.github/.github/workflows/security.yml at main · forkwright/.github · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
# WHY: Block merges on known vulnerabilities and license/source/ban violations.
# cargo-audit (RustSec) + cargo-deny (licenses/sources/bans/advisories) + osv-scanner.
# Reusable across the fleet; per-repo advisory ignores live in deny.toml/osv-scanner.toml.
name: Security (reusable)

on:
  workflow_call:
    inputs:
      runner:
        type: string
        default: "ubuntu-latest"
        required: false
      cargo_deny_timeout_minutes:
        type: number
        default: 15
        required: false
      cargo_audit_timeout_minutes:
        type: number
        default: 15
        required: false
      has_private_deps:
        description: "Configure FLEET_REPO_TOKEN git credentials for cross-repo private deps"
        type: boolean
        default: false
        required: false
      run_osv:
        description: "Run google/osv-scanner (uploads SARIF to code scanning)"
        type: boolean
        default: true
        required: false
      osv_config:
        type: string
        default: "osv-scanner.toml"
        required: false
      osv_lockfile:
        type: string
        default: "Cargo.lock"
        required: false
    secrets:
      FLEET_REPO_TOKEN:
        required: false

permissions:
  contents: read

env:
  CARGO_TERM_COLOR: always

jobs:
  cargo-deny:
    name: cargo deny
    runs-on: ${{ inputs.runner }}
    timeout-minutes: ${{ inputs.cargo_deny_timeout_minutes }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Configure git credentials for private fleet deps
        if: ${{ inputs.has_private_deps }}
        env:
          FLEET_REPO_TOKEN: ${{ secrets.FLEET_REPO_TOKEN }}
        run: |
          if [ -z "${FLEET_REPO_TOKEN}" ]; then
            echo "FLEET_REPO_TOKEN is not set; cross-repo private deps will fail to fetch." >&2
            exit 0
          fi
          git config --global credential.helper store
          printf 'https://forkwright:%s@github.com\n' "${FLEET_REPO_TOKEN}" > ~/.git-credentials
          chmod 0600 ~/.git-credentials
      # WHY: setup-rust-toolchain auto-reads rust-toolchain.toml, so nightly-pinned
      # repos (theatron) get nightly and stable repos get stable with no input.
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
        with:
          command: check advisories licenses bans sources
          credentials: ${{ inputs.has_private_deps && format('https://forkwright:{0}@github.com', secrets.FLEET_REPO_TOKEN) || '' }}
          use-git-cli: ${{ inputs.has_private_deps }}

  cargo-audit:
    name: cargo audit
    runs-on: ${{ inputs.runner }}
    timeout-minutes: ${{ inputs.cargo_audit_timeout_minutes }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Configure git credentials for private fleet deps
        if: ${{ inputs.has_private_deps }}
        env:
          FLEET_REPO_TOKEN: ${{ secrets.FLEET_REPO_TOKEN }}
        run: |
          if [ -z "${FLEET_REPO_TOKEN}" ]; then
            echo "FLEET_REPO_TOKEN is not set; cross-repo private deps will fail to fetch." >&2
            exit 0
          fi
          git config --global credential.helper store
          printf 'https://forkwright:%s@github.com\n' "${FLEET_REPO_TOKEN}" > ~/.git-credentials
          chmod 0600 ~/.git-credentials
      # WHY: setup-rust-toolchain auto-reads rust-toolchain.toml so a repo without
      # a committed Cargo.lock can still generate one for the scan; MSRV-pinned
      # repos get their pinned rustc, which no longer constrains cargo-audit now
      # that it is installed as a prebuilt binary below.
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
      # WHY: install cargo-audit as a PREBUILT binary, not `cargo install` from
      # source. A source build couples cargo-audit's climbing MSRV to the target
      # repo's pinned toolchain and fails both ways on MSRV-pinned repos: 0.22.x
      # needs rustc >= 1.88 to compile, while 0.21.x bundles a rustsec that cannot
      # parse the CVSS-4.0 advisories now in the RustSec DB (erroring the whole
      # scan). Pin the exact version — a DB-format bump is a deliberate, reviewed
      # change, never an implicit floor. See kanon#2385.
      - uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1
        with:
          tool: cargo-audit@0.22.2
      - name: cargo audit
        run: cargo audit --deny unmaintained --deny unsound --deny yanked

  osv-scanner:
    name: osv scanner
    if: ${{ inputs.run_osv }}
    permissions:
      actions: read
      contents: read
      security-events: write
    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@8deb546fdb875b9996d27d4950be7312dac076a1
    with:
      scan-args: "--config=${{ inputs.osv_config }} --lockfile=${{ inputs.osv_lockfile }}"