Repository navigation
test: add analytics charts and notification retention tests #390
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| contract-audit: | |
| name: Rust / Soroban Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write # Required to comment on issues | |
| pull-requests: write | |
| defaults: | |
| run: | |
| working-directory: contracts | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts | |
| - name: clippy | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: cargo audit | |
| run: | | |
| cargo install cargo-audit --locked --quiet | |
| cargo audit 2>&1 | tee /tmp/audit-output.txt | |
| exit ${PIPESTATUS[0]} | |
| - name: Soroban pattern check | |
| run: node ../scripts/soroban-security-check.mjs 2>&1 | tee /tmp/soroban-output.txt | |
| - name: Post contract audit summary | |
| if: always() | |
| # Fork PRs get a read-only token; the summary is best-effort. | |
| continue-on-error: true | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const audit = fs.existsSync('/tmp/audit-output.txt') | |
| ? fs.readFileSync('/tmp/audit-output.txt', 'utf8').trim() | |
| : '(no output)' | |
| const soroban = fs.existsSync('/tmp/soroban-output.txt') | |
| ? fs.readFileSync('/tmp/soroban-output.txt', 'utf8').trim() | |
| : '(no output)' | |
| const body = [ | |
| '## 🔐 Contract Security Scan', | |
| '', | |
| '<details><summary>cargo audit</summary>', | |
| '', | |
| '```', | |
| audit, | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>Soroban pattern check</summary>', | |
| '', | |
| '```', | |
| soroban, | |
| '```', | |
| '', | |
| '</details>', | |
| ].join('\n') | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body, | |
| }) | |
| frontend-audit: | |
| name: Frontend Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: npm audit | |
| # Fail on high/critical issues in shipped (production) dependencies, and | |
| # on critical issues anywhere. Dev-only tooling currently carries a high | |
| # advisory (braces) with no patched release upstream. | |
| run: | | |
| set -o pipefail | |
| npm audit --omit=dev --audit-level=high 2>&1 | tee /tmp/npm-audit.txt | |
| npm audit --audit-level=critical 2>&1 | tee -a /tmp/npm-audit.txt | |
| - name: ESLint security | |
| run: npm run lint 2>&1 | tee /tmp/eslint-output.txt; exit ${PIPESTATUS[0]} | |
| - name: Check for hardcoded secrets | |
| run: | | |
| node scripts/check-secrets.mjs 2>&1 | tee /tmp/secrets-output.txt | |
| exit ${PIPESTATUS[0]} | |
| - name: Post frontend audit summary | |
| if: always() | |
| # Fork PRs get a read-only token; the summary is best-effort. | |
| continue-on-error: true | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const read = (p) => fs.existsSync(p) ? fs.readFileSync(p, 'utf8').trim() : '(no output)' | |
| const body = [ | |
| '## 🛡️ Frontend Security Scan', | |
| '', | |
| '<details><summary>npm audit</summary>', | |
| '', | |
| '```', | |
| read('/tmp/npm-audit.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>ESLint</summary>', | |
| '', | |
| '```', | |
| read('/tmp/eslint-output.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>Hardcoded secrets check</summary>', | |
| '', | |
| '```', | |
| read('/tmp/secrets-output.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| ].join('\n') | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body, | |
| }) |