test(enforcement): behavioral proof for ENFORCE_SIGNAL gate promotion #654
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, develop] | |
| schedule: | |
| - cron: "0 6 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| dependency-review: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Detect dependency graph availability | |
| id: dep-graph | |
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | |
| with: | |
| script: | | |
| const {owner, repo} = context.repo; | |
| const {data} = await github.rest.repos.get({owner, repo}); | |
| const status = data.security_and_analysis?.dependency_graph?.status ?? "unknown"; | |
| core.info(`dependency_graph status: ${status}`); | |
| core.setOutput("enabled", status === "enabled" ? "true" : "false"); | |
| - name: Dependency review (fail on high/critical CVEs when supported) | |
| id: dependency_review | |
| if: steps.dep-graph.outputs.enabled == 'true' | |
| continue-on-error: true | |
| uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4 | |
| with: | |
| fail-on-severity: high | |
| - name: Handle unsupported dependency-review | |
| if: steps.dep-graph.outputs.enabled == 'true' && steps.dependency_review.outcome == 'failure' | |
| run: | | |
| echo "::warning::dependency-review action could not run in this repository context." | |
| echo "::warning::Enable Dependency Graph in repository settings to enforce dependency CVE policy." | |
| - name: Skip dependency review when dependency graph is disabled | |
| if: steps.dep-graph.outputs.enabled != 'true' | |
| run: | | |
| echo "::warning::Dependency graph is disabled for this repository; skipping dependency-review check." | |
| codeql: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@fee9466b8957867761f2d78f922ab084e3e2dd17 # v3 | |
| with: | |
| languages: cpp | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clang llvm libbpf-dev libsystemd-dev pkg-config cmake ninja-build | |
| - name: Build (CodeQL) | |
| run: | | |
| cmake -S . -B build-codeql -G Ninja -DCMAKE_BUILD_TYPE=Debug -DBUILD_TESTING=ON -DSKIP_BPF_BUILD=ON | |
| cmake --build build-codeql | |
| - name: Analyze | |
| uses: github/codeql-action/analyze@fee9466b8957867761f2d78f922ab084e3e2dd17 # v3 | |
| gitleaks: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Secret scan | |
| uses: gitleaks/gitleaks-action@dcedce43c6f43de0b836d1fe38946645c9c638dc # v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| semgrep: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install semgrep | |
| run: | | |
| python3 -m venv .venv | |
| ./.venv/bin/pip install --upgrade pip | |
| ./.venv/bin/pip install semgrep | |
| echo "$PWD/.venv/bin" >> "$GITHUB_PATH" | |
| - name: Run semgrep | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| DIFF_RANGE: ${{ github.event_name == 'push' && format('{0}...{1}', github.event.before, github.sha) || '' }} | |
| SCAN_ALL: ${{ github.event_name == 'schedule' && '1' || '0' }} | |
| run: scripts/run_semgrep_changed.sh |