code-foundry 0.9.0 → 0.11.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.github/workflows/reusable-security.yml +291 -0
- package/.github/workflows/security.yml +4 -220
- package/CHANGELOG.md +14 -0
- package/README.md +4 -0
- package/package.json +1 -1
|
@@ -0,0 +1,291 @@
|
|
|
1
|
+
name: Code Foundry Security
|
|
2
|
+
|
|
3
|
+
on:
|
|
4
|
+
workflow_call:
|
|
5
|
+
inputs:
|
|
6
|
+
runtime-repository:
|
|
7
|
+
description: Repository containing the Code Foundry runtime.
|
|
8
|
+
required: false
|
|
9
|
+
type: string
|
|
10
|
+
default: 0xPlayerOne/code-foundry
|
|
11
|
+
runtime-ref:
|
|
12
|
+
description: Code Foundry runtime tag or ref.
|
|
13
|
+
required: false
|
|
14
|
+
type: string
|
|
15
|
+
default: v0.9.0
|
|
16
|
+
|
|
17
|
+
permissions:
|
|
18
|
+
contents: read
|
|
19
|
+
|
|
20
|
+
env:
|
|
21
|
+
REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
|
|
22
|
+
REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
|
|
23
|
+
REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
|
|
24
|
+
REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
|
|
25
|
+
REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
|
|
26
|
+
REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
|
|
27
|
+
|
|
28
|
+
concurrency:
|
|
29
|
+
group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
|
|
30
|
+
cancel-in-progress: true
|
|
31
|
+
|
|
32
|
+
jobs:
|
|
33
|
+
profile:
|
|
34
|
+
name: Profile
|
|
35
|
+
runs-on: ubuntu-slim
|
|
36
|
+
timeout-minutes: 10
|
|
37
|
+
outputs:
|
|
38
|
+
javascript: ${{ steps.profile.outputs.javascript }}
|
|
39
|
+
rust: ${{ steps.profile.outputs.rust }}
|
|
40
|
+
python: ${{ steps.profile.outputs.python }}
|
|
41
|
+
python_requirements: ${{ steps.profile.outputs.python_requirements }}
|
|
42
|
+
steps:
|
|
43
|
+
- name: Checkout
|
|
44
|
+
uses: actions/checkout@v7
|
|
45
|
+
with:
|
|
46
|
+
fetch-depth: 2
|
|
47
|
+
filter: blob:none
|
|
48
|
+
sparse-checkout: |
|
|
49
|
+
.github
|
|
50
|
+
.mise.toml
|
|
51
|
+
mise.lock
|
|
52
|
+
.npmrc
|
|
53
|
+
.pnpmfile.cjs
|
|
54
|
+
.yarnrc*
|
|
55
|
+
**/package.json
|
|
56
|
+
**/bun.lock
|
|
57
|
+
**/bun.lockb
|
|
58
|
+
**/pnpm-lock.yaml
|
|
59
|
+
**/yarn.lock
|
|
60
|
+
**/package-lock.json
|
|
61
|
+
**/Cargo.toml
|
|
62
|
+
**/Cargo.lock
|
|
63
|
+
**/.cargo/**
|
|
64
|
+
**/pyproject.toml
|
|
65
|
+
**/requirements*.txt
|
|
66
|
+
**/setup.py
|
|
67
|
+
**/setup.cfg
|
|
68
|
+
**/Pipfile
|
|
69
|
+
**/Pipfile.lock
|
|
70
|
+
**/poetry.lock
|
|
71
|
+
**/uv.lock
|
|
72
|
+
sparse-checkout-cone-mode: false
|
|
73
|
+
- name: Runtime
|
|
74
|
+
uses: actions/checkout@v7
|
|
75
|
+
with:
|
|
76
|
+
repository: ${{ inputs.runtime-repository }}
|
|
77
|
+
ref: ${{ inputs.runtime-ref }}
|
|
78
|
+
path: .code-foundry
|
|
79
|
+
sparse-checkout: |
|
|
80
|
+
.github/actions
|
|
81
|
+
.github/scripts
