Security Verification #1389
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Verification | |
| on: | |
| push: | |
| branches: [ main, develop ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| # Run security checks daily at 2 AM UTC | |
| - cron: '0 2 * * *' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name == 'schedule' && github.run_id || github.ref }} | |
| cancel-in-progress: ${{ github.event_name != 'schedule' }} | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| security-verification: | |
| name: Security Verification | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - name: Install Linux HID build deps | |
| if: runner.os == 'Linux' | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y libudev-dev | |
| - name: Cache Cargo dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-security-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo-security- | |
| ${{ runner.os }}-cargo- | |
| - name: Install security audit tools | |
| run: | | |
| cargo +stable install --locked cargo-audit | |
| cargo +stable install --locked cargo-deny | |
| - name: Run security audit | |
| run: cargo audit | |
| - name: Run cargo deny | |
| run: cargo deny check | |
| - name: Build security components | |
| run: | | |
| cargo build -p flight-core --features security | |
| cargo build -p flight-ipc | |
| - name: Run security unit tests | |
| run: | | |
| cargo test -p flight-core security | |
| cargo test -p flight-ipc | |
| - name: Install nightly for scripts (no default switch) | |
| run: rustup toolchain install nightly --profile minimal --no-self-update | |
| - name: Run custom security verification | |
| run: | | |
| chmod +x scripts/security_verification.rs | |
| cargo +nightly -Zscript scripts/security_verification.rs | |
| - name: Check for hardcoded secrets | |
| run: | | |
| echo "🔍 Scanning for likely hardcoded secrets..." | |
| # Match likely credential assignments, not generic identifiers like map keys/tokens. | |
| SECRET_PATTERN='(?i)(password|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*["'"'"'][^"'"'"']{8,}["'"'"']' | |
| if rg -n --pcre2 --glob "*.rs" "$SECRET_PATTERN" crates/ \ | |
| | rg -v "test|example|development|mock|dummy|placeholder"; then | |
| echo "❌ Potential hardcoded credential literals found" | |
| exit 1 | |
| else | |
| echo "✅ No hardcoded secrets detected" | |
| fi | |
| - name: Verify no network bindings in production code | |
| run: | | |
| echo "🔍 Checking for unexpected wildcard/network listeners..." | |
| # Allow known network-facing adapters; fail on unexpected listeners elsewhere. | |
| if rg -n --glob "*.rs" "0\\.0\\.0\\.0|TcpListener::bind\\(" crates/ \ | |
| | rg -v "test|example|development|crates/flight-dcs-export|crates/flight-xplane|crates/flight-streamdeck|crates/flight-tactile"; then | |
| echo "❌ Unexpected network listeners found in non-network crates" | |
| exit 1 | |
| else | |
| echo "✅ No unauthorized network bindings found" | |
| fi | |
| - name: Check dependency licenses | |
| run: | | |
| # Ensure all dependencies have acceptable licenses | |
| cargo deny check licenses | |
| - name: Verify secure coding practices | |
| run: | | |
| # Check for unsafe code blocks (should be minimal and justified) | |
| unsafe_count=$(grep -r "unsafe" --include="*.rs" crates/ | wc -l) | |
| echo "Unsafe blocks found: $unsafe_count" | |
| # Check for unwrap() usage (should use proper error handling) | |
| unwrap_count=$(grep -r "\.unwrap()" --include="*.rs" crates/ | grep -v "test\|example" | wc -l) | |
| echo "Unwrap calls found: $unwrap_count" | |
| if [ $unwrap_count -gt 50 ]; then | |
| echo "❌ Too many unwrap() calls found ($unwrap_count > 50)" | |
| echo "Consider using proper error handling instead" | |
| exit 1 | |
| fi | |
| - name: Generate security report | |
| run: | | |
| echo "# Security Verification Report" > security-report.md | |
| echo "Generated on: $(date)" >> security-report.md | |
| echo "" >> security-report.md | |
| echo "## Audit Results" >> security-report.md | |
| cargo audit --format json > audit-results.json || true | |
| echo "See audit-results.json for detailed vulnerability information" >> security-report.md | |
| echo "" >> security-report.md | |
| echo "## Dependency Check" >> security-report.md | |
| cargo deny check --format json > deny-results.json || true | |
| echo "See deny-results.json for detailed dependency information" >> security-report.md | |
| - name: Upload security artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: security-verification-results | |
| path: | | |
| security-report.md | |
| audit-results.json | |
| deny-results.json | |
| retention-days: 30 | |
| windows-security-verification: | |
| name: Windows Security Verification | |
| runs-on: windows-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Build Windows-specific security components | |
| run: | | |
| cargo build -p flight-ipc --features named-pipes | |
| cargo build -p flight-core | |
| - name: Test Windows ACL functionality | |
| run: | | |
| # Test Windows-specific security features | |
| cargo test -p flight-ipc transport::named_pipes | |
| cargo test -p flight-core security::windows | |
| - name: Verify Windows security configuration | |
| shell: powershell | |
| run: | | |
| # Check for Windows-specific security issues | |
| $namedPipeCode = Get-Content "crates/flight-ipc/src/transport.rs" -Raw | |
| if ($namedPipeCode -match "GENERIC_ALL|FILE_ALL_ACCESS") { | |
| Write-Host "❌ Overly permissive Windows permissions detected" | |
| exit 1 | |
| } else { | |
| Write-Host "✅ Windows permissions appear secure" | |
| } | |
| macos-security-verification: | |
| name: macOS Security Verification | |
| runs-on: macos-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Build macOS-specific security components | |
| run: | | |
| cargo build -p flight-ipc --features unix-sockets | |
| cargo build -p flight-core | |
| - name: Test Unix socket security | |
| run: | | |
| # Test Unix-specific security features | |
| cargo test -p flight-ipc transport::unix_sockets | |
| cargo test -p flight-core security::unix | |
| - name: Verify Unix socket permissions | |
| run: | | |
| # Check for proper Unix socket permissions | |
| if grep -r "0o777\|0o666" --include="*.rs" crates/; then | |
| echo "❌ Overly permissive Unix permissions detected" | |
| exit 1 | |
| else | |
| echo "✅ Unix permissions appear secure" | |
| fi |