Security audit #3051
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security audit | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| zizmor: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false } | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 | |
| audit: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| checks: write | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false } | |
| - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| ignore: RUSTSEC-2023-0071,RUSTSEC-2024-0436,RUSTSEC-2025-0119,RUSTSEC-2025-0134,RUSTSEC-2026-0002,RUSTSEC-2026-0007,RUSTSEC-2026-0049,RUSTSEC-2026-0097,RUSTSEC-2026-0098,RUSTSEC-2026-0099,RUSTSEC-2026-0104,RUSTSEC-2026-0105,RUSTSEC-2025-0141,RUSTSEC-2026-0145 | |
| # RUSTSEC-2023-0071 = Marvin Attack: potential key recovery through timing side channels => not used exploitably | |
| # RUSTSEC-2024-0436 = paste - no longer maintained | |
| # RUSTSEC-2025-0119 = number_prefix is unmaintained, but we need no change in this lib | |
| # RUSTSEC-2025-0134 = rustls-pemfile is unmaintained, but only used in development dependencies | |
| # RUSTSEC-2026-0002 = unsound stack borrow in lru | |
| # RUSTSEC-2026-0007 = integer overflow in bytes | |
| # RUSTSEC-2026-0049 = rustls-webpki@0.101.7 CRL matching bug; stuck in aws-smithy-http-client's legacy rustls@0.21 chain, cannot be upgraded without an upstream aws-sdk-s3 release | |
| # RUSTSEC-2026-0097 = rand unsoundness with custom logger + rand::rng(); pinned by probabilistic-collections 0.7.0 (rand 0.7) and sqlx 0.8 (rand 0.8), neither have updates available | |
| # RUSTSEC-2026-0098 = rustls-webpki name constraints for URI names; remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0099 = rustls-webpki wildcard name constraints; remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0104 = rustls-webpki CRL parsing panic; only remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0105 = core2 unmaintained | |
| # RUSTSEC-2025-0141 = bincode unmaintained, is done | |
| # RUSTSEC-2026-0145 = astral-tokio-tar header desync, not used exploitably | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false } | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: low | |
| license-check: false # incredibly high maintenance cost, also many false positives and not ability to ignore issues like "MIT/APACHE2" being used | |
| show-openssf-scorecard: true | |
| warn-on-openssf-scorecard-level: 5 | |
| allow-ghsas: GHSA-cq8v-f236-94qc # rand@0.7.3 unsoundness with custom logger; pinned by probabilistic-collections 0.7.0, cannot be upgraded | |
| # actions/dependency-review-action does not find all licenses -> we use cargo-deny for this in addition to dependency-review-action | |
| - uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20 | |
| with: | |
| command: check bans licenses sources | |
| codeql: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # required for all workflows | |
| security-events: write | |
| # required to fetch internal or private CodeQL packs | |
| packages: read | |
| # only required for workflows in private repositories | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| - language: javascript-typescript | |
| - language: rust | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: { persist-credentials: false } | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 | |
| with: | |
| category: "/language:${{matrix.language}}" |