chore(deps): bump sha2 from 0.10.9 to 0.11.0 in /mesh/src-tauri #58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security and feature boundary | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ["v*"] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| codeql: | |
| name: CodeQL JavaScript and TypeScript SAST | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 | |
| with: | |
| languages: javascript-typescript | |
| build-mode: none | |
| - name: Analyze JavaScript and TypeScript | |
| uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2 | |
| with: | |
| category: /language:javascript-typescript | |
| dependency-review: | |
| name: Dependency and license review | |
| if: ${{ github.event_name == 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - name: Review dependency changes | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| config-file: ./.github/dependency-review-config.yml | |
| feature-matrix: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0 | |
| - name: Install Tauri system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libsqlcipher-dev | |
| - name: Check Matrix production artifact | |
| working-directory: mesh/src-tauri | |
| run: cargo check --no-default-features --features matrix-backend --locked --jobs 1 | |
| - name: Assert Matrix production tree excludes libp2p | |
| working-directory: mesh/src-tauri | |
| shell: bash | |
| run: | | |
| set -o pipefail | |
| if cargo tree --no-default-features --features matrix-backend -e normal,build --locked | grep -Eq '(^| )libp2p v'; then | |
| echo 'Matrix production dependency tree unexpectedly contains libp2p.' >&2 | |
| exit 1 | |
| fi | |
| - name: Check experimental LAN artifact | |
| working-directory: mesh/src-tauri | |
| run: cargo check --no-default-features --features legacy-p2p --locked --jobs 1 | |
| dependency-and-secret-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0 | |
| - name: Install pinned Rust advisory scanner | |
| run: | | |
| cargo install cargo-audit --version 0.22.2 --locked | |
| - name: Report raw Rust advisory status without suppressing legacy findings | |
| continue-on-error: true | |
| run: | | |
| cargo audit --file mesh/src-tauri/Cargo.lock | |
| - name: Enforce Matrix shipping and legacy visibility policy | |
| working-directory: mesh | |
| shell: pwsh | |
| run: | | |
| ./scripts/check-matrix-release-dependencies.ps1 ` | |
| -ReportPath release/rust-dependency-report.json | |
| - name: Upload Rust dependency policy evidence | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: rust-dependency-policy-${{ github.sha }} | |
| path: mesh/release/rust-dependency-report.json | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: mesh/package-lock.json | |
| - name: Enforce the on-device and non-autonomous AI boundary | |
| working-directory: mesh | |
| run: | | |
| node --test scripts/check-ai-boundary.test.mjs | |
| node scripts/check-ai-boundary.mjs | |
| - name: Audit JavaScript dependencies | |
| working-directory: mesh | |
| run: npm audit --audit-level=high | |
| - name: Scan repository history for non-URI secrets | |
| uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6 | |
| with: | |
| extra_args: --results=verified,unknown --exclude-detectors=URI | |
| - name: Scan repository history for credential-bearing URIs | |
| uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6 | |
| with: | |
| extra_args: --results=verified,unknown --include-detectors=URI --exclude-paths=.trufflehog-uri-excludes | |
| sbom: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: mesh/package-lock.json | |
| - name: Install JavaScript dependencies | |
| working-directory: mesh | |
| run: npm ci | |
| - name: Generate JavaScript CycloneDX SBOM | |
| working-directory: mesh | |
| run: npm sbom --sbom-format=cyclonedx > mesh-node.cdx.json | |
| - name: Generate Rust CycloneDX SBOM | |
| working-directory: mesh/src-tauri | |
| run: | | |
| cargo install cargo-cyclonedx --version 0.5.9 --locked | |
| cargo cyclonedx --format json | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: mesh-sboms-${{ github.sha }} | |
| path: | | |
| mesh/mesh-node.cdx.json | |
| mesh/src-tauri/*.cdx.json | |
| if-no-files-found: error | |
| retention-days: 30 |