cachekit-py/.github/workflows/security-fast.yml at 33f7701b786b1a9ec22d1d1a202f0726b24e4ee0 · cachekit-io/cachekit-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
name: Security Fast

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main, develop ]

permissions:
  contents: read
  pull-requests: read

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Fast security checks (< 3 min) - parallel execution
  cargo-audit:
    name: Vulnerability Scan
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Install cargo-audit
      run: cargo install --locked cargo-audit

    - name: Run vulnerability scan
      run: |
        cd rust
        cargo audit --deny warnings

  cargo-deny:
    name: License & Supply Chain
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Install cargo-deny
      run: cargo install --locked cargo-deny

    - name: Run cargo-deny checks
      run: |
        cd rust
        cargo deny check

  clippy-security:
    name: Security Lints
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable
      with:
        components: clippy

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Run Clippy security lints
      run: |
        cd rust
        cargo clippy --no-default-features --features compression,checksum,messagepack,encryption \
          -- -D warnings -W clippy::cargo -W clippy::pedantic

  cargo-machete:
    name: Unused Dependencies
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Set up Rust
      uses: dtolnay/rust-toolchain@stable

    - name: Cache Rust dependencies
      uses: Swatinem/rust-cache@v2
      with:
        workspaces: rust

    - name: Install cargo-machete
      run: cargo install --locked cargo-machete

    - name: Check for unused dependencies
      run: |
        cd rust
        cargo machete

  pip-audit:
    name: Python Dependency CVEs
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
    - uses: actions/checkout@v4

    - name: Install uv
      uses: astral-sh/setup-uv@v3
      with:
        enable-cache: true

    - name: Set up Python
      run: uv python install 3.12

    - name: Cache Python virtual environment
      uses: actions/cache@v4
      with:
        path: .venv
        key: venv-${{ runner.os }}-py3.12-${{ hashFiles('**/pyproject.toml', '**/uv.lock') }}
        restore-keys: |
          venv-${{ runner.os }}-py3.12-

    - name: Install dependencies
      run: |
        uv sync --group dev

    - name: Run pip-audit
      run: |
        uv run pip-audit --desc --format json --output pip-audit-report.json

    - name: Upload report
      if: always()
      uses: actions/upload-artifact@v4
      with:
        name: pip-audit-report
        path: pip-audit-report.json

  # Summary job - fail if any check fails
  security-fast-success:
    name: Security Fast Success
    runs-on: ubuntu-latest
    needs: [cargo-audit, cargo-deny, clippy-security, cargo-machete, pip-audit]
    if: always()
    steps:
    - name: Check all security checks passed
      run: |
        if [[ "${{ needs.cargo-audit.result }}" != "success" ]] || \
           [[ "${{ needs.cargo-deny.result }}" != "success" ]] || \
           [[ "${{ needs.clippy-security.result }}" != "success" ]] || \
           [[ "${{ needs.cargo-machete.result }}" != "success" ]] || \
           [[ "${{ needs.pip-audit.result }}" != "success" ]]; then
          echo "❌ One or more security checks failed"
          exit 1
        fi
        echo "✅ All fast security checks passed"