release: v1.12.0 #396
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security | |
| # Supply-chain & secrets gates (#117): | |
| # - gitleaks: scan the full git history for committed secrets (pool creds, the stratum | |
| # access-password from #113, tokens) on every push and PR. | |
| # - zizmor: static-audit the GitHub Actions workflows themselves (template injection, | |
| # over-broad GITHUB_TOKEN, unpinned actions, credential persistence) AND cross-reference the | |
| # actions we pin against the GitHub Advisory Database (online audit). | |
| # Dependabot (github-actions) lives in .github/dependabot.yml; the matching gitleaks pre-commit | |
| # hook lives in .pre-commit-config.yaml. | |
| on: | |
| push: | |
| branches: [main, develop] # develop is the integration branch; main is the release branch | |
| pull_request: | |
| workflow_dispatch: # dispatched onto bot branches (xmrig-bump #225) whose token-created PRs can't self-trigger | |
| # Re-audit main on a schedule so a newly-published advisory against an action we pin trips the gate | |
| # even during quiet periods with no pushes — the online zizmor audit is time-varying by design. | |
| schedule: | |
| - cron: "0 7 * * 1" # Mondays 07:00 UTC | |
| # Both jobs only read the tree to scan it. Pin the floor to read-only (zizmor: excessive-permissions). | |
| permissions: | |
| contents: read | |
| jobs: | |
| gitleaks: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-24.04 | |
| # The weekly tick exists for zizmor's advisory re-audit; history doesn't change between pushes, so | |
| # there's nothing new for gitleaks to scan on a schedule. | |
| if: github.event_name != 'schedule' | |
| env: | |
| # Pinned + checksum-verified, same as the shellcheck/shfmt installs in ci.yml — reproducible and | |
| # immune to runner-image drift. Keep GITLEAKS_VERSION in lockstep with .pre-commit-config.yaml. | |
| GITLEAKS_VERSION: "8.30.1" | |
| GITLEAKS_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 # scan EVERY commit, not just the tip — a secret is still a leak once pushed | |
| persist-credentials: false # zizmor: artipacked | |
| - name: Install pinned gitleaks | |
| run: | | |
| set -euo pipefail | |
| tarball="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" | |
| curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${tarball}" -o "$tarball" | |
| echo "${GITLEAKS_SHA256} ${tarball}" | sha256sum -c - | |
| tar -xzf "$tarball" gitleaks | |
| sudo install gitleaks /usr/local/bin/gitleaks | |
| gitleaks version | |
| # Full-history scan with the built-in ruleset. --redact keeps any match out of the public logs; | |
| # the job still fails (non-zero exit) so a leak blocks the merge. | |
| - name: Scan git history for secrets | |
| run: gitleaks git . --redact --no-banner --verbose | |
| zizmor: | |
| name: Workflow audit (zizmor) | |
| runs-on: ubuntu-24.04 | |
| env: | |
| ZIZMOR_VERSION: "1.25.2" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false # zizmor: artipacked | |
| # pipx is preinstalled on ubuntu-24.04; same install path as diff-cover in ci.yml's coverage job. | |
| - name: Install pinned zizmor | |
| run: pipx install "zizmor==${ZIZMOR_VERSION}" | |
| # Online audits ON (zizmor's default): GH_TOKEN lets the `known-vulnerable-actions` audit query | |
| # the GitHub Advisory Database, so a CVE disclosed against an action we pin fails the gate. The | |
| # built-in token (read-only here) is enough — advisory data is public; it's only for API access. | |
| # This complements Dependabot: zizmor blocks the merge, Dependabot opens the bump. | |
| - name: Audit GitHub Actions workflows | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: zizmor .github/workflows/ |