ci: audit and harden GitHub Actions workflows
- Bump all actions to latest versions (checkout@v6, upload-artifact@v7, download-artifact@v8, labeler@v6, gh-release@v3, gpg-import@v7) - Replace fragile curl|bash tool install with taiki-e/install-action@v2 - Fix Swatinem/rust-cache ordering: must run AFTER toolchain install for correct cache key derivation - Add --all-targets to clippy (CI now matches local testing) - Add RUSTDOCFLAGS=-D warnings to doc step (fail on broken links) - Fix ARM64 build order: install Rust toolchain before adding target and configuring linker - Add rust-toolchain.toml pinning Rust 1.94.0 for deterministic builds - Update Cargo.lock: rustls-webpki v0.103.11->v0.103.13 (fixes 3 CVEs) - Fix softprops/action-gh-release@v3: include checksums in files list (v3 removed the checksum input parameter) - Fix clippy manual_checked_ops lint in screenshot.rs - Clean up trailing whitespace and missing newlines in YAML files
This commit is contained in:
@@ -9,7 +9,7 @@ jobs:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Label PR based on changed files
|
||||
uses: actions/labeler@v5
|
||||
uses: actions/labeler@v6
|
||||
with:
|
||||
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
||||
configuration-path: .github/labeler.yml
|
||||
configuration-path: .github/labeler.yml
|
||||
|
||||
@@ -14,24 +14,30 @@ jobs:
|
||||
quality-checks:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: Swatinem/rust-cache@v2
|
||||
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- uses: ./.github/actions/deps
|
||||
|
||||
|
||||
- name: Install Rust with tools
|
||||
uses: dtolnay/rust-toolchain@stable
|
||||
with:
|
||||
components: rustfmt, clippy
|
||||
|
||||
|
||||
- uses: Swatinem/rust-cache@v2
|
||||
|
||||
- name: Check formatting
|
||||
run: cargo fmt -- --check
|
||||
|
||||
|
||||
- name: Run clippy
|
||||
run: cargo clippy -- -D warnings
|
||||
|
||||
- name: Run unit tests
|
||||
run: cargo clippy --all-targets -- -D warnings
|
||||
|
||||
- name: Run unit tests (default features)
|
||||
run: cargo test --quiet
|
||||
|
||||
|
||||
- name: Run unit tests (all features)
|
||||
run: cargo test --all-features --quiet
|
||||
|
||||
- name: Check documentation
|
||||
run: cargo doc --no-deps --document-private-items
|
||||
env:
|
||||
RUSTDOCFLAGS: -D warnings
|
||||
run: cargo doc --no-deps --document-private-items
|
||||
|
||||
@@ -9,7 +9,7 @@ env:
|
||||
CARGO_TERM_COLOR: always
|
||||
|
||||
jobs:
|
||||
release-build:
|
||||
release-build-x86:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
@@ -33,7 +33,7 @@ jobs:
|
||||
container: ${{ matrix.distro == 'ubuntu' && 'ubuntu:latest' || matrix.distro == 'debian' && 'debian:stable-slim' || matrix.distro == 'fedora' && 'fedora:latest' || 'archlinux:latest' }}
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Install system dependencies (Ubuntu/Debian)
|
||||
if: matrix.distro == 'ubuntu' || matrix.distro == 'debian'
|
||||
@@ -75,31 +75,118 @@ jobs:
|
||||
run: cargo build --release ${{ matrix.args }}
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v4
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: rustlock-${{ matrix.variant }}-${{ matrix.distro }}
|
||||
path: target/release/rustlock
|
||||
|
||||
release-build-arm64:
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
include:
|
||||
- variant: "default"
|
||||
args: ""
|
||||
target: "aarch64-unknown-linux-gnu"
|
||||
- variant: "no-networking"
|
||||
args: "--no-default-features"
|
||||
target: "aarch64-unknown-linux-gnu"
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-toolchain@stable
|
||||
|
||||
- name: Install cross-compilation toolchain
|
||||
run: |
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y \
|
||||
curl \
|
||||
llvm clang libclang-dev \
|
||||
pkg-config \
|
||||
libglib2.0-dev libcairo2-dev libpango1.0-dev libatk1.0-dev \
|
||||
libgdk-pixbuf-2.0-dev libpam0g-dev libdbus-1-dev \
|
||||
libwayland-dev libxkbcommon-dev \
|
||||
gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
|
||||
|
||||
- name: Add ARM target
|
||||
run: rustup target add aarch64-unknown-linux-gnu
|
||||
|
||||
- name: Configure cross-compilation linker
|
||||
run: |
|
||||
mkdir -p ~/.cargo
|
||||
echo '[target.aarch64-unknown-linux-gnu]
|
||||