|
|
82
|
+
- name: Install runtime
|
|
83
|
+
run: |
|
|
84
|
+
mkdir -p .github/actions .github/scripts
|
|
85
|
+
cp -R .code-foundry/.github/actions/. .github/actions/
|
|
86
|
+
cp -R .code-foundry/.github/scripts/. .github/scripts/
|
|
87
|
+
- name: Detect
|
|
88
|
+
id: profile
|
|
89
|
+
run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
|
|
90
|
+
|
|
91
|
+
dependency-audit-javascript:
|
|
92
|
+
name: Dependency Audit (JavaScript)
|
|
93
|
+
runs-on: ubuntu-slim
|
|
94
|
+
timeout-minutes: 20
|
|
95
|
+
steps:
|
|
96
|
+
- name: Checkout
|
|
97
|
+
uses: actions/checkout@v7
|
|
98
|
+
with:
|
|
99
|
+
filter: blob:none
|
|
100
|
+
sparse-checkout: |
|
|
101
|
+
.github
|
|
102
|
+
.mise.toml
|
|
103
|
+
mise.lock
|
|
104
|
+
.npmrc
|
|
105
|
+
.pnpmfile.cjs
|
|
106
|
+
.yarnrc*
|
|
107
|
+
**/package.json
|
|
108
|
+
**/bun.lock
|
|
109
|
+
**/bun.lockb
|
|
110
|
+
**/pnpm-lock.yaml
|
|
111
|
+
**/yarn.lock
|
|
112
|
+
**/package-lock.json
|
|
113
|
+
sparse-checkout-cone-mode: false
|
|
114
|
+
- name: Runtime
|
|
115
|
+
uses: actions/checkout@v7
|
|
116
|
+
with:
|
|
117
|
+
repository: ${{ inputs.runtime-repository }}
|
|
118
|
+
ref: ${{ inputs.runtime-ref }}
|
|
119
|
+
path: .code-foundry
|
|
120
|
+
sparse-checkout: |
|
|
121
|
+
.github/actions
|
|
122
|
+
.github/scripts
|
|
123
|
+
- name: Install runtime
|
|
124
|
+
run: |
|
|
125
|
+
mkdir -p .github/actions .github/scripts
|
|
126
|
+
cp -R .code-foundry/.github/actions/. .github/actions/
|
|
127
|
+
cp -R .code-foundry/.github/scripts/. .github/scripts/
|
|
128
|
+
- name: Detect
|
|
129
|
+
id: applicability
|
|
130
|
+
run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
|
|
131
|
+
- name: Setup
|
|
132
|
+
if: steps.applicability.outputs.applicable == 'true'
|
|
133
|
+
uses: ./.github/actions/setup
|
|
134
|
+
with:
|
|
135
|
+
mise-scope: javascript
|
|
136
|
+
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
137
|
+
- name: Audit dependencies
|
|
138
|
+
if: steps.applicability.outputs.applicable == 'true'
|
|
139
|
+
run: bash .github/scripts/security.sh audit javascript
|
|
140
|
+
|
|
141
|
+
dependency-audit-rust:
|
|
142
|
+
name: Dependency Audit (Rust)
|
|
143
|
+
runs-on: ${{ vars.REPO_FOUNDRY_RUST_AUDIT_RUNNER || 'ubuntu-latest' }}
|
|
144
|
+
timeout-minutes: 20
|
|
145
|
+
steps:
|
|
146
|
+
- name: Checkout
|
|
147
|
+
uses: actions/checkout@v7
|
|
148
|
+
with:
|
|
149
|
+
filter: blob:none
|
|
150
|
+
sparse-checkout: |
|
|
151
|
+
.github
|
|
152
|
+
.mise.toml
|
|
153
|
+
mise.lock
|
|
154
|
+
**/Cargo.toml
|
|
155
|
+
**/Cargo.lock
|
|
156
|
+
**/.cargo/**
|
|
157
|
+
sparse-checkout-cone-mode: false
|
|
158
|
+
- name: Runtime
|
|
159
|
+
uses: actions/checkout@v7
|
|
160
|
+
with:
|
|
161
|
+
repository: ${{ inputs.runtime-repository }}
|
|
162
|
+
ref: ${{ inputs.runtime-ref }}
|
|
163
|
+
