Skip to content

Commit adda17c

Browse files
doublegateclaude
doublegate
and
claude
committed
ci(security): add Dependabot and CodeQL security scanning
## Summary Configures comprehensive automated security scanning infrastructure for the WRAITH Protocol repository, integrating GitHub's Dependabot for dependency vulnerability monitoring and CodeQL for static security analysis. ## Dependabot Configuration (.github/dependabot.yml) **Ecosystems Monitored:** - cargo (Rust dependencies): 10 PR limit, weekly schedule - github-actions (workflow dependencies): 5 PR limit, weekly schedule **Update Schedule:** - Frequency: Weekly (Mondays 09:00 UTC) - Rationale: Balances security responsiveness with operational stability **Intelligent Dependency Grouping:** - crypto: chacha20poly1305, x25519-dalek, blake3, snow (Security-critical cryptographic dependencies) - async-runtime: tokio, io-uring, futures (Performance-critical async infrastructure) - dev-dependencies: Development and testing packages **Commit Conventions:** - Cargo updates: "deps:" prefix - GitHub Actions: "ci:" prefix ## CodeQL Security Workflow (.github/workflows/codeql.yml) **Job 1: CodeQL Analysis** - Engine: GitHub CodeQL with Rust support (experimental) - Query Suite: security-extended (comprehensive coverage) - Build Mode: Full workspace release build - Results: Uploaded to GitHub Security tab - Timeout: 30 minutes **Job 2: Rust Security Audit** - cargo-audit: Scans against RustSec advisory database - cargo-outdated: Identifies outdated dependencies - Policy: --deny warnings (strict, zero-tolerance) - Artifacts: 30-day retention for compliance auditing **Workflow Triggers:** - Push: main, develop branches - Pull Requests: Targeting main branch - Schedule: Weekly (Monday 09:00 UTC, cron: '0 9 * * 1') - Manual: workflow_dispatch enabled ## Security Architecture Rationale **Defense in Depth Strategy:** - CodeQL: Language-agnostic static analysis patterns - cargo-audit: Rust-specific vulnerability database (RustSec) - Dependabot: Proactive dependency update management **Strict Failure Policy:** - cargo audit --deny warnings ensures zero known vulnerabilities - Appropriate for cryptographic protocol implementation - Forces immediate attention to security issues **Why security-extended Query Suite:** - More comprehensive than CodeQL's default queries - Appropriate for cryptographic protocol implementation - Detects broader range of vulnerability patterns ## Post-Deployment Requirements Manual steps after push: 1. Repository Settings → Security & analysis 2. Enable "Dependabot alerts" 3. Enable "Dependabot security updates" 4. Verify first workflow run in Actions tab 5. Review Security tab for initial findings ## Files Added/Modified - .github/dependabot.yml (69 lines) - Dependabot configuration - .github/workflows/codeql.yml (126 lines) - CodeQL + cargo-audit workflow - CHANGELOG.md (+57 lines) - Security configuration documentation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 74cb938 commit adda17c

File tree

3 files changed

+252
-0
lines changed

3 files changed

+252
-0
lines changed

‎.github/dependabot.yml‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
# Dependabot configuration for WRAITH Protocol
2+
# Automatically checks for dependency updates and security vulnerabilities
3+
# Documentation: https://docs.github.com/en/code-security/dependabot
4+
5+
version: 2
6+
7+
updates:
8+
# Cargo (Rust) dependency updates
9+
- package-ecosystem: "cargo"
10+
directory: "/"
11+
schedule:
12+
interval: "weekly"
13+
day: "monday"
14+
time: "09:00"
15+
open-pull-requests-limit: 10
16+
reviewers:
17+
- "doublegate"
18+
labels:
19+
- "dependencies"
20+
- "rust"
21+
commit-message:
22+
prefix: "deps"
23+
prefix-development: "deps(dev)"
24+
include: "scope"
25+
# Group updates by dependency type
26+
groups:
27+
# Security-critical cryptographic dependencies
28+
crypto:
29+
patterns:
30+
- "chacha20poly1305"
31+
- "x25519-dalek"
32+
- "blake3"
33+
- "snow"
34+
- "crypto*"
35+
update-types:
36+
- "minor"
37+
- "patch"
38+
# Async runtime dependencies
39+
async-runtime:
40+
patterns:
41+
- "tokio"
42+
- "io-uring"
43+
- "futures*"
44+
update-types:
45+
- "minor"
46+
- "patch"
47+
# Development dependencies
48+
dev-dependencies:
49+
dependency-type: "development"
50+
update-types:
51+
- "minor"
52+
- "patch"
53+
54+
# GitHub Actions updates
55+
- package-ecosystem: "github-actions"
56+
directory: "/"
57+
schedule:
58+
interval: "weekly"
59+
day: "monday"
60+
time: "09:00"
61+
open-pull-requests-limit: 5
62+
reviewers:
63+
- "doublegate"
64+
labels:
65+
- "dependencies"
66+
- "github-actions"
67+
commit-message:
68+
prefix: "ci"
69+
include: "scope"

