87 lines
1.8 KiB
YAML
87 lines
1.8 KiB
YAML
name: Security
|
|
|
|
# GitHub Actions is public mirror validation only.
|
|
# Primary registry release security evidence must be produced on Russian build-runner.
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
|
|
jobs:
|
|
cargo-audit:
|
|
name: Cargo audit
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
working-directory: adk-rust
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Install stable Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Install cargo-audit
|
|
uses: taiki-e/install-action@cargo-audit
|
|
|
|
- name: cargo audit
|
|
run: cargo audit
|
|
|
|
cargo-deny:
|
|
name: Cargo deny
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Install stable Rust
|
|
uses: dtolnay/rust-toolchain@stable
|
|
|
|
- name: Install cargo-deny
|
|
uses: taiki-e/install-action@cargo-deny
|
|
|
|
- name: cargo deny
|
|
run: cargo deny check advisories licenses sources --config ../deny.toml
|
|
working-directory: adk-rust
|
|
|
|
secret-pattern-check:
|
|
name: Secret pattern check
|
|
runs-on: ubuntu-latest
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Scan for obvious secret patterns
|
|
run: python3 scripts/public_secret_pattern_check.py
|
|
|
|
dependency-review:
|
|
name: Dependency review
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'pull_request'
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
lfs: false
|
|
|
|
- name: Dependency Review
|
|
uses: actions/dependency-review-action@v4
|