path: .code-foundry
|
|
164
|
+
sparse-checkout: |
|
|
165
|
+
.github/actions
|
|
166
|
+
.github/scripts
|
|
167
|
+
- name: Install runtime
|
|
168
|
+
run: |
|
|
169
|
+
mkdir -p .github/actions .github/scripts
|
|
170
|
+
cp -R .code-foundry/.github/actions/. .github/actions/
|
|
171
|
+
cp -R .code-foundry/.github/scripts/. .github/scripts/
|
|
172
|
+
- name: Detect
|
|
173
|
+
id: applicability
|
|
174
|
+
run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
|
|
175
|
+
- name: Check Rust
|
|
176
|
+
id: system-rust
|
|
177
|
+
if: steps.applicability.outputs.applicable == 'true'
|
|
178
|
+
shell: bash
|
|
179
|
+
run: |
|
|
180
|
+
if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
|
|
181
|
+
cargo --version
|
|
182
|
+
rustc --version
|
|
183
|
+
echo 'available=true' >> "$GITHUB_OUTPUT"
|
|
184
|
+
else
|
|
185
|
+
echo 'available=false' >> "$GITHUB_OUTPUT"
|
|
186
|
+
fi
|
|
187
|
+
- name: Setup
|
|
188
|
+
if: >-
|
|
189
|
+
steps.applicability.outputs.applicable == 'true' &&
|
|
190
|
+
steps.system-rust.outputs.available != 'true'
|
|
191
|
+
uses: ./.github/actions/setup
|
|
192
|
+
with:
|
|
193
|
+
mise-scope: rust
|
|
194
|
+
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
195
|
+
- name: Install cargo-audit
|
|
196
|
+
if: steps.applicability.outputs.applicable == 'true'
|
|
197
|
+
uses: taiki-e/install-action@v2
|
|
198
|
+
with:
|
|
199
|
+
tool: cargo-audit
|
|
200
|
+
- name: Audit dependencies
|
|
201
|
+
if: steps.applicability.outputs.applicable == 'true'
|
|
202
|
+
run: bash .github/scripts/security.sh audit rust
|
|
203
|
+
|
|
204
|
+
dependency-audit-python:
|
|
205
|
+
name: Dependency Audit (Python) / ${{ matrix.requirement }}
|
|
206
|
+
needs: profile
|
|
207
|
+
if: >-
|
|
208
|
+
${{ needs.profile.result == 'success' &&
|
|
209
|
+
needs.profile.outputs.python == 'true' &&
|
|
210
|
+
needs.profile.outputs.python_requirements != '["none"]' }}
|
|
211
|
+
strategy:
|
|
212
|
+
fail-fast: false
|
|
213
|
+
max-parallel: 8
|
|
214
|
+
matrix:
|
|
215
|
+
requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
|
|
216
|
+
runs-on: ubuntu-slim
|
|
217
|
+
timeout-minutes: 20
|
|
218
|
+
env:
|
|
219
|
+
REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
|
|
220
|
+
steps:
|
|
221
|
+
- name: Checkout
|
|
222
|
+
uses: actions/checkout@v7
|
|
223
|
+
with:
|
|
224
|
+
filter: blob:none
|
|
225
|
+
sparse-checkout: |
|
|
226
|
+
.github
|
|
227
|
+
.mise.toml
|
|
228
|
+
mise.lock
|
|
229
|
+
**/pyproject.toml
|
|
230
|
+
**/requirements*.txt
|
|
231
|
+
**/setup.py
|
|
232
|
+
**/setup.cfg
|
|
233
|
+
**/Pipfile
|
|
234
|
+
**/Pipfile.lock
|
|
235
|
+
**/poetry.lock
|
|
236
|
+
**/uv.lock
|
|
237
|
+
sparse-checkout-cone-mode: false
|
|
238
|
+
- name: Runtime
|
|
239
|
+
uses: actions/checkout@v7
|
|
240
|
+
with:
|
|
241
|
+
repository: ${{ inputs.runtime-repository }}
