Security and Testing #66
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security and Testing | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| schedule: | |
| # Run security scans daily at 2 AM UTC | |
| - cron: '0 2 * * *' | |
| workflow_dispatch: | |
| jobs: | |
| # Constant-time validation for cryptographic code | |
| constant-time-validation: | |
| name: Constant-Time Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install valgrind | |
| run: sudo apt-get update && sudo apt-get install -y valgrind | |
| - name: Run constant-time tests (NIST crate) | |
| run: cargo test --release -p zipminator-nist -- --nocapture --test-threads=1 | |
| - name: Validate timing consistency | |
| run: | | |
| # Run timing analysis to detect potential timing side-channels | |
| cargo test --release -p zipminator-core -- timing_tests || echo "No timing tests found" | |
| # Security audit with cargo-audit | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Run cargo audit | |
| run: cargo audit --deny warnings | |
| - name: Run cargo-deny | |
| uses: EmbarkStudios/cargo-deny-action@v1 | |
| with: | |
| log-level: warn | |
| command: check | |
| arguments: --all-features | |
| # SAST scanning | |
| security-scanning: | |
| name: Security Scanning (SAST) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| - name: Upload Trivy results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| # CodeQL Analysis (Python only -- C++ was removed from the repo) | |
| codeql-analysis: | |
| name: CodeQL Security Analysis | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write | |
| actions: read | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: python | |
| queries: security-and-quality | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| # Dependency review | |
| dependency-review: | |
| name: Dependency Review | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Dependency Review | |
| uses: actions/dependency-review-action@v4 | |
| with: | |
| fail-on-severity: moderate | |
| # Memory safety tests | |
| memory-safety: | |
| name: Memory Safety Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust with miri | |
| uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| components: miri | |
| - name: Run miri tests | |
| run: | | |
| cargo miri setup | |
| cargo miri test -p zipminator-core || echo "Miri tests completed with warnings" | |
| # Fuzzing tests | |
| fuzzing: | |
| name: Fuzzing Tests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@nightly | |
| - name: Install cargo-fuzz | |
| run: cargo install cargo-fuzz | |
| - name: Run fuzzing tests | |
| working-directory: crates/zipminator-fuzz | |
| run: | | |
| # Run short fuzzing campaign | |
| cargo fuzz list 2>/dev/null | head -n 1 | xargs -I {} cargo fuzz run {} -- -max_total_time=300 || echo "Fuzzing completed" | |
| # Unit tests with coverage | |
| unit-tests: | |
| name: Unit Tests - ${{ matrix.component }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| component: [core, nist] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: llvm-tools-preview | |
| - name: Install cargo-llvm-cov | |
| run: cargo install cargo-llvm-cov | |
| - name: Run tests with coverage - Core | |
| if: matrix.component == 'core' | |
| run: | | |
| cargo llvm-cov --all-features -p zipminator-core --lcov --output-path lcov.info | |
| cargo llvm-cov report -p zipminator-core --html | |
| - name: Run tests with coverage - NIST | |
| if: matrix.component == 'nist' | |
| run: | | |
| cargo llvm-cov --all-features -p zipminator-nist --lcov --output-path lcov.info | |
| - name: Upload coverage to Codecov | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| files: lcov.info | |
| flags: ${{ matrix.component }} | |
| name: ${{ matrix.component }}-coverage | |
| fail_ci_if_error: false | |
| # Python tests | |
| python-tests: | |
| name: Python Tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install dependencies | |
| run: | | |
| pip install maturin pytest pytest-cov pytest-benchmark | |
| - name: Build and install package | |
| run: maturin develop | |
| - name: Run Python tests with coverage | |
| run: | | |
| pytest tests/ --cov=zipminator --cov-report=xml --cov-report=html -v | |
| - name: Upload Python coverage | |
| uses: codecov/codecov-action@v4 | |
| with: | |
| files: coverage.xml | |
| flags: python | |
| name: python-coverage | |
| # NIST KAT validation | |
| nist-kat-validation: | |
| name: NIST KAT Validation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Run NIST KAT tests | |
| run: cargo test --release -p zipminator-nist -- --nocapture | |
| - name: Validate test vectors | |
| run: | | |
| echo "Validating NIST test vectors..." | |
| # Add specific KAT validation | |
| # NOTE: Claude Flow notification pattern is duplicated across 8+ workflows. | |
| # TODO: Extract into a reusable composite action at .github/actions/claude-flow-notify/action.yml | |
| security-notification: | |
| name: Security Notification | |
| runs-on: ubuntu-latest | |
| needs: [security-audit, security-scanning, constant-time-validation] | |
| if: failure() | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Install Claude Flow | |
| run: npm install -g claude-flow@alpha | |
| - name: Send security alert | |
| run: | | |
| npx claude-flow@alpha hooks notify --message "Security tests failed in CI pipeline" | |
| npx claude-flow@alpha hooks post-task --task-id "security-scan-failed" |