security.yml

name: Code Foundry Security

on:
  workflow_call:
    inputs:
      runtime-repository:
        description: Repository containing the Code Foundry runtime.
        required: false
        type: string
        default: 0xPlayerOne/code-foundry
      runtime-ref:
        description: Code Foundry runtime tag or ref.
        required: false
        type: string
        default: v1.0.5
      runner:
        description: Runner used by Security jobs.
        required: false
        type: string
        default: ubuntu-slim
permissions:
  contents: read

env:
  REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
  REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
  REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
  REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
  REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
  REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}

concurrency:
  group: code-foundry-security-${{ github.event_name }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
  # Superseded pull-request runs are cancelled so the newest head owns the
  # group; push and scheduled runs queue instead, because cancelling a main
  # push can drop default-branch analysis or release-adjacent work.
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  profile:
    name: Profile
    if: vars.CI_BILLING_PAUSED != 'true'
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 10
    outputs:
      javascript: ${{ steps.profile.outputs.javascript }}
      rust: ${{ steps.profile.outputs.rust }}
      python: ${{ steps.profile.outputs.python }}
      python_requirements: ${{ steps.profile.outputs.python_requirements }}
      dependency_review: ${{ steps.profile.outputs.dependency_review }}
      audit_matrix: ${{ steps.matrix.outputs.audit_matrix }}
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          fetch-depth: 2
          filter: blob:none
          sparse-checkout: |
            .github
            .mise.toml
            mise.lock
            .npmrc
            .pnpmfile.cjs
            .yarnrc*
            **/package.json
            **/bun.lock
            **/bun.lockb
            **/pnpm-lock.yaml
            **/yarn.lock
            **/package-lock.json
            **/Cargo.toml
            **/Cargo.lock
            **/.cargo/**
            **/pyproject.toml
            **/requirements*.txt
            **/setup.py
            **/setup.cfg
            **/Pipfile
            **/Pipfile.lock
            **/poetry.lock
            **/uv.lock
          sparse-checkout-cone-mode: false
      - name: Runtime
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          repository: ${{ inputs.runtime-repository }}
          ref: ${{ inputs.runtime-ref }}
          path: .github/.code-foundry
          sparse-checkout: |
            .github/actions
            src/lib
            src/runtime-core.mjs
            src/runtime.mjs
      - name: Install runtime
        run: |
          mkdir -p .github/actions
          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
      - name: Detect
        id: profile
        env:
          REPO_FOUNDRY_PRIVATE: ${{ github.event.repository.private }}
          REPO_FOUNDRY_VISIBILITY: ${{ github.event.repository.visibility }}
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security profile >> "$GITHUB_OUTPUT"
      - id: matrix
        name: Build audit matrix
        env:
          MATRIX_JAVASCRIPT: ${{ steps.profile.outputs.javascript }}
          MATRIX_RUST: ${{ steps.profile.outputs.rust }}
          MATRIX_PYTHON: ${{ steps.profile.outputs.python }}
          MATRIX_REQUIREMENTS: ${{ steps.profile.outputs.python_requirements }}
        run: |
          node -e '
          const fs = require("node:fs");
          const env = process.env;
          const entries = [];
          if (env.MATRIX_JAVASCRIPT === "true") entries.push({ display: "JavaScript", language: "javascript" });
          if (env.MATRIX_RUST === "true") entries.push({ display: "Rust", language: "rust" });
          if (env.MATRIX_PYTHON === "true") {
            let requirements = [];
            try { requirements = JSON.parse(env.MATRIX_REQUIREMENTS || "[]"); } catch (error) { requirements = []; }
            for (const requirement of requirements.filter((item) => item && item !== "none")) {
              entries.push({ display: "Python / " + requirement, language: "python", requirement: requirement });
            }
          }
          fs.appendFileSync(env.GITHUB_OUTPUT, "audit_matrix=" + JSON.stringify(entries) + "\n");
          '
      - name: Dependency Review
        if: ${{ github.event_name == 'pull_request' && steps.profile.outputs.dependency_review == 'true' }}
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5
        with:
          fail-on-severity: high
          license-check: true