|
|
242
|
+
ref: ${{ inputs.runtime-ref }}
|
|
243
|
+
path: .code-foundry
|
|
244
|
+
sparse-checkout: |
|
|
245
|
+
.github/actions
|
|
246
|
+
.github/scripts
|
|
247
|
+
- name: Install runtime
|
|
248
|
+
run: |
|
|
249
|
+
mkdir -p .github/actions .github/scripts
|
|
250
|
+
cp -R .code-foundry/.github/actions/. .github/actions/
|
|
251
|
+
cp -R .code-foundry/.github/scripts/. .github/scripts/
|
|
252
|
+
- name: Setup
|
|
253
|
+
uses: ./.github/actions/setup
|
|
254
|
+
with:
|
|
255
|
+
mise-scope: python
|
|
256
|
+
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
257
|
+
- name: Audit dependencies
|
|
258
|
+
run: bash .github/scripts/security.sh audit python
|
|
259
|
+
|
|
260
|
+
dependency-audit-python-gate:
|
|
261
|
+
name: Dependency Audit (Python)
|
|
262
|
+
needs: [profile, dependency-audit-python]
|
|
263
|
+
if: always()
|
|
264
|
+
runs-on: ubuntu-slim
|
|
265
|
+
timeout-minutes: 5
|
|
266
|
+
steps:
|
|
267
|
+
- name: Gate
|
|
268
|
+
env:
|
|
269
|
+
PROFILE_RESULT: ${{ needs.profile.result }}
|
|
270
|
+
AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
|
|
271
|
+
run: |
|
|
272
|
+
if [ "$PROFILE_RESULT" != success ]; then
|
|
273
|
+
echo "Python audit profile failed: $PROFILE_RESULT" >&2
|
|
274
|
+
exit 1
|
|
275
|
+
fi
|
|
276
|
+
case "$AUDIT_RESULT" in
|
|
277
|
+
success|skipped) exit 0 ;;
|
|
278
|
+
*) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
|
|
279
|
+
esac
|
|
280
|
+
|
|
281
|
+
dependency-review:
|
|
282
|
+
name: Dependency Review
|
|
283
|
+
if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
|
|
284
|
+
runs-on: ubuntu-slim
|
|
285
|
+
timeout-minutes: 10
|
|
286
|
+
steps:
|
|
287
|
+
- name: Review
|
|
288
|
+
uses: actions/dependency-review-action@v5
|
|
289
|
+
with:
|
|
290
|
+
fail-on-severity: high
|
|
291
|
+
license-check: true
|
|
@@ -10,224 +10,8 @@ on:
|
|
|
10
10
|
permissions:
|
|
11
11
|
contents: read
|
|
12
12
|
|
|
13
|
-
env:
|
|
14
|
-
REPO_FOUNDRY_PROFILE: ${{ vars.REPO_FOUNDRY_PROFILE }}
|
|
15
|
-
REPO_FOUNDRY_LANGUAGES: ${{ vars.REPO_FOUNDRY_LANGUAGES }}
|
|
16
|
-
REPO_FOUNDRY_FEATURES: ${{ vars.REPO_FOUNDRY_FEATURES }}
|
|
17
|
-
REPO_FOUNDRY_PACKAGE_MANAGER: ${{ vars.REPO_FOUNDRY_PACKAGE_MANAGER }}
|
|
18
|
-
REPO_FOUNDRY_CACHE_PACKAGES: ${{ vars.REPO_FOUNDRY_CACHE_PACKAGES || 'auto' }}
|
|
19
|
-
REPO_FOUNDRY_BASE_SHA: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.before || '' }}
|
|
20
|
-
|
|
21
|
-
concurrency:
|
|
22
|
-
group: ${{ github.workflow }}-${{ github.event.pull_request.head.repo.full_name || github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}
|
|
23
|
-
cancel-in-progress: true
|
|
24
|
-
|
|
25
13
|
jobs:
|
|
26
|
-
|
|
27
|
-
name:
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
outputs:
|
|
31
|
-
javascript: ${{ steps.profile.outputs.javascript }}
|
|
32
