rust-security.yml

name: Rust Security Audit

on:
  pull_request:
    branches:
      - main
      - develop
  push:
    branches:
      - main
      - develop

jobs:
  security-audit:
    name: Cargo Audit & Clippy
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run cargo-audit (detect vulnerable dependencies)
        run: cargo audit --deny warnings

      - name: Run cargo-clippy (linting)
        run: cargo clippy --all-targets --all-features -- -D warnings
        continue-on-error: true

      - name: Run cargo-deny (supply chain security)
        continue-on-error: true
        run: |
          cargo install cargo-deny
          cargo deny check advisories

      - name: Check for unsafe code
        run: |
          echo "🔍 Scanning for unsafe code blocks..."
          if grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"; then
            echo "⚠️ Unsafe code found in non-test code. Please review:"
            grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"
            echo ""
            echo "✓ Verify these unsafe blocks are documented and necessary"
          else
            echo "✓ No unsafe code found in production code"
          fi

      - name: Comment PR with Security Results
        uses: actions/github-script@v7
        if: always() && github.event_name == 'pull_request'
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## 🔒 Rust Security Audit Complete\n\n✓ Cargo audit completed\n✓ Clippy analysis completed\n\nPlease ensure all security recommendations are addressed before merging.`
            });

      - name: Fail on audit violations
        if: failure()
        run: |
          echo "❌ Security audit detected issues"
          exit 1