techbro 0.0.0-stage → 0.5.0

package/assets/review-workflow.yml

@@ -0,0 +1,443 @@
+name: techbro review
+
+on:
+  workflow_call:
+    inputs:
+      sha:
+        description: Commit sha to review (40 hex)
+        required: true
+        type: string
+      request_id:
+        description: Request UUID
+        required: true
+        type: string
+    secrets:
+      SONAR_TOKEN:
+        required: false
+
+permissions: {}
+
+jobs:
+  authorize:
+    # Trusted helper, rules and team data come from the team action, never from the project checkout.
+    if: github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      ok: ${{ steps.authz.outputs.ok }}
+      project: ${{ steps.authz.outputs.project }}
+      owner: ${{ steps.authz.outputs.owner }}
+      repo: ${{ steps.authz.outputs.repo }}
+      sonar_key: ${{ steps.authz.outputs.sonar_key }}
+      test_configured: ${{ steps.authz.outputs.test_configured }}
+      test_runtime: ${{ steps.authz.outputs.test_runtime }}
+      test_node_version: ${{ steps.authz.outputs.test_node_version }}
+      test_workdir: ${{ steps.authz.outputs.test_workdir }}
+      test_install: ${{ steps.authz.outputs.test_install }}
+      test_command: ${{ steps.authz.outputs.test_command }}
+      test_coverage: ${{ steps.authz.outputs.test_coverage }}
+      test_rust_version: ${{ steps.authz.outputs.test_rust_version }}
+      fail_on: ${{ steps.authz.outputs.fail_on }}
+      sonar_mode: ${{ steps.authz.outputs.sonar_mode }}
+      dup_mode: ${{ steps.authz.outputs.dup_mode }}
+      dup_max_percent: ${{ steps.authz.outputs.dup_max_percent }}
+    steps:
+      - name: Stage trusted helper, rules and team data
+        uses: __TEAM__/.github/actions/techbro@main
+        timeout-minutes: 3
+        with:
+          expect-version: "__VERSION__"
+      - name: Authorize request
+        id: authz
+        timeout-minutes: 3
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          EVENT_NAME: ${{ github.event_name }}
+          ACTOR: ${{ github.actor }}
+          REF_NAME: ${{ github.ref_name }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          INPUT_SHA: ${{ inputs.sha }}
+          INPUT_REQUEST_ID: ${{ inputs.request_id }}
+          TEAM_DIR: team
+        run: node ctl/review.mjs authorize
+      - name: Upload trusted control files
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-ctl
+          path: ctl
+          retention-days: 1
+          if-no-files-found: error
+
+  prepare:
+    # Checks out the exact sha with the job token only, then archives it without .git. It never runs project code.
+    needs: authorize
+    if: needs.authorize.outputs.ok == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    outputs:
+      default_head: ${{ steps.snap.outputs.default_head }}
+    steps:
+      - name: Download control files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-ctl
+          path: ctl
+      - name: Checkout exact commit
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        timeout-minutes: 5
+        with:
+          ref: ${{ inputs.sha }}
+          path: checkout
+          persist-credentials: false
+      - name: Snapshot source (no .git)
+        id: snap
+        timeout-minutes: 10
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: node ctl/review.mjs snapshot
+      - name: Upload source snapshot
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 5
+        with:
+          name: techbro-source
+          path: snapshot
+          retention-days: 1
+          include-hidden-files: true
+          if-no-files-found: error
+
+  tests:
+    # Runs untrusted project code with no credentials and no job token. Its outputs are untrusted.
