From 365d34967ff3644ce54d5da350693810313d720e Mon Sep 17 00:00:00 2001 From: brite-side0 Date: Sat, 30 May 2026 17:32:52 +0000 Subject: [PATCH] feat: CI security hardening - Dependabot, SHA pinning, toolchain & cache upgrades Closes #632 Closes #633 Closes #634 Closes #635 Co-Authored-By: Claude Sonnet 4.6 --- .github/dependabot.yml | 19 ++++++ .github/workflows/dependency-scan.yml | 8 +-- .github/workflows/deploy.yml | 2 +- .github/workflows/docker.yml | 2 +- .github/workflows/test.yml | 95 ++++++--------------------- 5 files changed, 43 insertions(+), 83 deletions(-) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 00000000..9ae6de36 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,19 @@ +version: 2 +updates: + - package-ecosystem: npm + directory: /frontend + schedule: + interval: weekly + open-pull-requests-limit: 10 + + - package-ecosystem: npm + directory: /services/tts + schedule: + interval: weekly + open-pull-requests-limit: 10 + + - package-ecosystem: github-actions + directory: / + schedule: + interval: weekly + open-pull-requests-limit: 10 diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml index cb98b290..098cd0cf 100644 --- a/.github/workflows/dependency-scan.yml +++ b/.github/workflows/dependency-scan.yml @@ -16,11 +16,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Install cargo-audit run: cargo install cargo-audit @@ -79,7 +75,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # master with: scan-type: 'fs' scan-ref: '.' diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 7a853dc7..1969ae11 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -84,7 +84,7 @@ jobs: PROMETHEUS_URL: ${{ secrets.PROMETHEUS_URL }} - name: Download plan - uses: actions/download-artifact@v3 + uses: actions/download-artifact@v4 with: name: tfplan-${{ matrix.environment }} path: infrastructure/terraform diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 5fe018cf..6fae3ca9 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -63,7 +63,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # master with: image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest format: 'sarif' diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ac056224..f7153574 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -42,11 +42,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache cargo registry uses: actions/cache@v5 @@ -85,11 +81,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache dependencies uses: actions/cache@v5 @@ -114,11 +106,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache dependencies uses: actions/cache@v5 @@ -140,11 +128,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache dependencies uses: actions/cache@v5 @@ -214,11 +198,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache dependencies uses: actions/cache@v5 @@ -266,11 +246,8 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 + uses: dtolnay/rust-toolchain@stable with: - profile: minimal - toolchain: stable - override: true components: llvm-tools-preview - name: Install cargo-llvm-cov @@ -334,11 +311,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Install cargo-audit run: cargo install cargo-audit @@ -397,7 +370,7 @@ jobs: GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }} - name: Run TruffleHog - uses: trufflesecurity/trufflehog@main + uses: trufflesecurity/trufflehog@9f0b97f1600cd5f51e5ecb8380087807acb790f9 # main with: path: ./ base: ${{ github.event.repository.default_branch }} @@ -411,7 +384,7 @@ jobs: - uses: actions/checkout@v4 - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # master with: scan-type: "fs" scan-ref: "." @@ -451,7 +424,7 @@ jobs: continue-on-error: true - name: Scan API container with Trivy - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@314ff8b43182423b84c50b1670b0e10f858f2d98 # master if: success() with: image-ref: "predictiq-api:${{ github.sha }}" @@ -499,11 +472,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable components: clippy - name: Run Clippy @@ -517,11 +486,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable components: clippy - name: Clippy (deny warnings) — oracle module @@ -551,11 +516,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable components: rustfmt - name: Check formatting @@ -569,11 +530,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable target: wasm32-unknown-unknown - name: Install Soroban CLI @@ -608,11 +565,7 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache cargo dependencies uses: actions/cache@v5 @@ -725,14 +678,10 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache cargo dependencies - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: | ~/.cargo/registry @@ -764,7 +713,7 @@ jobs: - name: Upload benchmark results if: always() - uses: actions/upload-artifact@v3 + uses: actions/upload-artifact@v4 with: name: api-benchmark-results path: | @@ -781,14 +730,10 @@ jobs: - uses: actions/checkout@v4 - name: Install Rust - uses: actions-rs/toolchain@v1 - with: - profile: minimal - toolchain: stable - override: true + uses: dtolnay/rust-toolchain@stable - name: Cache cargo dependencies - uses: actions/cache@v3 + uses: actions/cache@v4 with: path: | ~/.cargo/registry