Skip to content

Commit 8a8c70f

Browse files
27Bslash627Bslash6
committed
chore: add security CI, Makefile, and sync with crates.io v0.1.0
- Add security.yml workflow (audit, deny, fuzz, kani, SBOM) - Add codeql.yml for GitHub code scanning - Add dependabot.yml for automated dependency updates - Add Makefile with security and quality targets - Sync Cargo.toml version to match published 0.1.0 - Sync release-please-manifest.json to 0.1.0 - Update cargo-vet config with audit-as-crates-io policy - Regenerate cargo-vet exemptions for current deps - Clean up stale deny.toml entries (unused licenses/skips) - Bump actions/checkout to v5, create-github-app-token to v2
1 parent 6dbe9b1 commit 8a8c70f

File tree

9 files changed

+621
-1047
lines changed

9 files changed

+621
-1047
lines changed

‎.github/dependabot.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
version: 2
2+
updates:
3+
# Cargo dependencies
4+
- package-ecosystem: cargo
5+
directory: /
6+
schedule:
7+
interval: weekly
8+
commit-message:
9+
prefix: "deps"
10+
groups:
11+
rust-dependencies:
12+
patterns:
13+
- "*"
14+
open-pull-requests-limit: 5
15+
16+
# GitHub Actions
17+
- package-ecosystem: github-actions
18+
directory: /
19+
schedule:
20+
interval: weekly
21+
commit-message:
22+
prefix: "ci"

‎.github/workflows/codeql.yml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: CodeQL
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
# Weekly scan on Sundays
10+
- cron: '0 0 * * 0'
11+
12+
jobs:
13+
analyze:
14+
name: Analyze
15+
runs-on: ubuntu-latest
16+
permissions:
17+
actions: read
18+
contents: read
19+
security-events: write
20+
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
- name: Initialize CodeQL
25+
uses: github/codeql-action/init@v3
26+
with:
27+
languages: cpp
28+
# CodeQL doesn't have native Rust support, but analyzes C FFI layer
29+
# For Rust-specific analysis, we rely on clippy and cargo-deny
30+
31+
- name: Install Rust toolchain
32+
uses: dtolnay/rust-toolchain@stable
33+
34+
- name: Build with FFI
35+
run: cargo build --features ffi --release
36+
37+
- name: Perform CodeQL Analysis
38+
uses: github/codeql-action/analyze@v3
39+
with:
40+
category: "/language:cpp"

‎.github/workflows/release.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
release_created: ${{ steps.release.outputs.release_created }}
1717
tag_name: ${{ steps.release.outputs.tag_name }}
1818
steps:
19-
- uses: actions/create-github-app-token@v1
19+
- uses: actions/create-github-app-token@v2
2020
id: app-token
2121
with:
2222
app-id: ${{ secrets.APP_ID }}
@@ -32,7 +32,7 @@ jobs:
3232
if: ${{ needs.release-please.outputs.release_created }}
3333
runs-on: ubuntu-latest
3434
steps:
35-
- uses: actions/checkout@v4
35+
- uses: actions/checkout@v5
3636