|
-
rust: ${{ steps.profile.outputs.rust }}
|
|
33
|
-
python: ${{ steps.profile.outputs.python }}
|
|
34
|
-
python_requirements: ${{ steps.profile.outputs.python_requirements }}
|
|
35
|
-
steps:
|
|
36
|
-
- name: Checkout
|
|
37
|
-
uses: actions/checkout@v7
|
|
38
|
-
with:
|
|
39
|
-
fetch-depth: 2
|
|
40
|
-
filter: blob:none
|
|
41
|
-
sparse-checkout: |
|
|
42
|
-
.github
|
|
43
|
-
.mise.toml
|
|
44
|
-
mise.lock
|
|
45
|
-
.npmrc
|
|
46
|
-
.pnpmfile.cjs
|
|
47
|
-
.yarnrc*
|
|
48
|
-
**/package.json
|
|
49
|
-
**/bun.lock
|
|
50
|
-
**/bun.lockb
|
|
51
|
-
**/pnpm-lock.yaml
|
|
52
|
-
**/yarn.lock
|
|
53
|
-
**/package-lock.json
|
|
54
|
-
**/Cargo.toml
|
|
55
|
-
**/Cargo.lock
|
|
56
|
-
**/.cargo/**
|
|
57
|
-
**/pyproject.toml
|
|
58
|
-
**/requirements*.txt
|
|
59
|
-
**/setup.py
|
|
60
|
-
**/setup.cfg
|
|
61
|
-
**/Pipfile
|
|
62
|
-
**/Pipfile.lock
|
|
63
|
-
**/poetry.lock
|
|
64
|
-
**/uv.lock
|
|
65
|
-
sparse-checkout-cone-mode: false
|
|
66
|
-
- name: Detect
|
|
67
|
-
id: profile
|
|
68
|
-
run: bash .github/scripts/security.sh profile >> "$GITHUB_OUTPUT"
|
|
69
|
-
|
|
70
|
-
dependency-audit-javascript:
|
|
71
|
-
name: Dependency Audit (JavaScript)
|
|
72
|
-
runs-on: ubuntu-slim
|
|
73
|
-
timeout-minutes: 20
|
|
74
|
-
steps:
|
|
75
|
-
- name: Checkout
|
|
76
|
-
uses: actions/checkout@v7
|
|
77
|
-
with:
|
|
78
|
-
# JavaScript audits only need manifests, lockfiles, and audit config.
|
|
79
|
-
filter: blob:none
|
|
80
|
-
sparse-checkout: |
|
|
81
|
-
.github
|
|
82
|
-
.mise.toml
|
|
83
|
-
mise.lock
|
|
84
|
-
.npmrc
|
|
85
|
-
.pnpmfile.cjs
|
|
86
|
-
.yarnrc*
|
|
87
|
-
**/package.json
|
|
88
|
-
**/bun.lock
|
|
89
|
-
**/bun.lockb
|
|
90
|
-
**/pnpm-lock.yaml
|
|
91
|
-
**/yarn.lock
|
|
92
|
-
**/package-lock.json
|
|
93
|
-
sparse-checkout-cone-mode: false
|
|
94
|
-
- name: Detect
|
|
95
|
-
id: applicability
|
|
96
|
-
run: bash .github/scripts/security.sh should_run javascript >> "$GITHUB_OUTPUT"
|
|
97
|
-
- name: Setup
|
|
98
|
-
if: steps.applicability.outputs.applicable == 'true'
|
|
99
|
-
uses: ./.github/actions/setup
|
|
100
|
-
with:
|
|
101
|
-
mise-scope: javascript
|
|
102
|
-
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
103
|
-
- name: Audit dependencies
|
|
104
|
-
if: steps.applicability.outputs.applicable == 'true'
|
|
105
|
-
run: bash .github/scripts/security.sh audit javascript
|
|
106
|
-
|
|
107
|
-
dependency-audit-rust:
|
|
108
|
-
name: Dependency Audit (Rust)
|
|
109
|
-
# ubuntu-latest ships with Cargo/Rust; use it for the audit-only job and
|
|
110
|
-
# fall back to the repository toolchain when the image lacks Rust.
|
|
111
|
-
runs-on: ${{ vars.REPO_FOUNDRY_RUST_AUDIT_RUNNER || 'ubuntu-latest' }}
|
|
112
|
-
timeout-minutes: 20
|
|
113
|
-
steps:
|
|
114
|
-
- name: Checkout
|
|
115
|
-
uses: actions/checkout@v7
|
|
116
|
-
with:
