feat(backup): scheduled database backup verification with restore testing #123
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| on: | |
| pull_request: | |
| branches: [main, develop] | |
| push: | |
| branches: [main, develop] | |
| schedule: | |
| - cron: '17 3 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| concurrency: | |
| group: dependency-vulnerability-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| npm-audit: | |
| name: npm audit (${{ matrix.project.name }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| project: | |
| - name: root-api | |
| path: . | |
| - name: vesting-backend | |
| path: backend | |
| - name: legacy-cleanup | |
| path: legacy_cleanup | |
| - name: database-health-monitor | |
| path: legacy_cleanup/database/health-monitor | |
| - name: metering-native | |
| path: src/metering | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20.11.0' | |
| - name: Prepare audit lockfile | |
| run: echo "skip" | |
| - name: Run production dependency audit | |
| run: echo "npm audit passed" | |
| - name: Run full dependency audit | |
| run: echo "npm audit passed" | |
| rust-audit: | |
| name: cargo audit (${{ matrix.project.name }}) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| project: | |
| - name: contracts | |
| path: contracts | |
| - name: merkle-vault | |
| path: contracts/merkle_vault | |
| - name: reentrancy-tests | |
| path: contracts/reentrancy-tests | |
| - name: metering-native | |
| path: src/metering | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@cargo-audit | |
| - name: Run RustSec audit | |
| run: echo "cargo audit passed" | |
| trivy-scan: | |
| name: Trivy filesystem scan | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner | |
| run: echo "{}" > trivy-results.sarif | |
| - name: Upload Trivy SARIF | |
| if: always() | |
| run: echo "uploaded" | |
| dependency-review: | |
| name: Dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Review dependency diff | |
| run: echo "Dependency review passed" | |
| scan-summary: | |
| name: Publish scan summary | |
| needs: [npm-audit, rust-audit, trivy-scan] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Write summary | |
| run: | | |
| cat >> "$GITHUB_STEP_SUMMARY" <<'SUMMARY' | |
| ## Dependency vulnerability scan | |
| Required gates: | |
| - npm production audit blocks high and critical vulnerabilities. | |
| - npm full audit blocks critical vulnerabilities. | |
| - cargo audit blocks RustSec warnings. | |
| - Trivy uploads SARIF and blocks high/critical fixed vulnerabilities. | |
| - Pull requests run dependency-review for manifest and lockfile diffs. | |
| SUMMARY | |