  # Audits run only for detected languages: the audit matrix is built from the
  # profile, so repositories never see skipped checks for ecosystems they do
  # not use. An empty matrix skips this job with no per-language rows.
  dependency-audit:
    name: Dependency Audit (${{ matrix.entry.display }})
    needs: profile
    if: vars.CI_BILLING_PAUSED != 'true' && needs.profile.result == 'success'
    strategy:
      fail-fast: false
      max-parallel: 8
      matrix:
        entry: ${{ fromJson(needs.profile.outputs.audit_matrix || '[]') }}
    runs-on: ${{ inputs.runner }}
    timeout-minutes: 20
    env:
      REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.entry.requirement }}
    steps:
      - name: Checkout JavaScript
        if: matrix.entry.language == 'javascript'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          filter: blob:none
          sparse-checkout: |
            .github
            .mise.toml
            mise.lock
            .npmrc
            .pnpmfile.cjs
            .yarnrc*
            **/package.json
            **/bun.lock
            **/bun.lockb
            **/pnpm-lock.yaml
            **/yarn.lock
            **/package-lock.json
          sparse-checkout-cone-mode: false
      - name: Checkout Rust
        if: matrix.entry.language == 'rust'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          filter: blob:none
          sparse-checkout: |
            .github
            .mise.toml
            mise.lock
            **/Cargo.toml
            **/Cargo.lock
            **/.cargo/**
          sparse-checkout-cone-mode: false
      - name: Checkout Python
        if: matrix.entry.language == 'python'
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          filter: blob:none
          sparse-checkout: |
            .github
            .mise.toml
            mise.lock
            **/pyproject.toml
            **/requirements*.txt
            **/setup.py
            **/setup.cfg
            **/Pipfile
            **/Pipfile.lock
            **/poetry.lock
            **/uv.lock
          sparse-checkout-cone-mode: false
      - name: Runtime
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false
          repository: ${{ inputs.runtime-repository }}
          ref: ${{ inputs.runtime-ref }}
          path: .github/.code-foundry
          sparse-checkout: |
            .github/actions
            src/lib
            src/runtime-core.mjs
            src/runtime.mjs
      - name: Install runtime
        run: |
          mkdir -p .github/actions
          mv .github/.code-foundry "$RUNNER_TEMP/code-foundry"
          cp -R "$RUNNER_TEMP/code-foundry/.github/actions/." .github/actions/
      - name: Detect audit toolchain
        id: audit-toolchain
        shell: bash
        env:
          REPO_FOUNDRY_LANGUAGE: ${{ matrix.entry.language }}
        run: |
          toolchain=auto
          configured_toolchain=''
          configured_package_manager=''
          if [ -f .github/code-foundry.yml ]; then
            configured_toolchain="$(awk -F': ' '/^toolchain:/ {print $2; exit}' .github/code-foundry.yml)"
            configured_package_manager="$(awk -F': ' '/^package_manager:/ {print $2; exit}' .github/code-foundry.yml)"
          fi
          [ -n "$configured_toolchain" ] && toolchain="$configured_toolchain"
          if [ "$toolchain" = auto ] && [ -f .mise.toml ]; then toolchain=mise; fi

          package_manager=none
          case "$configured_package_manager" in
            bun|pnpm|yarn|npm|none) package_manager="$configured_package_manager" ;;
            *)
              if [ -f bun.lock ] || [ -f bun.lockb ]; then package_manager=bun
              elif [ -f pnpm-lock.yaml ]; then package_manager=pnpm
              elif [ -f yarn.lock ]; then package_manager=yarn
              elif [ -f package-lock.json ]; then package_manager=npm
              elif [ -f package.json ]; then package_manager=bun
              fi
              ;;
          esac

          mise_tools=''
          configured_tool() {
            [ -f .mise.toml ] && grep -Eq "^$1[[:space:]]*=" .mise.toml
          }
          add_mise_tool() {
            configured_tool "$1" || return 0
            if [ -n "$mise_tools" ]; then mise_tools="$mise_tools $1"; else mise_tools="$1"; fi
          }
          if [ "$toolchain" = mise ] && [ -f .mise.toml ]; then
            case "$REPO_FOUNDRY_LANGUAGE" in
              javascript)
                add_mise_tool node
                [ "$package_manager" = bun ] && add_mise_tool bun
                ;;
              python)
                add_mise_tool python
                add_mise_tool uv
                add_mise_tool ruff
                ;;
              rust) add_mise_tool rust ;;
            esac
          fi

