Security audit #4667
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security audit | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| zizmor: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: { persist-credentials: false } | |
| - name: Run zizmor | |
| uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 | |
| audit: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| checks: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: { persist-credentials: false } | |
| - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| ignore: RUSTSEC-2023-0071,RUSTSEC-2024-0436,RUSTSEC-2025-0119,RUSTSEC-2025-0134,RUSTSEC-2026-0002,RUSTSEC-2026-0007,RUSTSEC-2026-0049,RUSTSEC-2026-0097,RUSTSEC-2026-0098,RUSTSEC-2026-0099,RUSTSEC-2026-0104,RUSTSEC-2026-0105,RUSTSEC-2025-0141,RUSTSEC-2026-0145,RUSTSEC-2026-0179,RUSTSEC-2026-0180,RUSTSEC-2026-0178,RUSTSEC-2026-0189,RUSTSEC-2026-0194,RUSTSEC-2026-0195 | |
| # RUSTSEC-2023-0071 = Marvin Attack: potential key recovery through timing side channels => not used exploitably | |
| # RUSTSEC-2024-0436 = paste - no longer maintained | |
| # RUSTSEC-2025-0119 = number_prefix is unmaintained, but we need no change in this lib | |
| # RUSTSEC-2025-0134 = rustls-pemfile is unmaintained, but only used in development dependencies | |
| # RUSTSEC-2025-0141 = bincode unmaintained, is done | |
| # RUSTSEC-2026-0002 = unsound stack borrow in lru | |
| # RUSTSEC-2026-0007 = integer overflow in bytes | |
| # RUSTSEC-2026-0049 = rustls-webpki@0.101.7 CRL matching bug; stuck in aws-smithy-http-client's legacy rustls@0.21 chain, cannot be upgraded without an upstream aws-sdk-s3 release | |
| # RUSTSEC-2026-0097 = rand unsoundness with custom logger + rand::rng(); pinned by probabilistic-collections 0.7.0 (rand 0.7) and sqlx 0.8 (rand 0.8), neither have updates available | |
| # RUSTSEC-2026-0098 = rustls-webpki name constraints for URI names; remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0099 = rustls-webpki wildcard name constraints; remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0104 = rustls-webpki CRL parsing panic; only remaining finding is rustls-webpki@0.101.7 in aws-smithy-http-client's legacy rustls@0.21 chain | |
| # RUSTSEC-2026-0105 = core2 unmaintained | |
| # RUSTSEC-2026-0145 = astral-tokio-tar header desync, not used exploitably | |
| # RUSTSEC-2026-0179 = postgres-protocol dos | |
| # RUSTSEC-2026-0180 = postgres-protocol dos | |
| # RUSTSEC-2026-0178 = tokio-postgres dos | |
| # RUSTSEC-2026-0189 = rmcp Streamable HTTP DNS rebinding; only pulled in via hotpath's hotpath-mcp profiling tool, never compiled into the shipped server | |
| # RUSTSEC-2026-0194 = quick-xml quadratic attribute-check dos; transitive via object_store 0.13 (quick-xml ^0.39), patched only in quick-xml 0.41 which needs a breaking object_store 0.14 bump | |
| # RUSTSEC-2026-0195 = quick-xml unbounded namespace-declaration dos; same object_store 0.13 pin, patched only in quick-xml 0.41 | |
| dependency-review: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: { persist-credentials: false } | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0 | |
| with: | |
| fail-on-severity: low | |
| license-check: false # incredibly high maintenance cost, also many false positives and not ability to ignore issues like "MIT/APACHE2" being used | |
| show-openssf-scorecard: true | |
| warn-on-openssf-scorecard-level: 5 | |
| allow-ghsas: GHSA-cq8v-f236-94qc # rand@0.7.3 unsoundness with custom logger; pinned by probabilistic-collections 0.7.0, cannot be upgraded | |
| # actions/dependency-review-action does not find all licenses -> we use cargo-deny for this in addition to dependency-review-action | |
| - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1 | |
| with: | |
| command: check bans licenses sources | |
| codeql: | |
| name: CodeQL (${{ matrix.language }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # required for all workflows | |
| security-events: write | |
| # required to fetch internal or private CodeQL packs | |
| packages: read | |
| # only required for workflows in private repositories | |
| actions: read | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - language: actions | |
| - language: javascript-typescript | |
| - language: rust | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: { persist-credentials: false } | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| build-mode: none | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| category: "/language:${{matrix.language}}" |