chore(deps): bump xml-rs from 0.8.28 to 0.8.29 #353
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security - Vulnerability scanning, dependency review, and policy enforcement | |
| # Comprehensive security auditing for dependencies and supply chain | |
| name: Security | |
| on: | |
| workflow_call: | |
| outputs: | |
| passed: | |
| description: "Whether all security checks passed" | |
| # For PRs, security-gate runs; for other events (tags), use core check results | |
| value: ${{ jobs.security-report.result == 'success' }} | |
| workflow_dispatch: | |
| push: | |
| branches: [master, main, "rc-*"] | |
| paths: | |
| - '**/Cargo.toml' | |
| - '**/Cargo.lock' | |
| - '.github/workflows/security.yml' | |
| - 'deny.toml' | |
| pull_request: | |
| branches: [master, main, "rc-*"] | |
| paths: | |
| - '**/Cargo.toml' | |
| - '**/Cargo.lock' | |
| schedule: | |
| # Run daily at 2 AM UTC | |
| - cron: '0 2 * * *' | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| # Vulnerability scanning with cargo-audit | |
| vulnerability-scan: | |
| name: Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| if: ${{ !startsWith(runner.name, 'nektos/act') }} | |
| - name: Set env | |
| run: | | |
| echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV" | |
| echo RUST_BACKTRACE=1 >> "$GITHUB_ENV" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo-audit | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.cargo/bin/cargo-audit | |
| key: cargo-audit-${{ runner.os }} | |
| - name: Install cargo-audit | |
| run: | | |
| if ! command -v cargo-audit &> /dev/null; then | |
| cargo install cargo-audit --locked | |
| fi | |
| - name: Run cargo-audit | |
| run: | | |
| # Generate both human-readable and SARIF output | |
| cargo audit --json > audit-results.json || true | |
| cargo audit || AUDIT_EXIT_CODE=$? | |
| # Generate SARIF from JSON results | |
| if [ -f audit-results.json ]; then | |
| echo "Converting audit results to SARIF format..." | |
| python3 .github/scripts/audit-to-sarif.py audit-results.json audit-results.sarif | |
| fi | |
| exit ${AUDIT_EXIT_CODE:-0} | |
| - name: Upload SARIF results | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: audit-results.sarif | |
| category: cargo-audit | |
| - name: Upload audit results | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: audit-results | |
| path: | | |
| audit-results.json | |
| audit-results.sarif | |
| # License and dependency policy enforcement with cargo-deny | |
| policy-check: | |
| name: Policy Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| if: ${{ !startsWith(runner.name, 'nektos/act') }} | |
| - name: Set env | |
| run: | | |
| echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV" | |
| echo RUST_BACKTRACE=1 >> "$GITHUB_ENV" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check | |
| arguments: --all-features | |
| log-level: warn | |
| - name: Check licenses | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check licenses | |
| arguments: --all-features | |
| - name: Check bans | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check bans | |
| arguments: --all-features | |
| - name: Check advisories | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check advisories | |
| arguments: --all-features | |
| - name: Check sources | |
| uses: EmbarkStudios/cargo-deny-action@v2 | |
| with: | |
| command: check sources | |
| arguments: --all-features | |
| # Supply chain security (informational, non-blocking) | |
| supply-chain: | |
| name: Supply Chain Security | |
| runs-on: ubuntu-latest | |
| continue-on-error: true # Don't block builds on supply chain failures | |
| steps: | |
| - uses: actions/checkout@v7 | |
| if: ${{ !startsWith(runner.name, 'nektos/act') }} | |
| - name: Set env | |
| run: | | |
| echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV" | |
| echo RUST_BACKTRACE=1 >> "$GITHUB_ENV" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-vet | |
| run: cargo install cargo-vet --locked | |
| - name: Initialize cargo-vet | |
| run: cargo vet init || true | |
| - name: Run cargo-vet | |
| run: | | |
| cargo vet --locked || VET_EXIT_CODE=$? | |
| # Generate report | |
