presswerk/.github/workflows/security.yml at main · hyperpolymath/presswerk · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# This workflow is managed by gh actions-lock.
# Presswerk — Security scanning (cargo-audit, strict clippy, unwrap detection)

name: Security Scan

on:
  push:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"

permissions:
  actions: read
  contents: read

jobs:
  cargo-audit:
    name: Cargo Audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: stable
      - uses: Swatinem/rust-cache@v2.9.2

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit
        run: cargo audit

  clippy-strict:
    name: Clippy (Strict / Library Crates)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: dtolnay/rust-toolchain@v1
        with:
          toolchain: stable
          components: clippy
      - uses: Swatinem/rust-cache@v2.9.2

      - name: Install system dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y libxdo-dev libwebkit2gtk-4.1-dev libgtk-3-dev libayatana-appindicator3-dev libsoup-3.0-dev libjavascriptcoregtk-4.1-dev

      - name: Clippy pedantic (library crates)
        run: |
          cargo clippy \
            -p presswerk-core \
            -p presswerk-security \
            -p presswerk-document \
            -p presswerk-print \
            -- -D warnings -W clippy::pedantic

  panic-check:
    name: Panic Surface Check (Informational)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7.0.1

      - name: Count unwrap/expect usage outside tests
        run: |
          echo "=== Scanning for unwrap()/expect() in crates/ ==="
          echo "(Excluding #[cfg(test)] and mod tests blocks)"
          echo ""
          count=0
          while IFS= read -r file; do
            results=$(awk '
              /^[[:space:]]*#\[cfg\(test\)\]/ { skip=1; next }
              /^[[:space:]]*mod tests/ { skip=1; brace=0; next }
              skip && /{/ { brace++ }
              skip && /}/ { brace--; if (brace<=0) skip=0; next }
              skip { next }
              /\.unwrap\(\)|\.expect\(/ { print FILENAME ":" NR ": " $0 }
            ' "$file")
            if [ -n "$results" ]; then
              echo "$results"
              file_count=$(echo "$results" | wc -l)
              count=$((count + file_count))
            fi
          done < <(find crates/ -name '*.rs' -type f)
          echo ""
          echo "=== Total unwrap()/expect() calls outside test code: $count ==="
          if [ "$count" -gt 0 ]; then
            echo "::notice::Found $count unwrap()/expect() calls outside test code."
          else
            echo "::notice::No unwrap()/expect() calls found outside test code."
          fi
          exit 0