Repository navigation
chore(deps): update github-actions #504
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Saturday 11:07 UTC = Sat 21:07 AEST / 22:07 AEDT (Sydney night, year-round). | |
| # Weekly cadence: deep fuzz at 1h/target × 16 targets. Each matrix target is a | |
| # separate GitHub-hosted job, so they run in parallel (bounded by GitHub's | |
| # concurrency limit) rather than serialising on shared runners — and hosted minutes | |
| # are free for public repos. The longer opt-in run is via workflow_dispatch | |
| # (run_deep_fuzz). PR-time coverage (cargo audit/deny, Cargo Vet, Quick Fuzz, | |
| # CodeQL) catches regressions promptly; deep fuzz is for finding bugs, not | |
| # gating merges. Off-minute (:07) avoids the cron pile-up GitHub schedules at :00. | |
| - cron: '7 11 * * 6' | |
| # Deliberately no `release:` trigger. It existed only for an SBOM job that | |
| # attached a release asset, and that can never work here: immutable releases | |
| # are enabled on this repo and GitHub seals a release's assets at publish, so | |
| # the upload always failed with "Cannot upload assets to an immutable release" | |
| # — every release since v0.1.0 has zero assets (LAB-983). The SBOM is generated | |
| # and attested in release.yml via actions/attest-sbom; that attestation is the | |
| # verifiable artifact, and a plain release asset would be an unsigned weaker | |
| # copy of it. Re-adding this alone only makes empty runs; the asset upload would | |
| # additionally need the release created as a draft, attached, then published. | |
| # On-demand: lets the schedule-only jobs (e.g. Kani) be run and verified | |
| # without waiting for the weekly cron. A plain dispatch does NOT trigger the | |
| # heavy deep-fuzz matrix — set run_deep_fuzz=true to opt into that. | |
| workflow_dispatch: | |
| inputs: | |
| run_deep_fuzz: | |
| description: "Run the full deep-fuzz matrix (heavy — one hosted job per target)" | |
| type: boolean | |
| default: false | |
| fuzz_seconds: | |
| description: "Seconds per target for an on-demand deep fuzz (default 5h; hard cap 18000s to fit GitHub's 6h job limit)" | |
| type: string | |
| default: "18000" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| jobs: | |
| fast-security: | |
| name: Fast Security Checks | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable | |
| with: | |
| toolchain: "stable" | |
| components: clippy | |
| - name: Cache Rust dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-security-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-security- | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Install cargo-deny | |
| run: cargo install cargo-deny --locked | |
| - name: Run cargo audit (CVE scanning) | |
| run: cargo audit | |
| - name: Run cargo deny (license compliance + advisories) | |
| run: cargo deny check | |
| - name: Run clippy (strict linting) | |
| run: cargo clippy --all-features --all-targets -- -D warnings | |
| - name: Run tests | |
| run: cargo test --all-features | |
| quick-fuzz: | |
| name: Quick Fuzz (Corpus Only) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'push' || github.event_name == 'pull_request' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - byte_storage_checksum_collision | |
| - byte_storage_compress | |
| - byte_storage_corrupted_envelope | |
| - byte_storage_decompress | |
| - byte_storage_empty_data | |
| - byte_storage_format_injection | |
| - byte_storage_integer_overflow | |
| - compression_bomb | |
| - encryption_aad_injection | |
| - encryption_key_derivation | |
| - encryption_large_payload | |
| - encryption_nonce_reuse | |
| - encryption_roundtrip | |
| - encryption_truncated_ciphertext | |
| - integration_layered_security | |
| - key_derivation | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly | |
| - name: Cache Rust dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| fuzz/target/ | |
| key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-fuzz-nightly- | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-fuzz | |
| # NOTE: --locked omitted: cargo-fuzz 0.13.1's published Cargo.lock pins | |
| # rustix 0.36.5, which uses unstable `rustc_attrs` cfg gates that newer | |