linker = "aarch64-linux-gnu-gcc"' >> ~/.cargo/config.toml
|
||||
|
||||
- name: Build ${{ matrix.variant }} (ARM64)
|
||||
run: cargo build --release --target aarch64-unknown-linux-gnu ${{ matrix.args }}
|
||||
|
||||
- name: Upload artifact
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: rustlock-${{ matrix.variant }}-arm64
|
||||
path: target/aarch64-unknown-linux-gnu/release/rustlock
|
||||
|
||||
publish-crates:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [release-build-x86]
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v6
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-toolchain@stable
|
||||
|
||||
- name: Publish to crates.io
|
||||
env:
|
||||
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
|
||||
run: cargo publish
|
||||
|
||||
release:
|
||||
runs-on: ubuntu-latest
|
||||
needs: [release-build]
|
||||
needs: [release-build-x86, release-build-arm64, publish-crates]
|
||||
permissions:
|
||||
contents: write
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Download all artifacts
|
||||
uses: actions/download-artifact@v4
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
path: artifacts
|
||||
|
||||
- name: Generate checksums
|
||||
working-directory: artifacts
|
||||
run: |
|
||||
find . -type f -name "rustlock" -exec sha256sum {} \; > SHA256SUMS.txt
|
||||
cat SHA256SUMS.txt
|
||||
|
||||
- name: Import GPG key
|
||||
id: import_gpg
|
||||
uses: crazy-max/ghaction-import-gpg@v7
|
||||
with:
|
||||
gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
|
||||
passphrase: ${{ secrets.GPG_PASSPHRASE }}
|
||||
git_config_global: true
|
||||
git_user_name: JorySeverijnse
|
||||
git_user_email: jory@severijnse.com
|
||||
|
||||
- name: Sign checksums
|
||||
working-directory: artifacts
|
||||
run: |
|
||||
gpg --armor --detach-sign SHA256SUMS.txt
|
||||
|
||||
- name: Determine tag
|
||||
id: tag
|
||||
run: echo "VERSION=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Create Release
|
||||
uses: softprops/action-gh-release@v2
|
||||
uses: softprops/action-gh-release@v3
|
||||
with:
|
||||
tag_name: ${{ github.ref_name }}
|
||||
name: RustLock v${{ steps.tag.outputs.VERSION }}
|
||||
@@ -111,3 +198,8 @@ jobs:
|
||||
artifacts/rustlock-default-debian/rustlock
|
||||
artifacts/rustlock-default-fedora/rustlock
|
||||
artifacts/rustlock-default-arch/rustlock
|
||||
artifacts/rustlock-default-arm64/rustlock
|
||||
artifacts/rustlock-no-networking-arm64/rustlock
|
||||
artifacts/SHA256SUMS.txt
|
||||
artifacts/SHA256SUMS.txt.asc
|
||||
generate_release_notes: true
|
||||
|
||||
@@ -19,42 +19,33 @@ jobs:
|
||||
security-audit:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- uses: Swatinem/rust-cache@v2
|
||||
|
||||
- uses: actions/checkout@v6
|
||||
|
||||
- name: Install Rust
|
||||
uses: dtolnay/rust-toolchain@stable
|
||||
|
||||
|
||||
- uses: Swatinem/rust-cache@v2
|
||||
|
||||
- name: Install security tools
|
||||
run: |
|
||||
curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
|
||||
cargo binstall --no-confirm cargo-audit cargo-deny cargo-cyclonedx cargo-outdated || \
|
||||
cargo install cargo-audit cargo-deny cargo-cyclonedx cargo-outdated
|
||||
|
||||
uses: taiki-e/install-action@v2
|
||||
with:
|
||||
tool: cargo-audit,cargo-deny,cargo-cyclonedx,cargo-outdated
|
||||
|
||||
- name: Run cargo audit
|
||||
run: cargo audit
|
||||
|
||||
|
||||
- name: Run cargo deny
|
||||
run: cargo deny check
|
||||
|
||||
|
||||
- name: Generate Software Bill of Materials (SBOM)
|
||||
run: cargo cyclonedx --format json --override-filename bom
|
||||
|
||||
|
||||
- name: Upload SBOM
|
||||
uses: actions/upload-artifact@v4
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: sbom
|
||||
path: bom.json
|
||||
|
||||
|
||||
- name: Check for outdated dependencies
|
||||
run: cargo outdated --exit-code 1 || echo "Some dependencies are outdated"
|
||||
|
||||
- name: Security summary
|
||||
run: |
|
||||
echo "=== Security Scan Complete ==="
|
||||
echo "✅ cargo audit - Vulnerability scanning"
|
||||
echo "✅ cargo deny - Advisory and license checking"
|
||||
echo "✅ SBOM generated - Software Bill of Materials"
|
||||
echo "✅ Outdated dependencies checked"
|
||||
echo ""
|
||||
echo "Next scheduled scan: Weekly (Sunday 00:00 UTC)"
|
||||
|
||||
|
||||
Reference in New Issue
Block a user