‎.github/workflows/codeql.yml‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
# CodeQL Security Scanning Workflow for WRAITH Protocol
2+
# Analyzes code for security vulnerabilities and code quality issues
3+
# Documentation: https://docs.github.com/en/code-security/code-scanning
4+
5+
name: "CodeQL Security Scan"
6+
7+
on:
8+
push:
9+
branches: [main, develop]
10+
pull_request:
11+
branches: [main]
12+
schedule:
13+
# Run weekly on Monday at 09:00 UTC
14+
- cron: '0 9 * * 1'
15+
workflow_dispatch:
16+
17+
env:
18+
CARGO_TERM_COLOR: always
19+
20+
jobs:
21+
analyze:
22+
name: CodeQL Analysis
23+
runs-on: ubuntu-latest
24+
timeout-minutes: 30
25+
permissions:
26+
# Required for CodeQL to upload results to GitHub Security tab
27+
actions: read
28+
contents: read
29+
security-events: write
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
# CodeQL has experimental Rust support; we'll use it for basic analysis
35+
# Note: Rust support in CodeQL is limited compared to other languages
36+
language: ['rust']
37+
38+
steps:
39+
- name: Checkout repository
40+
uses: actions/checkout@v4
41+
42+
- name: Install Rust toolchain
43+
uses: dtolnay/rust-toolchain@stable
44+
45+
- name: Cache cargo registry
46+
uses: actions/cache@v4
47+
with:
48+
path: |
49+
~/.cargo/registry
50+
~/.cargo/git
51+
target
52+
key: ${{ runner.os }}-cargo-codeql-${{ hashFiles('**/Cargo.lock') }}
53+
restore-keys: |
54+
${{ runner.os }}-cargo-codeql-
55+
${{ runner.os }}-cargo-
56+
57+
# Initialize CodeQL tools for scanning
58+
- name: Initialize CodeQL
59+
uses: github/codeql-action/init@v3
60+
with:
61+
languages: ${{ matrix.language }}
62+
# Use security-extended query suite for comprehensive security analysis
63+
queries: security-extended
64+
# Optional: Add custom queries
65+
# config-file: ./.github/codeql/codeql-config.yml
66+
67+
# Build the project (required for compiled languages like Rust)
68+
# CodeQL needs the build to understand the code structure
69+
- name: Build project
70+
run: |
71+
cargo build --workspace --all-features --release
72+
73+
# Perform CodeQL Analysis
74+
- name: Perform CodeQL Analysis
75+
uses: github/codeql-action/analyze@v3
76+
with:
77+
category: "/language:${{ matrix.language }}"
78+
# Fail the workflow if high or critical severity issues are found
79+
# Commented out by default to avoid breaking builds initially
80+
# fail-on: critical,high
81+
82+
# Additional Rust-specific security scanning with cargo-audit
83+
rust-security:
84+
name: Rust Security Audit
85+
runs-on: ubuntu-latest
86+
timeout-minutes: 15
87+
steps:
88+
- name: Checkout repository
89+
uses: actions/checkout@v4
90+
91+
- name: Install Rust toolchain
92+
uses: dtolnay/rust-toolchain@stable
93+
94+
- name: Cache cargo registry
95+
uses: actions/cache@v4
96+
with:
97+
path: |
98+
~/.cargo/registry
99+
~/.cargo/git
100+
target
101+
key: ${{ runner.os }}-cargo-audit-${{ hashFiles('**/Cargo.lock') }}
102+
103+
# Install cargo-audit for RustSec advisory database scanning
104+
- name: Install cargo-audit
105+
run: cargo install cargo-audit --locked
106+
107+
# Check for security vulnerabilities in dependencies
108+
- name: Run cargo audit
109+
run: cargo audit --deny warnings
110+
111+
# Check for outdated dependencies with known security issues
112+
- name: Run cargo outdated
113+
continue-on-error: true
114+
run: |
115+
cargo install cargo-outdated --locked
116+
cargo outdated --root-deps-only --format json > outdated-deps.json || true
117+
118+
# Upload results as artifacts for review
119+
- name: Upload audit results
120+
if: always()
121+
uses: actions/upload-artifact@v4
122+
with:
123+
name: security-audit-results
124+
path: |
125+
outdated-deps.json
126+
retention-days: 30

