igor04091968
121d66cfcf
CI / Rust checks (push) Canceled after 0s
CI / Docs and registry checks (push) Canceled after 0s
CI / Smoke checks (push) Canceled after 0s
Coverage / Coverage baseline (push) Canceled after 0s
Dependency hygiene / Unused dependency check (push) Canceled after 0s
Dependency hygiene / Dependency duplicate report (push) Canceled after 0s
Dependency hygiene / Dependency security policy (push) Canceled after 0s
Dependency hygiene / Cargo udeps nightly advisory (push) Canceled after 0s
Operational maturity / Offline operational maturity (push) Canceled after 0s
Operational maturity / Live operational contract (push) Canceled after 0s
Security / Cargo audit (push) Canceled after 0s
Security / Cargo deny (push) Canceled after 0s
Security / Secret pattern check (push) Canceled after 0s
Security / Dependency review (push) Canceled after 0s
74 lines
1.8 KiB
YAML
74 lines
1.8 KiB
YAML
name: Operational maturity
|
|
|
|
# GitHub Actions is public mirror validation only.
|
|
# Live DetMir production checks must be run explicitly by an operator with
|
|
# private network access and must not enable heavy DLP, Loki or always-on
|
|
# Velociraptor.
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
live:
|
|
description: "Run live endpoint contract if AWATCH_OPS_LIVE_URL is configured"
|
|
required: false
|
|
default: "false"
|
|
schedule:
|
|
- cron: "41 3 * * 2"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
offline-operational-maturity:
|
|
name: Offline operational maturity
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Install Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Script syntax
|
|
run: node --check scripts/operational-maturity-check.mjs
|
|
|
|
- name: Operational maturity harness
|
|
run: node scripts/operational-maturity-check.mjs --json
|
|
|
|
live-operational-contract:
|
|
name: Live operational contract
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'workflow_dispatch' && inputs.live == 'true'
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Install Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: "20"
|
|
|
|
- name: Run live contract when URL is available
|
|
env:
|
|
AWATCH_OPS_LIVE_URL: ${{ secrets.AWATCH_OPS_LIVE_URL }}
|
|
run: |
|
|
if [[ -z "${AWATCH_OPS_LIVE_URL}" ]]; then
|
|
echo "skipped: AWATCH_OPS_LIVE_URL secret is not configured"
|
|
exit 0
|
|
fi
|
|
node scripts/operational-maturity-check.mjs --json --live
|