Codewhale/.github/workflows/security-audit.yml

name: Security audit

permissions: {}

on:
  workflow_dispatch: {}
  workflow_call: {}

env:
  CARGO_TERM_COLOR: always

jobs:
  self-audit:
    name: cargo-audit
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-audit
        run: cargo install cargo-audit
      - name: Run cargo audit
        run: cargo audit

  npm-audit:
    name: npm-audit (${{ matrix.name }})
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    strategy:
      fail-fast: false
      matrix:
        # Every committed package-lock.json, including build-only tooling.
        include:
          - { name: root, directory: . }
          - { name: web, directory: web }
          - { name: telemetry-ingest, directory: telemetry-ingest }
          - { name: extension-host, directory: crates/tui/extension-host }
          - { name: vscode, directory: extensions/vscode }
          - { name: feishu-bridge, directory: integrations/feishu-bridge }
          - { name: telegram-bridge, directory: integrations/telegram-bridge }
          - { name: wecom-bridge, directory: integrations/wecom-bridge }
          - { name: pet, directory: pet }
    defaults:
      run:
        working-directory: ${{ matrix.directory }}
    steps:
      - uses: actions/checkout@v7
      - uses: actions/[email protected]
        with:
          node-version: '22'
      # Audit the complete committed lock, including build dependencies, and
      # keep the raw report. Runtime compatibility remains owned by surface CI.
      - name: Audit locked dependencies
        if: matrix.name != 'web' && matrix.name != 'vscode'
        run: |
          set +e
          npm audit --json > "${{ runner.temp }}/npm-audit.json"
          status=$?
          set -e
          node -e '
            const r = require(process.argv[1]);
            if (r.error || !r.metadata?.vulnerabilities) throw new Error("Incomplete dependency audit");
            console.log(JSON.stringify(r.metadata.vulnerabilities));
          ' "${{ runner.temp }}/npm-audit.json"
          exit "$status"
      # The website also verifies its installed, reviewed build dependency
      # mitigation (web/docs/DEPENDENCY_SECURITY.md); the raw report keeps every
      # upstream finding.
      - name: Install and verify website build dependency mitigation
        if: matrix.name == 'web'
        run: npm ci --no-audit
      - name: Audit website with verified build dependency mitigation
        if: matrix.name == 'web'
        run: npm run audit:dependencies -- --report "${{ runner.temp }}/npm-audit.json"
      # The VS Code extension's packager toolchain carries one unfixed high
      # advisory that never runs for users (DEPENDENCY_SECURITY.md at the repo
      # root). It is admitted by name; anything else fails the job.
      - name: Audit extension with reviewed packager advisory acceptance
        if: matrix.name == 'vscode'
        run: npm run audit:dependencies -- --report "${{ runner.temp }}/npm-audit.json"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        if: always()
        with:
          name: npm-audit-${{ matrix.name }}
          path: ${{ runner.temp }}/npm-audit.json
          if-no-files-found: error