fak: in-place integration of a6c52d66d8804c30ebca48c2e396e30cd1ea546c #8908
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security-audit automation for the fak module (issue #54 / SOTA-parity E-004). | |
| # | |
| # Two jobs, both reproducible on a clean ubuntu runner: | |
| # | |
| # govulncheck — the authoritative scan. `govulncheck ./...` is Go's official | |
| # vulnerability analysis: it walks the call graph of the fak module against the | |
| # Go vulnerability database (https://vuln.go.dev) and reports only the CVEs whose | |
| # vulnerable symbols this code ACTUALLY reaches — covering static analysis, | |
| # dependency scanning, and the standard library at once. The fak module ships | |
| # zero external deps today (go.mod), so in practice this is the stdlib-CVE | |
| # gate; it stays correct the moment a `require` is ever added. | |
| # | |
| # posture — the deterministic wiring gate. Runs tools/security_audit.py, which needs | |
| # no Go toolchain or network: it verifies the automation itself is in place (this | |
| # workflow runs govulncheck, the secret-leak scanner + pre-commit hook exist, the | |
| # dependency surface is pinned, SECURITY.md is present). This is the local, | |
| # on-demand half of the audit — the same posture as public_readiness_audit.py. | |
| # | |
| # CVE tracking: the weekly `schedule` re-runs govulncheck against an UNCHANGED tree, so | |
| # a CVE disclosed after the last push still trips the build. workflow_dispatch lets a | |
| # maintainer run the scan on demand. | |
| name: security-audit | |
| on: | |
| push: | |
| branches: [main, master, fak-v0.1] | |
| pull_request: | |
| schedule: | |
| # 06:17 UTC every Monday — catch newly-disclosed CVEs against a quiet tree. | |
| - cron: "17 6 * * 1" | |
| workflow_dispatch: | |
| # Supersede stale branch/PR work, but preserve every scheduled or manual audit. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.pull_request.number) || github.event_name == 'push' && format('ref-{0}', github.ref) || format('run-{0}', github.run_id) }} | |
| cancel-in-progress: ${{ github.event_name == 'push' || github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| govulncheck: | |
| name: govulncheck · fak (static analysis + CVE/dependency scan) | |
| runs-on: ubuntu-latest | |
| env: | |
| # The toolchain comes from go.mod (go 1.26); GOTOOLCHAIN=auto lets the | |
| # runner fetch it if its Go is older — mirrors .github/workflows/ci.yml. | |
| GOTOOLCHAIN: auto | |
| defaults: | |
| run: | |
| working-directory: . | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: false # zero external deps -> no go.sum to key a cache on | |
| # govulncheck is golang.org/x/vuln — an external tool, NOT this repo's module, | |
| # so `go install ...@latest` works here (the #72 caveat is about installing fak | |
| # itself, which isn't go-gettable yet). Pin nothing: we WANT the latest DB client. | |
| - name: install govulncheck | |
| run: go install golang.org/x/vuln/cmd/govulncheck@latest | |
| # Exit code IS the gate: govulncheck exits non-zero iff a reachable vulnerability | |
| # is found, failing the build. ./... covers every package in the module. | |
| - name: govulncheck ./... | |
| run: govulncheck ./... | |
| posture: | |
| name: security-posture audit (wiring + secret-leak gate + deps + policy) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.x" | |
| # The auditor's own tests first (fixtures that trip / clear each check), then the | |
| # auditor against this repo — exit 1 on any FAIL (missing scan, scanner, policy). | |
| - name: security_audit tests | |
| run: python tools/security_audit_test.py | |
| - name: security_audit (FAIL on any wiring/policy gap) | |
| run: python tools/security_audit.py |