mirror of
https://github.com/XRPLF/rippled.git
synced 2026-08-21 14:20:56 +00:00
85 lines
2.4 KiB
YAML
85 lines
2.4 KiB
YAML
# This workflow audits the Rust dependencies in crates/ for known security
|
|
# advisories using cargo-audit. It runs on a weekly schedule, whenever the
|
|
# dependency graph changes (Cargo.lock / Cargo.toml), and on demand. On a
|
|
# scheduled run, a failure opens a tracking issue (matching the clang-tidy
|
|
# workflow's behavior); on push/PR it simply fails the check.
|
|
name: Cargo audit
|
|
|
|
on:
|
|
schedule:
|
|
# 06:32 UTC every Monday.
|
|
- cron: "32 6 * * 1"
|
|
push:
|
|
branches:
|
|
- "develop"
|
|
- "release*"
|
|
paths:
|
|
- "crates/**/Cargo.toml"
|
|
- "crates/Cargo.lock"
|
|
- ".github/workflows/cargo-audit.yml"
|
|
pull_request:
|
|
paths:
|
|
- "crates/**/Cargo.toml"
|
|
- "crates/Cargo.lock"
|
|
- ".github/workflows/cargo-audit.yml"
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: crates
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
container: ghcr.io/xrplf/xrpld/nix-debian:sha-2e25435
|
|
permissions:
|
|
contents: read
|
|
# Needed to open an issue on scheduled failures.
|
|
issues: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
|
|
- name: Run cargo audit
|
|
id: audit
|
|
continue-on-error: true
|
|
run: |
|
|
set -o pipefail
|
|
cargo audit | tee /tmp/cargo-audit.txt
|
|
|
|
- name: Prepare issue body
|
|
if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
|
|
run: |
|
|
{
|
|
echo "## \`cargo audit\` found advisories"
|
|
echo
|
|
echo '```'
|
|
cat /tmp/cargo-audit.txt
|
|
echo '```'
|
|
echo
|
|
echo "---"
|
|
echo "*This issue was automatically created by the cargo-audit workflow.*"
|
|
} >/tmp/cargo-audit-issue.md
|
|
|
|
- name: Create issue
|
|
if: ${{ steps.audit.outcome != 'success' && github.event_name == 'schedule' }}
|
|
uses: XRPLF/actions/create-issue@2b8bc36af85b88bca0dd7bfac2e2dc05f94ad712
|
|
with:
|
|
title: "cargo audit found vulnerabilities"
|
|
body_file: /tmp/cargo-audit-issue.md
|
|
labels: "Bug,Security"
|
|
|
|
- name: Fail if advisories were found
|
|
if: ${{ steps.audit.outcome != 'success' }}
|
|
run: |
|
|
echo "cargo audit found advisories!"
|
|
exit 1
|