Skip to content
Nightly Security & Mutation Audit

Nightly Security & Mutation Audit #65

Sign in to view logs

Nightly Security & Mutation Audit

Nightly Security & Mutation Audit #65

Workflow file for this run

.github/workflows/nightly-security-audit.yml at b7a6f72
name: Nightly Security & Mutation Audit
on:
schedule:
# Triggers every single night at 02:00 UTC
- cron: '0 2 * * *'
workflow_dispatch: # Allows manual trigger for verification
permissions:
contents: write
jobs:
audit:
name: Run Security and Mutation Suite
runs-on: ubuntu-latest
steps:
- name: Checkout Code Repository
uses: actions/checkout@v4
- name: Install Rust Toolchain (Nightly)
uses: dtolnay/rust-toolchain@nightly
- name: Cache Cargo Dependencies
uses: actions/cache@v4
with:
path: |
~/.cargo/bin/
~/.cargo/registry/index/
~/.cargo/registry/cache/
~/.cargo/git/db/
target/
key: ${{ runner.os }}-cargo-nightly-${{ hashFiles('**/Cargo.lock') }}
- name: Install Utility Tooling Engines
run: |
cargo install cargo-deny --locked || true
cargo install cargo-audit --locked || true
cargo install cargo-mutants --locked || true
- name: Initialize or Clear Audit Log File
run: |
echo "# 🛡️ Automated Security & Mutation Audit Log" > AUDIT_LOG.md
echo "Generated on: $(date -u)" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
- name: Execute Cargo Deny Checks
id: deny
run: |
echo "## 📦 Dependency License & Advisory Checks (cargo-deny)" >> AUDIT_LOG.md
echo "\`\`\`text" >> AUDIT_LOG.md
if cargo deny check licenses bans sources 2>&1 | tee -a AUDIT_LOG.md; then
echo "deny_exit=0" >> "$GITHUB_OUTPUT"
else
echo "deny_exit=$?" >> "$GITHUB_OUTPUT"
echo "::warning::cargo-deny flagged warnings or errors (see AUDIT_LOG.md)"
fi
echo "\`\`\`" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
- name: Execute Cargo Audit Sweeps
id: audit
run: |
echo "## 🔍 Vulnerability Advisory Scans (cargo-audit)" >> AUDIT_LOG.md
echo "\`\`\`text" >> AUDIT_LOG.md
set +e
cargo audit 2>&1 | tee -a AUDIT_LOG.md
AUDIT_EXIT=$?
set -e
echo "\`\`\`" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
if [ "$AUDIT_EXIT" -ne 0 ]; then
echo "::error::cargo-audit found vulnerabilities (exit code $AUDIT_EXIT). See AUDIT_LOG.md for details."
echo "audit_exit=$AUDIT_EXIT" >> "$GITHUB_OUTPUT"
else
echo "audit_exit=0" >> "$GITHUB_OUTPUT"
fi
- name: Mutants Gate — propchain-lending
run: |
set -o pipefail
echo "## 🧬 Mutation Gate: lending" >> AUDIT_LOG.md
echo "\`\`\`text" >> AUDIT_LOG.md
cargo mutants -p propchain-lending --timeout 120 2>&1 | tee -a AUDIT_LOG.md
echo "\`\`\`" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
- name: Mutants Gate — propchain-bridge
run: |
set -o pipefail
echo "## 🧬 Mutation Gate: bridge" >> AUDIT_LOG.md
echo "\`\`\`text" >> AUDIT_LOG.md
cargo mutants -p propchain-bridge --timeout 180 2>&1 | tee -a AUDIT_LOG.md
echo "\`\`\`" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
- name: Mutants Gate — oracle
run: |
set -o pipefail
echo "## 🧬 Mutation Gate: oracle" >> AUDIT_LOG.md
echo "\`\`\`text" >> AUDIT_LOG.md
cargo mutants -p oracle --timeout 120 2>&1 | tee -a AUDIT_LOG.md
echo "\`\`\`" >> AUDIT_LOG.md
echo "---" >> AUDIT_LOG.md
- name: Evaluate Audit Results
if: always()
run: |
DENY_EXIT="${{ steps.deny.outputs.deny_exit }}"
AUDIT_EXIT="${{ steps.audit.outputs.audit_exit }}"
if [ "$DENY_EXIT" != "0" ] || [ "$AUDIT_EXIT" != "0" ]; then
echo "::error::Security audit found issues. Review AUDIT_LOG.md and fix before proceeding."
exit 1
fi
- name: Commit and Push Security Results to Repo
if: always()
run: |
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git add AUDIT_LOG.md
git diff-index --quiet HEAD || git commit -m "chore(ci): update nightly AUDIT_LOG.md [skip ci]"
git push origin HEAD:${{ github.ref }}