FlowStar/.github/workflows/security.yml at main · FlowwStar/FlowStar · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Security Scan

on:
  pull_request:
    branches: [main]

jobs:
  contract-audit:
    name: Rust / Soroban Audit
    runs-on: ubuntu-latest
    permissions:
      issues: write # Required to comment on issues
      pull-requests: write
    defaults:
      run:
        working-directory: contracts

    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: contracts

      - name: clippy
        run: cargo clippy --all-targets -- -D warnings

      - name: cargo audit
        run: |
          cargo install cargo-audit --locked --quiet
          cargo audit 2>&1 | tee /tmp/audit-output.txt
          exit ${PIPESTATUS[0]}

      - name: Soroban pattern check
        run: node ../scripts/soroban-security-check.mjs 2>&1 | tee /tmp/soroban-output.txt

      - name: Post contract audit summary
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs')
            const audit = fs.existsSync('/tmp/audit-output.txt')
              ? fs.readFileSync('/tmp/audit-output.txt', 'utf8').trim()
              : '(no output)'
            const soroban = fs.existsSync('/tmp/soroban-output.txt')
              ? fs.readFileSync('/tmp/soroban-output.txt', 'utf8').trim()
              : '(no output)'
            const body = [
              '## 🔐 Contract Security Scan',
              '',
              '<details><summary>cargo audit</summary>',
              '',
              '```',
              audit,
              '```',
              '',
              '</details>',
              '',
              '<details><summary>Soroban pattern check</summary>',
              '',
              '```',
              soroban,
              '```',
              '',
              '</details>',
            ].join('\n')
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            })

  frontend-audit:
    name: Frontend Audit
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm

      - run: npm ci

      - name: npm audit
        run: npm audit --audit-level=high 2>&1 | tee /tmp/npm-audit.txt; exit ${PIPESTATUS[0]}

      - name: ESLint security
        run: npm run lint 2>&1 | tee /tmp/eslint-output.txt; exit ${PIPESTATUS[0]}

      - name: Check for hardcoded secrets
        run: |
          node scripts/check-secrets.mjs 2>&1 | tee /tmp/secrets-output.txt
          exit ${PIPESTATUS[0]}

      - name: Post frontend audit summary
        if: always()
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs')
            const read = (p) => fs.existsSync(p) ? fs.readFileSync(p, 'utf8').trim() : '(no output)'
            const body = [
              '## 🛡️ Frontend Security Scan',
              '',
              '<details><summary>npm audit</summary>',
              '',
              '```',
              read('/tmp/npm-audit.txt'),
              '```',
              '',
              '</details>',
              '',
              '<details><summary>ESLint</summary>',
              '',
              '```',
              read('/tmp/eslint-output.txt'),
              '```',
              '',
              '</details>',
              '',
              '<details><summary>Hardcoded secrets check</summary>',
              '',
              '```',
              read('/tmp/secrets-output.txt'),
              '```',
              '',
              '</details>',
            ].join('\n')
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body,
            })