Implement config management with hot-reload and schema validation (fixes #122) #89
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Scan | |
| on: | |
| pull_request: | |
| branches: [ main ] | |
| push: | |
| branches: [ main ] | |
| schedule: | |
| - cron: '17 3 * * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| concurrency: | |
| group: dependency-vulnerability-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| dependency-review: | |
| name: Pull request dependency review | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Check Dependency graph availability | |
| id: graph-check | |
| run: | | |
| set +e | |
| code=$(curl -s -o /dev/null -w '%{http_code}' \ | |
| -H "Authorization: Bearer ${{ github.token }}" \ | |
| -H "Accept: application/vnd.github+json" \ | |
| "https://api.github.com/repos/${{ github.repository }}/dependency-graph/compare/${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }}") | |
| echo "http_code=$code" >> "$GITHUB_OUTPUT" | |
| - name: Block vulnerable dependency changes | |
| if: > | |
| steps.graph-check.outputs.http_code != '403' && | |
| steps.graph-check.outputs.http_code != '404' | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: moderate | |
| deny-licenses: GPL-2.0, GPL-3.0, AGPL-1.0, AGPL-3.0 | |
| comment-summary-in-pr: always | |
| - name: Skip dependency review (Dependency graph disabled) | |
| if: > | |
| steps.graph-check.outputs.http_code == '403' || | |
| steps.graph-check.outputs.http_code == '404' | |
| run: | | |
| echo "::warning::Dependency graph is not enabled on this repository; skipping dependency review. Enable it in Settings -> Code security and analysis -> Dependency graph." | |
| rust-audit: | |
| name: Rust cargo audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| uses: taiki-e/install-action@cargo-audit | |
| - name: Audit root workspace dependencies | |
| run: cargo audit --deny warnings --file Cargo.lock | |
| - name: Audit contracts workspace dependencies | |
| run: cargo audit --deny warnings --file contracts/Cargo.lock | |
| npm-audit: | |
| name: Node npm audit | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| project: | |
| - meter-simulator | |
| - usage-dashboard | |
| defaults: | |
| run: | |
| working-directory: ${{ matrix.project }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: ${{ matrix.project }}/package-lock.json | |
| - name: Install locked dependencies without running package scripts | |
| run: npm ci --ignore-scripts | |
| - name: Audit production dependency tree | |
| run: npm audit --audit-level=moderate --omit=dev | |
| - name: Audit full dependency tree | |
| run: npm audit --audit-level=high | |
| vulnerability-summary: | |
| name: Vulnerability scan summary | |
| runs-on: ubuntu-latest | |
| needs: | |
| - rust-audit | |
| - npm-audit | |
| if: always() | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Publish pipeline summary | |
| run: | | |
| cat <<'SUMMARY' >> "$GITHUB_STEP_SUMMARY" | |
| ## Dependency vulnerability scan | |
| | Scanner | Scope | Blocking threshold | | |
| | --- | --- | --- | | |
| | Dependency Review | Pull request manifest and lockfile changes | Moderate | | |
| | cargo-audit | Root and contracts Cargo.lock files | RustSec warnings | | |
| | npm audit | meter-simulator and usage-dashboard | Moderate production / high full tree | | |
| Failed jobs block the pull request until the dependency is upgraded, | |
| replaced, or an explicitly documented security exception is approved. | |
| SUMMARY | |
| - name: Enforce successful scanners | |
| run: | | |
| if [ "${{ needs.rust-audit.result }}" != "success" ] || [ "${{ needs.npm-audit.result }}" != "success" ]; then | |
| echo "One or more dependency vulnerability scanners failed. Review job logs before merging." | |
| exit 1 | |
| fi |