| # nightly rustc rejects. Let cargo resolve fresh deps. | |
| run: cargo install cargo-fuzz | |
| - name: Run quick fuzz (corpus only) | |
| run: | | |
| cd fuzz | |
| # Build first - fail fast on compile errors | |
| cargo fuzz build ${{ matrix.target }} | |
| # libFuzzer self-exits at -max_total_time (graceful "Done ..."); the outer | |
| # `timeout` is a +30s hang safety-net only. Buffer matters because libFuzzer's | |
| # clock starts after build/corpus-load, so an equal `timeout` would always | |
| # SIGTERM first ("run interrupted") and the graceful path would be unreachable. | |
| # Exit 124 (timeout fired = genuine hang) is still tolerated. | |
| timeout 150 cargo fuzz run ${{ matrix.target }} -- -runs=0 -max_total_time=120 || [ $? -eq 124 ] | |
| deep-fuzz: | |
| name: Deep Fuzzing | |
| runs-on: ubuntu-latest | |
| # Scheduled weekly run is light (1h/target). The longer on-demand run is opt-in | |
| # via workflow_dispatch (run_deep_fuzz) and clamped to fit the hosted 6h cap. | |
| if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_deep_fuzz) | |
| # 360min = GitHub's hosted job cap. The inner timeout governs the actual | |
| # scheduled (1h) vs dispatched (<=5h, clamped below) duration. | |
| timeout-minutes: 360 | |
| permissions: | |
| contents: read | |
| actions: read # list and download the previous run's corpus artifact | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| target: | |
| - byte_storage_checksum_collision | |
| - byte_storage_compress | |
| - byte_storage_corrupted_envelope | |
| - byte_storage_decompress | |
| - byte_storage_empty_data | |
| - byte_storage_format_injection | |
| - byte_storage_integer_overflow | |
| - compression_bomb | |
| - encryption_aad_injection | |
| - encryption_key_derivation | |
| - encryption_large_payload | |
| - encryption_nonce_reuse | |
| - encryption_roundtrip | |
| - encryption_truncated_ciphertext | |
| - integration_layered_security | |
| - key_derivation | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly | |
| - name: Cache Rust dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| fuzz/target/ | |
| key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-fuzz-nightly- | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-fuzz | |
| # NOTE: --locked omitted: cargo-fuzz 0.13.1's published Cargo.lock pins | |
| # rustix 0.36.5, which uses unstable `rustc_attrs` cfg gates that newer | |
| # nightly rustc rejects. Let cargo resolve fresh deps. | |
| run: cargo install cargo-fuzz | |
| - name: Find previous fuzz corpus | |
| id: corpus | |
| # Each run resumes from the corpus the previous run uploaded, so coverage | |
| # accumulates instead of restarting cold. An artifact, not the Actions cache: | |
| # cache entries are evicted under size pressure and after 7 days unused, which | |
| # a weekly run cannot outlast. Only this repository's runs on the same ref | |
| # qualify, so a branch or fork run cannot seed this one. | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TARGET: ${{ matrix.target }} | |
| REF_NAME: ${{ github.ref_name }} | |
| REPO_ID: ${{ github.repository_id }} | |
| run: | | |
| # Two steps, so a failed listing fails this step (set -e) instead of | |
| # reading as "no artifact". --paginate walks every page: newer artifacts | |
| # from other branches must not push this ref's corpus off page one. | |
| artifacts=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=fuzz-corpus-${TARGET}&per_page=100" \ | |
| --jq '.artifacts[]') | |
| run_id=$(jq -rs --arg ref "$REF_NAME" --argjson repo "$REPO_ID" ' | |
| [.[] | |
| | select(.expired | not) | |
| | select(.workflow_run.head_branch == $ref and .workflow_run.head_repository_id == $repo)] | |
| | sort_by(.created_at) | last | .workflow_run.id // empty' <<< "$artifacts") | |
| if [ -z "$run_id" ]; then | |
| echo "::warning::No fuzz-corpus-${TARGET} artifact from ${REF_NAME}; starting from an empty corpus" | |
| fi | |
| echo "run_id=${run_id}" >> "$GITHUB_OUTPUT" | |
| - name: Restore fuzz corpus | |
| if: steps.corpus.outputs.run_id != '' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: fuzz-corpus-${{ matrix.target }} | |
| path: fuzz/corpus/${{ matrix.target }} | |
| run-id: ${{ steps.corpus.outputs.run_id }} | |