| cargo vet dump-graph > supply-chain-report.json || true | |
| exit ${VET_EXIT_CODE:-0} | |
| - name: Upload supply chain report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: supply-chain-report | |
| path: supply-chain-report.json | |
| # SBOM generation | |
| sbom-generation: | |
| name: Generate SBOM | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| if: ${{ !startsWith(runner.name, 'nektos/act') }} | |
| - name: Set env | |
| run: | | |
| echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV" | |
| echo RUST_BACKTRACE=1 >> "$GITHUB_ENV" | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-cyclonedx | |
| run: cargo install cargo-cyclonedx --locked | |
| - name: Generate SBOM | |
| run: | | |
| cargo cyclonedx --format json > sbom.cyclonedx.json | |
| cargo cyclonedx --format xml > sbom.cyclonedx.xml | |
| - name: Upload SBOM artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: sbom | |
| path: | | |
| sbom.cyclonedx.json | |
| sbom.cyclonedx.xml | |
| # Security metrics and reporting | |
| security-report: | |
| name: Security Report | |
| needs: [vulnerability-scan, policy-check, supply-chain] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Download all artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: security-artifacts/ | |
| - name: Generate security report | |
| run: | | |
| echo "# Security Scan Report" > security-report.md | |
| echo "Date: $(date)" >> security-report.md | |
| echo "" >> security-report.md | |
| echo "## Summary" >> security-report.md | |
| echo "- Vulnerability Scan: ${{ needs.vulnerability-scan.result }}" >> security-report.md | |
| echo "- Policy Check: ${{ needs.policy-check.result }}" >> security-report.md | |
| echo "- Supply Chain: ${{ needs.supply-chain.result }}" >> security-report.md | |
| echo "" >> security-report.md | |
| # Add vulnerability summary if available | |
| if [ -f security-artifacts/audit-results/audit-results.json ]; then | |
| echo "## Vulnerabilities" >> security-report.md | |
| echo '```json' >> security-report.md | |
| jq '.vulnerabilities.count' security-artifacts/audit-results/audit-results.json >> security-report.md || echo "0" >> security-report.md | |
| echo '```' >> security-report.md | |
| echo "" >> security-report.md | |
| fi | |
| # Add to GitHub summary | |
| cat security-report.md >> $GITHUB_STEP_SUMMARY | |
| - name: Upload security report | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: security-report | |
| path: security-report.md | |
| # Dependency review for PRs (GitHub's dependency review action) | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| # Informational only unless GitHub Dependency Graph is enabled for the repo. | |
| # The action exits with "Dependency review is not supported" otherwise, | |
| # which is repository configuration rather than a dependency/content issue. | |
| continue-on-error: true | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Dependency Review | |
| continue-on-error: true | |
| uses: actions/dependency-review-action@v5 | |
| with: | |
| fail-on-severity: high | |
| license-check: true | |
| vulnerability-check: true | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Check for outdated dependencies | |
| run: | | |
| cargo install cargo-outdated --locked || true | |
| cargo outdated --exit-code 1 || echo "::warning::Some dependencies are outdated" | |
| # Fail the workflow if critical vulnerabilities are found by repo-local checks. | |
| # GitHub Dependency Review is intentionally advisory here unless/until | |
| # Dependency Graph is enabled for this repository. | |
| security-gate: | |
| name: Security Gate | |
| needs: [vulnerability-scan, policy-check, dependency-review] | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check security status | |
| run: | | |
| if [ "${{ needs.vulnerability-scan.result }}" == "failure" ]; then | |
| echo "::error::Critical vulnerabilities found. Please fix before merging." | |
| exit 1 | |
| fi | |
| if [ "${{ needs.policy-check.result }}" == "failure" ]; then | |
| echo "::error::Security policy violations found. Please fix before merging." | |
| exit 1 | |
| fi | |
| echo "All security checks passed!" |