Merge pull request #116 from gloskull/Database-Migration-Versioning #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| push: | |
| branches: [ main ] | |
| schedule: | |
| - cron: '17 3 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| concurrency: | |
| group: dependency-vulnerability-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Pull request dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Block vulnerable dependency changes | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: moderate | |
| deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0 | |
| comment-summary-in-pr: always | |
| rust-audit: | |
| name: Rust cargo audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@cargo-audit | |
| - name: Audit root workspace dependencies | |
| run: cargo audit --deny warnings --file Cargo.lock | |
| - name: Audit contracts workspace dependencies | |
| run: cargo audit --deny warnings --file contracts/Cargo.lock | |
| npm-audit: | |
| name: Node npm audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| project: | |
| - meter-simulator | |
| - usage-dashboard | |
| defaults: | |
| run: | |
| working-directory: ${{ matrix.project }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: ${{ matrix.project }}/package-lock.json | |
| - name: Install locked dependencies without running package scripts | |
| run: npm ci --ignore-scripts | |
| - name: Audit production dependency tree | |
| run: npm audit --audit-level=moderate --omit=dev | |
| - name: Audit full dependency tree | |
| run: npm audit --audit-level=high | |
| vulnerability-summary: | |
| name: Vulnerability scan summary | |
| runs-on: ubuntu-latest | |
| needs: | |
| - rust-audit | |
| - npm-audit | |
| if: always() | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Publish pipeline summary | |
| run: | | |
| cat <<'SUMMARY' >> "$GITHUB_STEP_SUMMARY" | |
| ## Dependency vulnerability scan | |
| | Scanner | Scope | Blocking threshold | | |
| | --- | --- | --- | | |
| | Dependency Review | Pull request manifest and lockfile changes | Moderate | | |
| | cargo-audit | Root and contracts Cargo.lock files | RustSec warnings | | |
| | npm audit | meter-simulator and usage-dashboard | Moderate production / high full tree | | |
| Failed jobs block the pull request until the dependency is upgraded, | |
| replaced, or an explicitly documented security exception is approved. | |
| SUMMARY | |
| - name: Enforce successful scanners | |
| run: | | |
| if [ "${{ needs.rust-audit.result }}" != "success" ] || [ "${{ needs.npm-audit.result }}" != "success" ]; then | |
| echo "One or more dependency vulnerability scanners failed. Review job logs before merging." | |
| exit 1 | |
| fi |