|
|
117
|
-
# Rust audits only need manifests, Cargo configuration, and audit config.
|
|
118
|
-
filter: blob:none
|
|
119
|
-
sparse-checkout: |
|
|
120
|
-
.github
|
|
121
|
-
.mise.toml
|
|
122
|
-
mise.lock
|
|
123
|
-
**/Cargo.toml
|
|
124
|
-
**/Cargo.lock
|
|
125
|
-
**/.cargo/**
|
|
126
|
-
sparse-checkout-cone-mode: false
|
|
127
|
-
- name: Detect
|
|
128
|
-
id: applicability
|
|
129
|
-
run: bash .github/scripts/security.sh should_run rust >> "$GITHUB_OUTPUT"
|
|
130
|
-
- name: Check Rust
|
|
131
|
-
id: system-rust
|
|
132
|
-
if: steps.applicability.outputs.applicable == 'true'
|
|
133
|
-
shell: bash
|
|
134
|
-
run: |
|
|
135
|
-
if command -v cargo >/dev/null 2>&1 && command -v rustc >/dev/null 2>&1; then
|
|
136
|
-
cargo --version
|
|
137
|
-
rustc --version
|
|
138
|
-
echo 'available=true' >> "$GITHUB_OUTPUT"
|
|
139
|
-
else
|
|
140
|
-
echo 'available=false' >> "$GITHUB_OUTPUT"
|
|
141
|
-
fi
|
|
142
|
-
- name: Setup
|
|
143
|
-
if: >-
|
|
144
|
-
steps.applicability.outputs.applicable == 'true' &&
|
|
145
|
-
steps.system-rust.outputs.available != 'true'
|
|
146
|
-
uses: ./.github/actions/setup
|
|
147
|
-
with:
|
|
148
|
-
mise-scope: rust
|
|
149
|
-
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
150
|
-
- name: Install cargo-audit
|
|
151
|
-
if: steps.applicability.outputs.applicable == 'true'
|
|
152
|
-
uses: taiki-e/install-action@v2
|
|
153
|
-
with:
|
|
154
|
-
tool: cargo-audit
|
|
155
|
-
- name: Audit dependencies
|
|
156
|
-
if: steps.applicability.outputs.applicable == 'true'
|
|
157
|
-
run: bash .github/scripts/security.sh audit rust
|
|
158
|
-
|
|
159
|
-
dependency-audit-python:
|
|
160
|
-
name: Dependency Audit (Python) / ${{ matrix.requirement }}
|
|
161
|
-
needs: profile
|
|
162
|
-
if: >-
|
|
163
|
-
${{ needs.profile.result == 'success' &&
|
|
164
|
-
needs.profile.outputs.python == 'true' &&
|
|
165
|
-
needs.profile.outputs.python_requirements != '["none"]' }}
|
|
166
|
-
strategy:
|
|
167
|
-
fail-fast: false
|
|
168
|
-
max-parallel: 8
|
|
169
|
-
matrix:
|
|
170
|
-
requirement: ${{ fromJSON(needs.profile.outputs.python_requirements) }}
|
|
171
|
-
runs-on: ubuntu-slim
|
|
172
|
-
timeout-minutes: 20
|
|
173
|
-
env:
|
|
174
|
-
REPO_FOUNDRY_PYTHON_REQUIREMENT: ${{ matrix.requirement }}
|
|
175
|
-
steps:
|
|
176
|
-
- name: Checkout
|
|
177
|
-
uses: actions/checkout@v7
|
|
178
|
-
with:
