rsscript/.github/workflows/security-sensitive.yml at main · Haofei/rsscript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: Security-sensitive paths

on:
  pull_request:
    branches: [main]
    paths:
      - ".github/workflows/security-sensitive.yml"
      - "Cargo.lock"
      - "Cargo.toml"
      - "crates/lsp/**"
      - "crates/process-guard/**"
      - "crates/rsscript-bytecode/**"
      - "crates/rsscript-jit-cranelift/**"
      - "crates/rsscript-provider-api/**"
      - "crates/rsscript-provider-bindgen/**"
      - "crates/rsscript-provider-conformance/**"
      - "crates/rsscript-review/**"
      - "crates/rsscript-runner-protocol/**"
      - "crates/rsscript-sdk/**"
      - "crates/rsscript-vm/**"
      - "providers/**"
  push:
    branches: [main]
    paths:
      - ".github/workflows/security-sensitive.yml"
      - "Cargo.lock"
      - "Cargo.toml"
      - "crates/lsp/**"
      - "crates/process-guard/**"
      - "crates/rsscript-bytecode/**"
      - "crates/rsscript-jit-cranelift/**"
      - "crates/rsscript-provider-api/**"
      - "crates/rsscript-provider-bindgen/**"
      - "crates/rsscript-provider-conformance/**"
      - "crates/rsscript-review/**"
      - "crates/rsscript-runner-protocol/**"
      - "crates/rsscript-sdk/**"
      - "crates/rsscript-vm/**"
      - "providers/**"
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: security-sensitive-${{ github.ref }}
  cancel-in-progress: true

jobs:
  unsafe-boundaries:
    runs-on: ubuntu-latest
    timeout-minutes: 45

    steps:
      - name: Checkout
        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

      - name: Install Rust
        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
        with:
          toolchain: 1.96.1
          components: clippy

      - name: Check unsafe boundary crates
        run: |
          cargo clippy --locked -p rsscript-jit-cranelift --all-targets -- -D warnings
          cargo clippy --locked -p rss-process-guard --all-targets -- -D warnings
          cargo clippy --locked -p rss-lsp --all-targets -- -D warnings

      - name: Test JIT allocation and differential boundaries
        run: |
          cargo test --locked -p rsscript-jit-cranelift
          cargo test --locked -p rsscript-sdk --features native-jit --test native_jit_smoke
          cargo test --locked -p rsscript-sdk --features native-jit --test native_jit_differential

      - name: Test process containment
        run: |
          cargo test --locked -p rss-process-guard

      - name: Test review and runtime boundaries
        run: |
          cargo run --locked -p rsscript-xtask -- test-tier integrations
          cargo test --locked -p rss-lsp

      - name: Test Provider conformance contracts
        run: |
          cargo test --locked -p rsscript-provider-conformance
          cargo test --locked -p rsscript-provider-fs -p rsscript-provider-env
          cargo test --locked -p rsscript-provider-process -p rsscript-provider-http
          cargo test --locked -p rsscript-provider-time -p rsscript-provider-entropy
          cargo test --locked -p rsscript-provider-log -p rsscript-provider-cli