3737
- name: Install Rust toolchain
3838
uses: dtolnay/rust-toolchain@stable

‎.github/workflows/security.yml‎

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
name: Security
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
schedule:
9+
- cron: '0 3 * * *'
10+
release:
11+
types: [published]
12+
13+
env:
14+
CARGO_TERM_COLOR: always
15+
RUST_BACKTRACE: 1
16+
17+
jobs:
18+
fast-security:
19+
name: Fast Security Checks
20+
runs-on: ubuntu-latest
21+
if: github.event_name == 'push' || github.event_name == 'pull_request'
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
26+
- name: Install Rust toolchain
27+
uses: dtolnay/rust-toolchain@stable
28+
with:
29+
toolchain: "1.85"
30+
components: clippy
31+
32+
- name: Cache Rust dependencies
33+
uses: actions/cache@v4
34+
with:
35+
path: |
36+
~/.cargo/registry/index/
37+
~/.cargo/registry/cache/
38+
~/.cargo/git/db/
39+
target/
40+
key: ${{ runner.os }}-cargo-security-${{ hashFiles('**/Cargo.lock') }}
41+
restore-keys: |
42+
${{ runner.os }}-cargo-security-
43+
${{ runner.os }}-cargo-
44+
45+
- name: Install cargo-audit
46+
run: cargo install cargo-audit --locked
47+
48+
- name: Install cargo-deny
49+
run: cargo install cargo-deny --locked
50+
51+
- name: Run cargo audit (CVE scanning)
52+
run: cargo audit
53+
54+
- name: Run cargo deny (license compliance + advisories)
55+
run: cargo deny check
56+
57+
- name: Run clippy (strict linting)
58+
run: cargo clippy --all-features --all-targets -- -D warnings
59+
60+
- name: Run tests
61+
run: cargo test --all-features
62+
63+
quick-fuzz:
64+
name: Quick Fuzz (Corpus Only)
65+
runs-on: ubuntu-latest
66+
if: github.event_name == 'push' || github.event_name == 'pull_request'
67+
strategy:
68+
fail-fast: false
69+
matrix:
70+
target:
71+
- byte_storage_checksum_collision
72+
- byte_storage_compress
73+
- byte_storage_corrupted_envelope
74+
- byte_storage_decompress
75+
- byte_storage_empty_data
76+
- byte_storage_format_injection
77+
- byte_storage_integer_overflow
78+
- compression_bomb
79+
- encryption_aad_injection
80+
- encryption_key_derivation
81+
- encryption_large_payload
82+
- encryption_nonce_reuse
83+
- encryption_roundtrip
84+
- encryption_truncated_ciphertext
85+
- integration_layered_security
86+
- key_derivation
87+
steps:
88+
- name: Checkout code
89+
uses: actions/checkout@v4
90+
91+
- name: Install Rust toolchain
92+
uses: dtolnay/rust-toolchain@stable
93+
with:
94+
toolchain: "1.85"
95+
96+
- name: Cache Rust dependencies
97+
uses: actions/cache@v4
98+
with:
99+
path: |
100+
~/.cargo/registry/index/
101+
~/.cargo/registry/cache/
102+
~/.cargo/git/db/
103+
fuzz/target/
104+
key: ${{ runner.os }}-cargo-fuzz-${{ hashFiles('**/Cargo.lock') }}
105+
restore-keys: |
106+
${{ runner.os }}-cargo-fuzz-
107+
${{ runner.os }}-cargo-
108+
109+
- name: Install cargo-fuzz
110+
run: cargo install cargo-fuzz --locked
111+
112+
- name: Run quick fuzz (corpus only)
113+
run: |
114+
cd fuzz
115+
timeout 120 cargo fuzz run ${{ matrix.target }} -- -runs=0 -max_total_time=120 || true
116+
117+
deep-fuzz:
118+
name: Deep Fuzzing (8 hours)
119+
runs-on: ubuntu-latest
120+
if: github.event_name == 'schedule'
121+
strategy:
122+
fail-fast: false
123+
matrix:
124+
target:
125+
- byte_storage_checksum_collision
126+
- byte_storage_compress
127+
- byte_storage_corrupted_envelope
128+
- byte_storage_decompress
129+
- byte_storage_empty_data
130+
- byte_storage_format_injection
131+
- byte_storage_integer_overflow
132+
- compression_bomb
133+
- encryption_aad_injection
134+
- encryption_key_derivation
135+
- encryption_large_payload
136+
- encryption_nonce_reuse
137+
- encryption_roundtrip
138+
- encryption_truncated_ciphertext
139+
- integration_layered_security
140+
- key_derivation
141+
steps:
142+
- name: Checkout code
143+
uses: actions/checkout@v4
144+
145+
- name: Install Rust toolchain
146+
uses: dtolnay/rust-toolchain@stable
147+
with:
148+
toolchain: "1.85"
149+
150+
- name: Cache Rust dependencies
151+
uses: actions/cache@v4
152+
with:
153+
path: |
154+
~/.cargo/registry/index/
155+
~/.cargo/registry/cache/
156+
~/.cargo/git/db/
157+
fuzz/target/
158+
key: ${{ runner.os }}-cargo-fuzz-${{ hashFiles('**/Cargo.lock') }}
159+
restore-keys: |
160+
${{ runner.os }}-cargo-fuzz-
161+
${{ runner.os }}-cargo-
162+
163+
- name: Install cargo-fuzz
