[1153] Enforce secret redaction checks in logs produced by pipeline commands #44
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Audit | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| paths: | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - '.cargo/audit.toml' | |
| - 'deny.toml' | |
| - '.github/workflows/security-audit.yml' | |
| pull_request: | |
| branches: [ main ] | |
| paths: | |
| - 'Cargo.toml' | |
| - 'Cargo.lock' | |
| - '.cargo/audit.toml' | |
| - 'deny.toml' | |
| schedule: | |
| # Run security audit daily at 02:00 UTC | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| toolchain: stable | |
| - name: Cache dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| key: security-audit | |
| - name: Install cargo-deny | |
| run: cargo install --force cargo-deny --locked | |
| - name: Install cargo-audit | |
| run: cargo install --force cargo-audit --locked | |
| - name: Run cargo deny | |
| run: cargo deny check | |
| continue-on-error: false | |
| - name: Run cargo audit | |
| run: | | |
| # rust-cache can leave a non-empty advisory-db dir that cargo-audit | |
| # refuses to re-initialize ("Refusing to initialize the non-empty directory"). | |
| rm -rf "${CARGO_HOME:-$HOME/.cargo}/advisory-db" | |
| cargo audit | |
| continue-on-error: false | |
| - name: Check for outdated dependencies | |
| run: | | |
| cargo install --force cargo-outdated --locked | |
| cargo outdated --exit-code 1 --root-deps-only | |
| continue-on-error: true | |
| - name: Generate SBOM | |
| run: | | |
| mkdir -p security/sbom | |
| cargo tree --format "{p} {l}" > security/sbom/dependencies.txt | |
| cargo deny list --format json > security/sbom/licenses.json 2>/dev/null || true | |
| - name: Upload SBOM artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-sbom-${{ github.sha }} | |
| path: security/sbom/ | |
| retention-days: 90 | |
| - name: Security report summary | |
| run: | | |
| echo "## Security Audit Summary" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Dependency Policy Check" >> $GITHUB_STEP_SUMMARY | |
| if cargo deny check --format json > deny-report.json 2>/dev/null; then | |
| echo "✅ All dependency policies satisfied" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ Dependency policy violations found" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Vulnerability Scan" >> $GITHUB_STEP_SUMMARY | |
| if cargo audit --quiet; then | |
| echo "✅ No known vulnerabilities detected" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "⚠️ Security advisories found (check justified exceptions)" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Artifacts Generated" >> $GITHUB_STEP_SUMMARY | |
| echo "- Software Bill of Materials (SBOM)" >> $GITHUB_STEP_SUMMARY | |
| echo "- Dependency tree with licenses" >> $GITHUB_STEP_SUMMARY | |
| supply-chain-security: | |
| name: Supply Chain Security | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Check for new dependencies | |
| run: | | |
| if git diff origin/main..HEAD --name-only | grep -q "Cargo.toml"; then | |
| echo "⚠️ Cargo.toml modified - new dependencies require security review" >> $GITHUB_STEP_SUMMARY | |
| git diff origin/main..HEAD Cargo.toml >> $GITHUB_STEP_SUMMARY | |
| fi | |
| - name: Validate dependency licenses | |
| run: | | |
| cargo install --force cargo-deny --locked | |
| cargo deny check licenses | |
| security-scorecard: | |
| name: OpenSSF Scorecard | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| id-token: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| persist-credentials: false | |
| - name: Run analysis | |
| uses: ossf/scorecard-action@v2.4.0 | |
| with: | |
| results_file: results.sarif | |
| results_format: sarif | |
| publish_results: true | |
| - name: Upload SARIF results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: results.sarif |