Merge pull request #1296 from kingksjo/feat/issues-1146-1149-979-983 #1059
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Audit | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: | | |
| backend/package-lock.json | |
| frontend/package-lock.json | |
| packages/api-schemas/package-lock.json | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Build shared API schemas | |
| run: npm ci && npm run build | |
| working-directory: packages/api-schemas | |
| - name: Install backend dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| working-directory: frontend | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --version 0.22.1 --locked | |
| - name: Run cargo audit | |
| run: | | |
| cargo audit --ignore RUSTSEC-2026-0097 \ | |
| --ignore RUSTSEC-2024-0388 \ | |
| --ignore RUSTSEC-2024-0436 \ | |
| --json > cargo-audit.json || true | |
| node scripts/dependency-audit.js cargo cargo-audit cargo-audit.json | |
| - name: Run npm audit for backend | |
| run: | | |
| npm audit --json > backend/backend-audit.json || true | |
| node scripts/dependency-audit.js npm backend backend/backend-audit.json | |
| - name: Run npm audit for frontend | |
| run: | | |
| npm audit --json > frontend/frontend-audit.json || true | |
| node scripts/dependency-audit.js npm frontend frontend/frontend-audit.json | |
| - name: Run cargo-clippy (share-price math) | |
| run: cargo clippy -p share-price-math --all-targets -- -D warnings | |
| working-directory: contracts | |
| continue-on-error: true | |
| - name: Run cargo-deny (supply chain security) | |
| run: | | |
| cargo install cargo-deny --version 0.18.3 --locked | |
| cargo deny check advisories | |
| - name: Check for unsafe code | |
| run: | | |
| echo "🔍 Scanning for unsafe code blocks..." | |
| if grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"; then | |
| echo "⚠️ Unsafe code found in non-test code. Please review:" | |
| grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz" | |
| echo "" | |
| echo "✓ Verify these unsafe blocks are documented and necessary" | |
| else | |
| echo "✓ No unsafe code found in production code" | |
| fi | |
| - name: Set up Rust nightly (cargo-fuzz) | |
| uses: dtolnay/rust-toolchain@nightly | |
| - name: Install cargo-fuzz | |
| run: cargo +nightly install cargo-fuzz --locked | |
| - name: Run vault share-price fuzz (60s) | |
| run: | | |
| cd contracts/vault | |
| cargo +nightly fuzz run share_price_math -- -max_total_time=60 | |
| - name: Notify Slack on security audit failure | |
| if: failure() | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| if [ -z "$SLACK_WEBHOOK_URL" ]; then | |
| echo "SECURITY_SLACK_WEBHOOK_URL secret is not set; skipping Slack notification." | |
| exit 0 | |
| fi | |
| text="🚨 Security audit failed on *${GITHUB_REPOSITORY}* (${GITHUB_REF_NAME}, run <${RUN_URL}|#${GITHUB_RUN_ID}>). Review cargo-audit / cargo-deny / fuzz findings before merging." | |
| payload=$(jq -n --arg text "$text" '{text: $text}') | |
| curl --fail --silent --show-error -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "$payload" \ | |
| "$SLACK_WEBHOOK_URL" |