+    needs: [authorize, prepare]
+    if: needs.prepare.result == 'success' && needs.authorize.outputs.test_configured == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    permissions: {}
+    outputs:
+      install_outcome: ${{ steps.install.outcome }}
+      test_outcome: ${{ steps.test.outcome }}
+      cov_artifact_id: ${{ steps.upcov.outputs.artifact-id }}
+    env:
+      TB_WORKDIR: ${{ needs.authorize.outputs.test_workdir }}
+      TB_INSTALL: ${{ needs.authorize.outputs.test_install }}
+      TB_COMMAND: ${{ needs.authorize.outputs.test_command }}
+      TB_COVERAGE: ${{ needs.authorize.outputs.test_coverage }}
+    steps:
+      - name: Download source
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 5
+        with:
+          name: techbro-source
+          path: src
+      - name: Set up Node
+        if: needs.authorize.outputs.test_runtime == 'node' || needs.authorize.outputs.test_runtime == 'rust-node'
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        timeout-minutes: 5
+        with:
+          node-version: ${{ needs.authorize.outputs.test_node_version }}
+      - name: Set up Rust toolchain (project rust-toolchain file, or pinned override)
+        if: needs.authorize.outputs.test_runtime == 'rust-node'
+        timeout-minutes: 10
+        working-directory: src/${{ needs.authorize.outputs.test_workdir }}
+        env:
+          TB_RUST: ${{ needs.authorize.outputs.test_rust_version }}
+        run: |
+          if [ -n "$TB_RUST" ]; then
+            rustup toolchain install "$TB_RUST" --profile minimal -c rustfmt,clippy
+            echo "RUSTUP_TOOLCHAIN=$TB_RUST" >> "$GITHUB_ENV"
+          elif [ -f rust-toolchain.toml ] || [ -f rust-toolchain ]; then
+            rustup toolchain install --profile minimal -c rustfmt,clippy
+          else
+            rustup toolchain install stable --profile minimal -c rustfmt,clippy
+            echo "RUSTUP_TOOLCHAIN=stable" >> "$GITHUB_ENV"
+          fi
+          cargo --version
+      - name: Install
+        id: install
+        if: env.TB_INSTALL != ''
+        continue-on-error: true
+        timeout-minutes: 10
+        working-directory: src/${{ needs.authorize.outputs.test_workdir }}
+        run: bash -c "$TB_INSTALL"
+      - name: Test
+        id: test
+        if: steps.install.outcome != 'failure'
+        continue-on-error: true
+        timeout-minutes: 20
+        working-directory: src/${{ needs.authorize.outputs.test_workdir }}
+        run: bash -c "$TB_COMMAND"
+      - name: Collect coverage
+        id: cov
+        if: always()
+        timeout-minutes: 3
+        run: |
+          mkdir -p "$RUNNER_TEMP/out"
+          f="src/$TB_WORKDIR/$TB_COVERAGE"
+          if [ -n "$TB_COVERAGE" ] && [ -f "$f" ] && [ ! -L "$f" ] && [ "$(stat -c %s "$f")" -le 5242880 ]; then
+            case "$(realpath "$f")" in
+              "$(realpath src)"/*) cp "$f" "$RUNNER_TEMP/out/lcov.info" && echo "present=true" >> "$GITHUB_OUTPUT" ;;
+            esac
+          fi
+      - name: Upload coverage
+        id: upcov
+        if: always() && steps.cov.outputs.present == 'true'
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-test-result
+          path: ${{ runner.temp }}/out
+          retention-days: 1
+          if-no-files-found: error
+
+  opengrep:
+    # No secrets, no job token. Raw scanner output (messages, snippets) is never uploaded or logged.
+    needs: [authorize, prepare]
+    if: needs.prepare.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    permissions: {}
+    outputs:
+      result_sha: ${{ steps.sanitize.outputs.sha }}
+    env:
+      OPENGREP_VERSION: v1.30.2
+      OPENGREP_SHA256: a66aa3278457f02b287b985a45b6762aebcaba5000f2689245fd1ed86d1456c7
+    steps:
+      - name: Download control files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-ctl
+          path: ctl
+      - name: Download source
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 5
+        with:
+          name: techbro-source
+          path: src
+      - name: Install opengrep (pinned, sha256-verified)
+        timeout-minutes: 5
+        run: |
+          curl -fsSL --retry 3 -o "$RUNNER_TEMP/opengrep" "https://github.com/opengrep/opengrep/releases/download/${OPENGREP_VERSION}/opengrep_manylinux_x86"
+          echo "${OPENGREP_SHA256}  $RUNNER_TEMP/opengrep" | sha256sum -c -
+          chmod +x "$RUNNER_TEMP/opengrep"
+      - name: Scan
+        id: sanitize
+        timeout-minutes: 30
+        run: |
+          mkdir -p "$RUNNER_TEMP/out"
+          cfg=(--config "$GITHUB_WORKSPACE/ctl/rules/baseline.yml")
+          if [ -d ctl/rules/custom ]; then cfg+=(--config "$GITHUB_WORKSPACE/ctl/rules/custom"); fi
+          printf "node_modules/\nvendor/\n.git/\n" > src/.semgrepignore
+          rc=0
+          (cd src && timeout 1500 "$RUNNER_TEMP/opengrep" scan "${cfg[@]}" --json --output "$RUNNER_TEMP/og-raw.json" --disable-version-check --timeout 30 --max-target-bytes 2000000 .) >/dev/null 2>&1 || rc=$?