164+
run: cargo install cargo-fuzz --locked
165+
166+
- name: Run deep fuzz (30 minutes per target)
167+
run: |
168+
cd fuzz
169+
timeout 1800 cargo fuzz run ${{ matrix.target }} -- -max_total_time=1800 || true
170+
171+
- name: Upload crash artifacts
172+
if: always()
173+
uses: actions/upload-artifact@v4
174+
with:
175+
name: fuzz-crashes-${{ matrix.target }}
176+
path: fuzz/artifacts/${{ matrix.target }}/
177+
if-no-files-found: ignore
178+
179+
kani:
180+
name: Kani Formal Verification
181+
runs-on: ubuntu-latest
182+
if: github.event_name == 'schedule'
183+
steps:
184+
- name: Checkout code
185+
uses: actions/checkout@v4
186+
187+
- name: Install Rust toolchain
188+
uses: dtolnay/rust-toolchain@stable
189+
with:
190+
toolchain: "1.85"
191+
192+
- name: Cache Rust dependencies
193+
uses: actions/cache@v4
194+
with:
195+
path: |
196+
~/.cargo/registry/index/
197+
~/.cargo/registry/cache/
198+
~/.cargo/git/db/
199+
target/
200+
key: ${{ runner.os }}-cargo-kani-${{ hashFiles('**/Cargo.lock') }}
201+
restore-keys: |
202+
${{ runner.os }}-cargo-kani-
203+
${{ runner.os }}-cargo-
204+
205+
- name: Install Kani
206+
run: |
207+
cargo install --locked kani-verifier || echo "Kani install failed, skipping verification"
208+
cargo kani setup || echo "Kani setup failed, skipping verification"
209+
210+
- name: Run Kani verification
211+
run: cargo kani --all-features || echo "Kani verification failed or not supported"
212+
continue-on-error: true
213+
214+
cargo-vet:
215+
name: Cargo Vet (Supply Chain)
216+
runs-on: ubuntu-latest
217+
if: github.event_name == 'schedule'
218+
steps:
219+
- name: Checkout code
220+
uses: actions/checkout@v4
221+
222+
- name: Install Rust toolchain
223+
uses: dtolnay/rust-toolchain@stable
224+
with:
225+
toolchain: "1.85"
226+
227+
- name: Cache Rust dependencies
228+
uses: actions/cache@v4
229+
with:
230+
path: |
231+
~/.cargo/registry/index/
232+
~/.cargo/registry/cache/
233+
~/.cargo/git/db/
234+
target/
235+
key: ${{ runner.os }}-cargo-vet-${{ hashFiles('**/Cargo.lock') }}
236+
restore-keys: |
237+
${{ runner.os }}-cargo-vet-
238+
${{ runner.os }}-cargo-
239+
240+
- name: Install cargo-vet
241+
run: cargo install cargo-vet --locked
242+
243+
- name: Run cargo vet
244+
run: cargo vet
245+
246+
sbom:
247+
name: Generate SBOM
248+
runs-on: ubuntu-latest
249+
if: github.event_name == 'release'
250+
steps:
251+
- name: Checkout code
252+
uses: actions/checkout@v4
253+
254+
- name: Install Rust toolchain
255+
uses: dtolnay/rust-toolchain@stable
256+
with:
257+
toolchain: "1.85"
258+
259+
- name: Cache Rust dependencies
260+
uses: actions/cache@v4
261+
with:
262+
path: |
263+
~/.cargo/registry/index/
264+
~/.cargo/registry/cache/
265+
~/.cargo/git/db/
266+
target/
267+
key: ${{ runner.os }}-cargo-sbom-${{ hashFiles('**/Cargo.lock') }}
268+
restore-keys: |
269+
${{ runner.os }}-cargo-sbom-
270+
${{ runner.os }}-cargo-
271+
272+
- name: Install cargo-sbom
273+
run: cargo install cargo-sbom --locked
274+
275+
- name: Generate SBOM
276+
run: cargo sbom > cachekit-core-sbom.json
277+
278+
- name: Upload SBOM as release asset
279+
uses: actions/upload-release-asset@v1
280+
env:
281+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
282+
with:
283+
upload_url: ${{ github.event.release.upload_url }}
284+
asset_path: ./cachekit-core-sbom.json
285+
asset_name: cachekit-core-sbom.json
286+
asset_content_type: application/json

‎.release-please-manifest.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
{
2-
".": "0.0.1"
2+
".": "0.1.0"
33
}

‎Cargo.toml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
[package]
22
name = "cachekit-core"
3-
version = "0.0.1"
3+
version = "0.1.0"
44
edition = "2024"
55
authors = ["cachekit Contributors"]
66
description = "LZ4 compression, xxHash3 integrity, AES-256-GCM encryption for byte payloads"
@@ -10,7 +10,7 @@ repository = "https://github.com/cachekit-io/cachekit-core"
1010
homepage = "https://github.com/cachekit-io/cachekit-core"
1111
documentation = "https://docs.rs/cachekit-core"
1212
readme = "README.md"
13-
keywords = ["lz4", "xxhash", "aes-gcm", "encryption", "compression"]
13+
keywords = ["lz4", "xxhash3", "aes-gcm", "encryption", "compression"]
1414
categories = ["compression", "cryptography"]
1515

1616
[lib]

0 commit comments

Comments
 (0)