mesh/.github/workflows/security.yml at 00ee00f5387ee142227572cc3898f803a9f0fe9a · dhawal-ss/mesh · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: Security and feature boundary

on:
  push:
    branches: [main]
    tags: ["v*"]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  codeql:
    name: CodeQL JavaScript and TypeScript SAST
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Initialize CodeQL
        uses: github/codeql-action/init@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
        with:
          languages: javascript-typescript
          build-mode: none
      - name: Analyze JavaScript and TypeScript
        uses: github/codeql-action/analyze@18420e3271f74589575af831a523c833acda327f # codeql-bundle-v2.26.2
        with:
          category: /language:javascript-typescript

  dependency-review:
    name: Dependency and license review
    if: ${{ github.event_name == 'pull_request' }}
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - name: Review dependency changes
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          config-file: ./.github/dependency-review-config.yml

  feature-matrix:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
      - name: Install Tauri system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libwebkit2gtk-4.1-dev libappindicator3-dev librsvg2-dev patchelf libssl-dev libsqlcipher-dev
      - name: Check Matrix production artifact
        working-directory: mesh/src-tauri
        run: cargo check --no-default-features --features matrix-backend --locked --jobs 1
      - name: Assert Matrix production tree excludes libp2p
        working-directory: mesh/src-tauri
        shell: bash
        run: |
          set -o pipefail
          if cargo tree --no-default-features --features matrix-backend -e normal,build --locked | grep -Eq '(^| )libp2p v'; then
            echo 'Matrix production dependency tree unexpectedly contains libp2p.' >&2
            exit 1
          fi
      - name: Check experimental LAN artifact
        working-directory: mesh/src-tauri
        run: cargo check --no-default-features --features legacy-p2p --locked --jobs 1

  dependency-and-secret-audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
        with:
          fetch-depth: 0
      - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
      - name: Install pinned Rust advisory scanner
        run: |
          cargo install cargo-audit --version 0.22.2 --locked
      - name: Report raw Rust advisory status without suppressing legacy findings
        continue-on-error: true
        run: |
          cargo audit --file mesh/src-tauri/Cargo.lock
      - name: Enforce Matrix shipping and legacy visibility policy
        working-directory: mesh
        shell: pwsh
        run: |
          ./scripts/check-matrix-release-dependencies.ps1 `
            -ReportPath release/rust-dependency-report.json
      - name: Upload Rust dependency policy evidence
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: rust-dependency-policy-${{ github.sha }}
          path: mesh/release/rust-dependency-report.json
          if-no-files-found: error
          retention-days: 30
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: mesh/package-lock.json
      - name: Enforce the on-device and non-autonomous AI boundary
        working-directory: mesh
        run: |
          node --test scripts/check-ai-boundary.test.mjs
          node scripts/check-ai-boundary.mjs
      - name: Audit JavaScript dependencies
        working-directory: mesh
        run: npm audit --audit-level=high
      - name: Scan repository history for non-URI secrets
        uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6
        with:
          extra_args: --results=verified,unknown --exclude-detectors=URI
      - name: Scan repository history for credential-bearing URIs
        uses: trufflesecurity/trufflehog@18c7b1fc33e6c16b27ea66ff27cc7e642fb7cd0a # v3.90.6
        with:
          extra_args: --results=verified,unknown --include-detectors=URI --exclude-paths=.trufflehog-uri-excludes

  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: dtolnay/rust-toolchain@d0befba8b9ddf874327619e84c39b094edd58b66 # 1.93.0
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: mesh/package-lock.json
      - name: Install JavaScript dependencies
        working-directory: mesh
        run: npm ci
      - name: Generate JavaScript CycloneDX SBOM
        working-directory: mesh
        run: npm sbom --sbom-format=cyclonedx > mesh-node.cdx.json
      - name: Generate Rust CycloneDX SBOM
        working-directory: mesh/src-tauri
        run: |
          cargo install cargo-cyclonedx --version 0.5.9 --locked
          cargo cyclonedx --format json
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: mesh-sboms-${{ github.sha }}
          path: |
            mesh/mesh-node.cdx.json
            mesh/src-tauri/*.cdx.json
          if-no-files-found: error
          retention-days: 30