Adds backend governance controls to reduce operational risk and make API behavior safer and more predictable. #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rust Security Audit | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - develop | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| jobs: | |
| security-audit: | |
| name: Cargo Audit & Clippy | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Run cargo-audit (detect vulnerable dependencies) | |
| run: cargo audit --deny warnings | |
| - name: Run cargo-clippy (linting) | |
| run: cargo clippy --all-targets --all-features -- -D warnings | |
| continue-on-error: true | |
| - name: Run cargo-deny (supply chain security) | |
| continue-on-error: true | |
| run: | | |
| cargo install cargo-deny | |
| cargo deny check advisories | |
| - name: Check for unsafe code | |
| run: | | |
| echo "🔍 Scanning for unsafe code blocks..." | |
| if grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"; then | |
| echo "⚠️ Unsafe code found in non-test code. Please review:" | |
| grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz" | |
| echo "" | |
| echo "✓ Verify these unsafe blocks are documented and necessary" | |
| else | |
| echo "✓ No unsafe code found in production code" | |
| fi | |
| - name: Comment PR with Security Results | |
| uses: actions/github-script@v7 | |
| if: always() && github.event_name == 'pull_request' | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: `## 🔒 Rust Security Audit Complete\n\n✓ Cargo audit completed\n✓ Clippy analysis completed\n\nPlease ensure all security recommendations are addressed before merging.` | |
| }); | |
| - name: Fail on audit violations | |
| if: failure() | |
| run: | | |
| echo "❌ Security audit detected issues" | |
| exit 1 |