+          RAW="$RUNNER_TEMP/og-raw.json" RC="$rc" OUT="$RUNNER_TEMP/out/opengrep.json" node ctl/review.mjs sanitize
+      - name: Upload sanitized findings
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-opengrep-result
+          path: ${{ runner.temp }}/out/opengrep.json
+          retention-days: 1
+          if-no-files-found: ignore
+
+  jscpd:
+    # No secrets, no job token, no project config or hooks. Raw clone fragments are never uploaded or logged.
+    needs: [authorize, prepare]
+    if: needs.prepare.result == 'success' && needs.authorize.outputs.dup_mode == 'required'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions: {}
+    outputs:
+      result_sha: ${{ steps.jsan.outputs.sha }}
+    env:
+      JSCPD_VERSION: 5.4.1
+    steps:
+      - name: Download control files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-ctl
+          path: ctl
+      - name: Download source
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 5
+        with:
+          name: techbro-source
+          path: src
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        timeout-minutes: 5
+        with:
+          node-version: "20"
+      - name: Install jscpd (pinned, no install scripts)
+        timeout-minutes: 5
+        run: |
+          mkdir -p "$RUNNER_TEMP/jscpd"
+          (cd "$RUNNER_TEMP/jscpd" && npm init -y >/dev/null && npm install --ignore-scripts --no-audit --no-fund "jscpd@${JSCPD_VERSION}")
+      - name: Detect duplication
+        id: jsan
+        timeout-minutes: 20
+        run: |
+          mkdir -p "$RUNNER_TEMP/out" "$RUNNER_TEMP/jraw"
+          printf '{}' > "$RUNNER_TEMP/jscpd-config.json"
+          rc=0
+          (cd src && timeout 1100 "$RUNNER_TEMP/jscpd/node_modules/.bin/jscpd" --config "$RUNNER_TEMP/jscpd-config.json" --reporters json --output "$RUNNER_TEMP/jraw" --min-lines 5 --min-tokens 50 --silent --fail-on-empty --ignore '**/node_modules/**,**/vendor/**,**/dist/**,**/build/**,**/target/**,**/.git/**,**/*.lock,**/package-lock.json,**/pnpm-lock.yaml,**/yarn.lock,**/Cargo.lock,**/*.min.js' .) >/dev/null 2>&1 || rc=$?
+          RAW="$RUNNER_TEMP/jraw/jscpd-report.json" RC="$rc" OUT="$RUNNER_TEMP/out/jscpd.json" node ctl/review.mjs jscpd-sanitize
+          rm -rf "$RUNNER_TEMP/jraw"
+      - name: Upload sanitized duplication result
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-jscpd-result
+          path: ${{ runner.temp }}/out/jscpd.json
+          retention-days: 1
+          if-no-files-found: ignore
+
+  sonar:
+    # Credential job: only the scanner runs here, never install/test scripts. Project scanner settings are removed.