| github-token: ${{ github.token }} | |
| - name: Run deep fuzz | |
| # Scheduled runs use 1h/target; a manual workflow_dispatch can request a | |
| # longer duration (up to the 5h clamp below) via fuzz_seconds. | |
| env: | |
| FUZZ_SECONDS: ${{ (github.event_name == 'workflow_dispatch' && inputs.fuzz_seconds) || '3600' }} | |
| run: | | |
| # Validate the dispatch-supplied duration before it reaches shell arithmetic | |
| # and the fuzzer. Must be a positive integer within the hosted 6h job cap. | |
| # Ceiling is 18000s (5h): +180s hang slack (below) still leaves headroom | |
| # under timeout-minutes 360 (21600s), so a dispatched job cannot exceed 6h. | |
| case "$FUZZ_SECONDS" in | |
| ''|*[!0-9]*) echo "::error::fuzz_seconds must be a positive integer (got '$FUZZ_SECONDS')"; exit 1 ;; | |
| esac | |
| if [ "$FUZZ_SECONDS" -lt 1 ] || [ "$FUZZ_SECONDS" -gt 18000 ]; then | |
| echo "::error::fuzz_seconds must be 1..18000 (<= 6h hosted job cap), got $FUZZ_SECONDS"; exit 1 | |
| fi | |
| cd fuzz | |
| # Build first - fail fast on compile errors | |
| cargo fuzz build ${{ matrix.target }} | |
| # libFuzzer self-exits at -max_total_time with a graceful "Done N runs ..." | |
| # (final stats + corpus consolidation). The outer `timeout` is +3min slack so | |
| # it only fires on a genuine hang — NOT as the normal end-of-budget stop. An | |
| # equal `timeout` would always win the race (libFuzzer's clock starts later, | |
| # after build/corpus-load) and every run would log "run interrupted" instead, | |
| # making a real hang indistinguishable from normal completion. Exit 124 (hang | |
| # killed by timeout) remains tolerated. | |
| timeout "$((FUZZ_SECONDS + 180))" cargo fuzz run ${{ matrix.target }} -- -max_total_time="$FUZZ_SECONDS" || [ $? -eq 124 ] | |
| - name: Save fuzz corpus | |
| # always(): a run that found a crash still grew the corpus. | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: fuzz-corpus-${{ matrix.target }} | |
| path: fuzz/corpus/${{ matrix.target }}/ | |
| retention-days: 90 | |
| if-no-files-found: warn | |
| - name: Upload crash artifacts | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: fuzz-crashes-${{ matrix.target }} | |
| path: fuzz/artifacts/${{ matrix.target }}/ | |
| if-no-files-found: ignore | |
| kani: | |
| name: Kani Formal Verification | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| permissions: | |
| contents: read # least-privilege: the job only checks out and verifies | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master | |
| with: | |
| # Host toolchain for the kani-verifier installer only — Kani downloads its | |
| # own pinned verification toolchain in `cargo kani setup`. Must be current | |
| # stable: kani-verifier's deps (e.g. home 0.5.12) now require rustc >= 1.88, | |
| # so the old "1.85" pin failed to compile the installer. | |
| toolchain: stable | |
| - name: Cache Rust dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-kani-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-kani- | |
| ${{ runner.os }}-cargo- | |
| - name: Install Kani | |
| # No `|| echo` swallowing: a failed install/setup MUST fail the job. Silently | |
| # skipping verification gives false green-CI assurance. --force makes the | |
| # install idempotent on the runner's persistent cargo cache. | |
| run: | | |
| cargo install --locked --force kani-verifier | |
| cargo kani setup | |
| - name: Run Kani verification | |
| # No continue-on-error, no `|| echo`: a failed proof must turn CI red. | |
| run: cargo kani --all-features | |
| cargo-vet: | |
| name: Cargo Vet (Supply Chain) | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'schedule' || github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master | |
| with: | |
| toolchain: "1.99" | |
| - name: Cache Rust dependencies | |
| uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 | |
| with: | |
| path: | | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| target/ | |
| key: ${{ runner.os }}-cargo-vet-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-vet- | |
| ${{ runner.os }}-cargo- | |
| - name: Install cargo-vet | |
| run: cargo install cargo-vet --locked | |
| - name: Run cargo vet | |
| run: cargo vet |