          {
            printf 'toolchain_mode=%s\n' "$toolchain"
            printf 'package_manager=%s\n' "$package_manager"
            printf 'mise_tools=%s\n' "$mise_tools"
          } >> "$GITHUB_OUTPUT"
      - name: Detect JavaScript
        id: applicability-javascript
        if: matrix.entry.language == 'javascript'
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run javascript >> "$GITHUB_OUTPUT"
      - name: Detect Rust
        id: applicability-rust
        if: matrix.entry.language == 'rust'
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security should_run rust >> "$GITHUB_OUTPUT"
      - name: Setup mise toolchain
        if: steps.audit-toolchain.outputs.mise_tools != ''
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4
        with:
          version: 2026.9.2
          cache: false
          install_args: ${{ steps.audit-toolchain.outputs.mise_tools }}
      - name: Setup Node
        if: >-
          matrix.entry.language == 'javascript' &&
          steps.applicability-javascript.outputs.applicable == 'true' &&
          steps.audit-toolchain.outputs.toolchain_mode != 'mise' &&
          steps.audit-toolchain.outputs.package_manager != 'bun' &&
          steps.audit-toolchain.outputs.package_manager != 'none'
        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
      - name: Setup Bun
        if: >-
          matrix.entry.language == 'javascript' &&
          steps.applicability-javascript.outputs.applicable == 'true' &&
          steps.audit-toolchain.outputs.toolchain_mode != 'mise' &&
          steps.audit-toolchain.outputs.package_manager == 'bun'
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
        with:
          bun-version: 1.4.3
      - name: Enable Corepack
        if: >-
          matrix.entry.language == 'javascript' &&
          steps.applicability-javascript.outputs.applicable == 'true' &&
          (steps.audit-toolchain.outputs.package_manager == 'pnpm' ||
          steps.audit-toolchain.outputs.package_manager == 'yarn')
        shell: bash
        run: corepack enable
      - name: Audit JavaScript dependencies
        if: >-
          matrix.entry.language == 'javascript' &&
          steps.applicability-javascript.outputs.applicable == 'true'
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit javascript
      - name: Check Rust
        id: system-rust
        if: >-
          matrix.entry.language == 'rust' &&
          steps.applicability-rust.outputs.applicable == 'true'
        shell: bash
        run: |
          if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
            cargo --version
            rustc --version
            echo 'available=true' >> "$GITHUB_OUTPUT"
          else
            echo 'available=false' >> "$GITHUB_OUTPUT"
          fi
      - name: Setup Rust
        if: >-
          matrix.entry.language == 'rust' &&
          steps.applicability-rust.outputs.applicable == 'true' &&
          steps.audit-toolchain.outputs.toolchain_mode != 'mise' &&
          steps.system-rust.outputs.available != 'true'
        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
      - name: Install cargo-audit
        if: >-
          matrix.entry.language == 'rust' &&
          steps.applicability-rust.outputs.applicable == 'true'
        uses: taiki-e/install-action@cb33e69fad06166ca28a42b2575e4dadabf62ee8 # v2
        with:
          tool: cargo-audit
      - name: Audit Rust dependencies
        if: >-
          matrix.entry.language == 'rust' &&
          steps.applicability-rust.outputs.applicable == 'true'
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit rust
      - name: Setup Python
        if: >-
          matrix.entry.language == 'python' &&
          steps.audit-toolchain.outputs.toolchain_mode != 'mise'
        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: '3.13'
      - name: Check uv
        id: uv
        if: matrix.entry.language == 'python'
        shell: bash
        run: |
          if command -v uv >/dev/null 2>&1; then
            echo 'available=true' >> "$GITHUB_OUTPUT"
          else
            echo 'available=false' >> "$GITHUB_OUTPUT"
          fi
      - name: Setup uv
        if: matrix.entry.language == 'python' && steps.uv.outputs.available != 'true'
        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
        with:
          version: 0.11.32
          enable-cache: false
      - name: Audit Python dependencies
        if: matrix.entry.language == 'python'
        run: node "$RUNNER_TEMP/code-foundry/src/runtime.mjs" security audit python