+    needs: [authorize, prepare, tests]
+    if: ${{ !cancelled() && needs.prepare.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    concurrency:
+      group: techbro-sonar-${{ needs.authorize.outputs.sonar_key || github.run_id }}
+      cancel-in-progress: false
+    permissions: {}
+    outputs:
+      result_sha: ${{ steps.sres.outputs.sha }}
+    steps:
+      - name: Download control files
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-ctl
+          path: ctl
+      - name: Download source
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 5
+        with:
+          name: techbro-source
+          path: src
+      - name: Check Sonar configuration
+        id: gate
+        timeout-minutes: 3
+        env:
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+          HAS_TOKEN: ${{ secrets.SONAR_TOKEN != '' }}
+          SONAR_KEY: ${{ needs.authorize.outputs.sonar_key }}
+          DEFAULT_HEAD: ${{ needs.prepare.outputs.default_head }}
+          SONAR_MODE: ${{ needs.authorize.outputs.sonar_mode }}
+          GATE_OUT: ${{ runner.temp }}/gate.json
+        run: node ctl/review.mjs sonar-gate
+      - name: Download test coverage
+        if: steps.gate.outputs.status == 'ready' && needs.tests.result == 'success' && needs.tests.outputs.cov_artifact_id != ''
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          artifact-ids: ${{ needs.tests.outputs.cov_artifact_id }}
+          merge-multiple: true
+          path: cov
+      - name: Import bounded LCOV coverage
+        id: cov
+        if: steps.gate.outputs.status == 'ready'
+        timeout-minutes: 3
+        env:
+          COV_DIR: cov
+          COV_XML: ${{ runner.temp }}/sonar-coverage.xml
+          COV_OUT: ${{ runner.temp }}/cov.json
+        run: node ctl/review.mjs sonar-coverage
+      - name: Remove project scanner settings
+        if: steps.gate.outputs.status == 'ready'
+        timeout-minutes: 3
+        run: rm -rf src/sonar-project.properties src/.sonarcloud.properties src/.scannerwork
+      - name: Sonar scan
+        id: scan
+        if: steps.gate.outputs.status == 'ready'
+        continue-on-error: true
+        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        timeout-minutes: 25
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_HOST_URL: ${{ vars.SONAR_HOST_URL }}
+        with:
+          projectBaseDir: src
+          args: >
+            -Dsonar.projectKey=${{ needs.authorize.outputs.sonar_key }}
+            -Dsonar.sources=.
+            -Dsonar.scm.disabled=true
+            -Dsonar.qualitygate.wait=true
+            -Dsonar.qualitygate.timeout=600
+            ${{ steps.cov.outputs.arg }}
+      - name: Collect Sonar result
+        id: sres
+        if: always()
+        timeout-minutes: 5
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          SONAR_KEY: ${{ needs.authorize.outputs.sonar_key }}
+          SCAN_OUTCOME: ${{ steps.scan.outcome }}
+          GATE_OUT: ${{ runner.temp }}/gate.json
+          COV_OUT: ${{ runner.temp }}/cov.json
+          OUT: ${{ runner.temp }}/out/sonar.json
+        run: node ctl/review.mjs sonar-result
+      - name: Upload Sonar result
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-sonar-result
+          path: ${{ runner.temp }}/out/sonar.json
+          retention-days: 1
+          if-no-files-found: ignore
+
+  report:
+    needs: [authorize, prepare, tests, opengrep, jscpd, sonar]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Stage trusted helper
+        uses: __TEAM__/.github/actions/techbro@main
+        timeout-minutes: 3
+        with:
+          expect-version: "__VERSION__"
+      - name: Download job results
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        timeout-minutes: 3
+        with:
+          pattern: techbro-*-result
+          path: ${{ runner.temp }}/results
+      - name: Build report
+        timeout-minutes: 3
+        env:
+          NEEDS: ${{ toJSON(needs) }}
+          OG_SHA: ${{ needs.opengrep.outputs.result_sha }}
+          SN_SHA: ${{ needs.sonar.outputs.result_sha }}
+          JD_SHA: ${{ needs.jscpd.outputs.result_sha }}
+          ART_DIR: ${{ runner.temp }}/results
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          INPUT_PROJECT: ${{ needs.authorize.outputs.project }}
+          INPUT_SHA: ${{ inputs.sha }}
+          INPUT_REQUEST_ID: ${{ inputs.request_id }}
+        run: node ctl/review.mjs report
+      - name: Upload report
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        timeout-minutes: 3
+        with:
+          name: techbro-review-report
+          path: report
+          retention-days: 14
+          if-no-files-found: error