|
|
179
|
-
# Python audits only need manifests, lockfiles, and audit config.
|
|
180
|
-
filter: blob:none
|
|
181
|
-
sparse-checkout: |
|
|
182
|
-
.github
|
|
183
|
-
.mise.toml
|
|
184
|
-
mise.lock
|
|
185
|
-
**/pyproject.toml
|
|
186
|
-
**/requirements*.txt
|
|
187
|
-
**/setup.py
|
|
188
|
-
**/setup.cfg
|
|
189
|
-
**/Pipfile
|
|
190
|
-
**/Pipfile.lock
|
|
191
|
-
**/poetry.lock
|
|
192
|
-
**/uv.lock
|
|
193
|
-
sparse-checkout-cone-mode: false
|
|
194
|
-
- name: Setup
|
|
195
|
-
uses: ./.github/actions/setup
|
|
196
|
-
with:
|
|
197
|
-
mise-scope: python
|
|
198
|
-
cache-save: ${{ github.event_name != 'pull_request' }}
|
|
199
|
-
- name: Audit dependencies
|
|
200
|
-
run: bash .github/scripts/security.sh audit python
|
|
201
|
-
|
|
202
|
-
dependency-audit-python-gate:
|
|
203
|
-
name: Dependency Audit (Python)
|
|
204
|
-
needs: [profile, dependency-audit-python]
|
|
205
|
-
if: always()
|
|
206
|
-
runs-on: ubuntu-slim
|
|
207
|
-
timeout-minutes: 5
|
|
208
|
-
steps:
|
|
209
|
-
- name: Gate
|
|
210
|
-
env:
|
|
211
|
-
PROFILE_RESULT: ${{ needs.profile.result }}
|
|
212
|
-
AUDIT_RESULT: ${{ needs.dependency-audit-python.result }}
|
|
213
|
-
run: |
|
|
214
|
-
if [ "$PROFILE_RESULT" != success ]; then
|
|
215
|
-
echo "Python audit profile failed: $PROFILE_RESULT" >&2
|
|
216
|
-
exit 1
|
|
217
|
-
fi
|
|
218
|
-
case "$AUDIT_RESULT" in
|
|
219
|
-
success|skipped) exit 0 ;;
|
|
220
|
-
*) echo "Python dependency audit failed: $AUDIT_RESULT" >&2; exit 1 ;;
|
|
221
|
-
esac
|
|
222
|
-
|
|
223
|
-
dependency-review:
|
|
224
|
-
name: Dependency Review
|
|
225
|
-
if: ${{ github.event_name == 'pull_request' && !github.event.repository.private }}
|
|
226
|
-
runs-on: ubuntu-slim
|
|
227
|
-
timeout-minutes: 10
|
|
228
|
-
steps:
|
|
229
|
-
- name: Review
|
|
230
|
-
uses: actions/dependency-review-action@v5
|
|
231
|
-
with:
|
|
232
|
-
fail-on-severity: high
|
|
233
|
-
license-check: true
|
|
14
|
+
security:
|
|
15
|
+
name: Security
|
|
16
|
+
uses: 0xPlayerOne/code-foundry/.github/workflows/reusable-security.yml@v0.10.0
|
|
17
|
+
secrets: inherit
|
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,19 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [0.11.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.10.0...v0.11.0) (2026-07-28)
|
|
4
|
+
|
|
5
|
+
|
|
6
|
+
### Features
|
|
7
|
+
|
|
8
|
+
* **security:** document centralized security runtime ([f8427fe](https://github.com/0xPlayerOne/code-foundry/commit/f8427fe740b2753c83a400766d7dd7ac453f3c5b))
|
|
9
|
+
|
|
10
|
+
## [0.10.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.9.0...v0.10.0) (2026-07-28)
|
|
11
|
+
|
|
12
|
+
|
|
13
|
+
### Features
|
|
14
|
+
|
|
15
|
+
* **security:** add reusable security workflow runtime ([b21d014](https://github.com/0xPlayerOne/code-foundry/commit/b21d014e85cfcdef4181d488b1df91e3c950503b))
|
|
16
|
+
|
|
3
17
|
## [0.9.0](https://github.com/0xPlayerOne/code-foundry/compare/v0.8.0...v0.9.0) (2026-07-28)
|
|
4
18
|
|
|
5
19
|
|
package/README.md
CHANGED
|
@@ -42,6 +42,10 @@ the selected repository is saved in `.github/template.yml` and rendered into
|
|
|
42
42
|
the small `ci.yml` and `test.yml` wrappers automatically. The equivalent
|
|
43
43
|
environment variable is `REPO_FOUNDRY_RUNTIME_REPOSITORY`.
|
|
44
44
|
|
|
45
|
+
The standard Security wrapper uses the same runtime contract, so dependency
|
|
46
|
+
audits and the public-only Dependency Review policy can be upgraded centrally
|
|
47
|
+
without copying security scripts into every consumer repository.
|
|
48
|
+
|
|
45
49
|
Initialization defaults to AGPL for new repositories. Synchronization defaults
|
|
46
50
|
to `--license preserve`, so an existing repository's license is never replaced
|
|
47
51
|
unless you explicitly select a license or provide `--license-file`.
|
package/package.json
CHANGED