security.yml

name: Security

# Dependency and code scanning. The pipeline used to report nothing about
# vulnerable dependencies at all, so a known-vulnerable package could be added
# to a lockfile and merged with every check green (issue #301).
on:
  push:
    branches:
      - main
  pull_request:
    types: [opened, synchronize, reopened]
  # Advisories are published after a dependency is merged, so a weekly run is
  # what turns a new advisory into a signal without a code change.
  schedule:
    - cron: '0 6 * * 1'
  workflow_dispatch:

# Least-privilege default; jobs escalate individually when needed.
permissions:
  contents: read

# Provide Git config to actions/checkout itself; checkout runs git init before
# any workflow step can configure Git.
env:
  GIT_CONFIG_COUNT: '1'
  GIT_CONFIG_KEY_0: init.defaultBranch
  GIT_CONFIG_VALUE_0: main

jobs:
  codeql:
    name: CodeQL (${{ matrix.language }})
    runs-on: ubuntu-latest
    timeout-minutes: 30
    concurrency:
      group: check-${{ github.workflow }}-${{ github.ref }}-codeql-${{ matrix.language }}
      cancel-in-progress: true
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        # `actions` analyses the workflow files themselves; it complements
        # zizmor rather than duplicating it.
        language: [javascript-typescript, actions, rust]
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: ${{ matrix.language }}

      - name: Autobuild
        uses: github/codeql-action/autobuild@v4

      - name: Analyze
        uses: github/codeql-action/analyze@v4

  dependency-review:
    name: Dependency Review
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: check-${{ github.workflow }}-${{ github.ref }}-dependency-review
      cancel-in-progress: true
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      # actions/dependency-review-action fails the job outright with
      # "Dependency review is not supported on this repository" when the
      # dependency graph is disabled, which turns every pull request red for a
      # repository-settings reason rather than a dependency problem - exactly
      # the kind of false positive issue #301 is about. Probe the API first and
      # downgrade only that case to a warning; a real advisory still fails.
      - name: Check whether the dependency graph is available
        id: graph
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          code=$(curl -sS -o /dev/null -w '%{http_code}' \
            -H "Authorization: Bearer $GITHUB_TOKEN" \
            -H "Accept: application/vnd.github+json" \
            -H "X-GitHub-Api-Version: 2022-11-28" \
            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/dependency-graph/compare/$BASE_SHA...$HEAD_SHA")

          case "$code" in
            200)
              echo 'available=true' >> "$GITHUB_OUTPUT"
              ;;
            403 | 404)
              echo 'available=false' >> "$GITHUB_OUTPUT"
              echo "::warning::Dependency review skipped: the dependency graph is not enabled for $GITHUB_REPOSITORY (dependency-graph API returned $code). Enable it under Settings -> Code security -> Dependency graph; npm audit and cargo audit still run."
              ;;
            *)
              echo "::error::Unexpected HTTP $code from the dependency-graph API"
              exit 1
              ;;
          esac

      - name: Review dependency changes
        if: steps.graph.outputs.available == 'true'
        uses: actions/dependency-review-action@v5
        with:
          fail-on-severity: high
          comment-summary-in-pr: on-failure

  npm-audit:
    name: Audit npm lock
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: check-${{ github.workflow }}-${{ github.ref }}-npm-audit
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: actions/setup-node@v6
        with:
          node-version: 24

      # `--package-lock-only` audits the committed lockfile, so the result does
      # not depend on what a fresh install happens to resolve today.
      - name: Audit committed package-lock.json
        working-directory: js
        run: npm audit --package-lock-only --audit-level=high

  cargo-audit:
    name: Cargo audit
    runs-on: ubuntu-latest
    timeout-minutes: 10
    concurrency:
      group: check-${{ github.workflow }}-${{ github.ref }}-cargo-audit
      cancel-in-progress: true
    steps:
      - uses: actions/checkout@v6
        with:
          persist-credentials: false

      - uses: taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2.87.4
        with:
          tool: cargo-audit@0.22.2

      - name: Audit committed Cargo.lock
        working-directory: rust
        run: cargo audit --file Cargo.lock