──────────────────────────────────────────────────────────────
	frontend:
	name: Frontend (Next.js / TypeScript)
	runs-on: ubuntu-latest
	defaults:
	run:
	working-directory: frontend
	steps:
	- uses: actions/checkout@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: npm
	cache-dependency-path: frontend/package-lock.json

	- run: npm ci
	- run: npm run lint
	- run: npm run build
	- run: npm test

Navigation Menu

Uh oh!

Feat/emergency sweep #146

Workflow file

Feat/emergency sweep #146

Uh oh!

Workflow file for this run