Repository navigation
docs: fix type preservation claims in comparison.md #398
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Fast | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main, develop ] | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| checks: write # Required for rustsec/audit-check to create check runs | |
| security-events: write | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Fast security checks (< 3 min) - parallel execution | |
| cargo-audit: | |
| name: Vulnerability Scan | |
| runs-on: cachekit | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| cargo-deny: | |
| name: License & Supply Chain | |
| runs-on: cachekit | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install cargo-deny | |
| run: cargo install --locked cargo-deny | |
| - name: Run cargo-deny | |
| run: cargo deny --all-features check | |
| clippy-security: | |
| name: Security Lints | |
| runs-on: cachekit | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Run Clippy security lints | |
| run: | | |
| cd rust | |
| cargo clippy --no-default-features --features compression,checksum,messagepack,encryption \ | |
| -- -D warnings -W clippy::cargo -W clippy::pedantic | |
| cargo-machete: | |
| name: Unused Dependencies | |
| runs-on: cachekit | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install cargo-machete | |
| run: cargo install --locked cargo-machete | |
| - name: Check for unused dependencies | |
| run: | | |
| cd rust | |
| cargo machete | |
| pip-audit: | |
| name: Python Dependency CVEs | |
| runs-on: cachekit | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Install dependencies | |
| run: | | |
| uv sync --group dev | |
| - name: Run pip-audit | |
| run: | | |
| # No suppressions: every prior CVE is resolved at source on the py3.10+ | |
| # resolution. urllib3>=2.7.0 and pip>=26.1.2 are pinned via | |
| # [tool.uv] constraint-dependencies; pygments/pyarrow advisories cleared | |
| # by their py3.10+ fix versions. Keep this list IDENTICAL to ci.yml's | |
| # post-merge pip-audit so the two cannot drift. | |
| uv run pip-audit --desc --format json --output pip-audit-report.json | |
| - name: Upload report | |
| if: always() | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 | |
| with: | |
| name: pip-audit-report | |
| path: pip-audit-report.json | |
| # Summary job - fail if any check fails | |
| security-fast-success: | |
| name: Security Fast Success | |
| runs-on: ubuntu-latest | |
| needs: [cargo-audit, cargo-deny, clippy-security, cargo-machete, pip-audit] | |
| if: always() | |
| steps: | |
| - name: Check all security checks passed | |
| run: | | |
| if [[ "${{ needs.cargo-audit.result }}" != "success" ]] || \ | |
| [[ "${{ needs.cargo-deny.result }}" != "success" ]] || \ | |
| [[ "${{ needs.clippy-security.result }}" != "success" ]] || \ | |
| [[ "${{ needs.cargo-machete.result }}" != "success" ]] || \ | |
| [[ "${{ needs.pip-audit.result }}" != "success" ]]; then | |
| echo "❌ One or more security checks failed" | |
| exit 1 | |
| fi | |
| echo "✅ All fast security checks passed" |