‎CHANGELOG.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,63 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
77

88
## [Unreleased]
99

10+
### [2025-11-29] - GitHub Security Scanning Configuration
11+
12+
#### Added
13+
14+
**Dependabot Configuration (.github/dependabot.yml):**
15+
- Automated dependency update monitoring for Cargo (Rust) ecosystem
16+
- GitHub Actions version update monitoring
17+
- Weekly update schedule (Mondays at 09:00 UTC)
18+
- Grouped updates by dependency category:
19+
- Cryptographic dependencies (chacha20poly1305, x25519-dalek, blake3, snow)
20+
- Async runtime dependencies (tokio, io-uring, futures)
21+
- Development dependencies (separate group)
22+
- Conventional commit message prefixes (deps:, ci:)
23+
- Auto-assignment to repository maintainers
24+
- Pull request limits (10 for cargo, 5 for github-actions)
25+
26+
**CodeQL Security Scanning (.github/workflows/codeql.yml):**
27+
- Automated security vulnerability scanning using GitHub CodeQL
28+
- Rust language analysis with security-extended query suite
29+
- Triggered on: push to main/develop, pull requests, weekly schedule, manual dispatch
30+
- Two-job workflow:
31+
1. CodeQL Analysis: Comprehensive code scanning with security-extended queries
32+
2. Rust Security Audit: cargo-audit for RustSec advisory database scanning
33+
- Security results uploaded to GitHub Security tab
34+
- Artifact retention for audit results (30 days)
35+
- cargo-audit integration for Rust-specific vulnerability detection
36+
- cargo-outdated checks for dependency freshness
37+
- Caching strategy for faster builds
38+
39+
**Security Scanning Features:**
40+
- RustSec advisory database integration via cargo-audit
41+
- Automated weekly security scans
42+
- Pull request security validation
43+
- Cryptographic dependency prioritization
44+
- GitHub Security tab integration for centralized vulnerability tracking
45+
46+
#### Technical Details
47+
48+
**Dependabot Groups:**
49+
- crypto: Critical cryptographic libraries (minor/patch updates)
50+
- async-runtime: Tokio and async I/O dependencies (minor/patch updates)
51+
- dev-dependencies: Development-only dependencies (minor/patch updates)
52+
53+
**CodeQL Configuration:**
54+
- Language: Rust (experimental support)
55+
- Query Suite: security-extended (comprehensive security analysis)
56+
- Timeout: 30 minutes for analysis, 15 minutes for cargo-audit
57+
- Permissions: actions:read, contents:read, security-events:write
58+
- Build Strategy: Full workspace release build for accurate analysis
59+
60+
**Rust Security Tools:**
61+
- cargo-audit: Scans Cargo.lock against RustSec advisory database
62+
- cargo-outdated: Identifies outdated dependencies with security implications
63+
- CodeQL: Static analysis for common vulnerability patterns
64+
65+
---
66+
1067
### [2025-11-29] - Rust 2024 Edition Upgrade
1168

1269
#### Changed

0 commit comments

Comments
 (0)