fix(hooks): remove unused HorizonOperation/HorizonEffect interfaces (FlowwStar/FlowStar#376) #108
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Scan | |
| on: | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| contract-audit: | |
| name: Rust / Soroban Audit | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write # Required to comment on issues | |
| pull-requests: write | |
| defaults: | |
| run: | |
| working-directory: contracts | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - uses: Swatinem/rust-cache@v2 | |
| with: | |
| workspaces: contracts | |
| - name: clippy | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: cargo audit | |
| run: | | |
| cargo install cargo-audit --locked --quiet | |
| cargo audit 2>&1 | tee /tmp/audit-output.txt | |
| exit ${PIPESTATUS[0]} | |
| - name: Soroban pattern check | |
| run: node ../scripts/soroban-security-check.mjs 2>&1 | tee /tmp/soroban-output.txt | |
| - name: Post contract audit summary | |
| if: always() | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const audit = fs.existsSync('/tmp/audit-output.txt') | |
| ? fs.readFileSync('/tmp/audit-output.txt', 'utf8').trim() | |
| : '(no output)' | |
| const soroban = fs.existsSync('/tmp/soroban-output.txt') | |
| ? fs.readFileSync('/tmp/soroban-output.txt', 'utf8').trim() | |
| : '(no output)' | |
| const body = [ | |
| '## 🔐 Contract Security Scan', | |
| '', | |
| '<details><summary>cargo audit</summary>', | |
| '', | |
| '```', | |
| audit, | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>Soroban pattern check</summary>', | |
| '', | |
| '```', | |
| soroban, | |
| '```', | |
| '', | |
| '</details>', | |
| ].join('\n') | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body, | |
| }) | |
| frontend-audit: | |
| name: Frontend Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: npm audit | |
| run: npm audit --audit-level=high 2>&1 | tee /tmp/npm-audit.txt; exit ${PIPESTATUS[0]} | |
| - name: ESLint security | |
| run: npm run lint 2>&1 | tee /tmp/eslint-output.txt; exit ${PIPESTATUS[0]} | |
| - name: Check for hardcoded secrets | |
| run: | | |
| node scripts/check-secrets.mjs 2>&1 | tee /tmp/secrets-output.txt | |
| exit ${PIPESTATUS[0]} | |
| - name: Post frontend audit summary | |
| if: always() | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs') | |
| const read = (p) => fs.existsSync(p) ? fs.readFileSync(p, 'utf8').trim() : '(no output)' | |
| const body = [ | |
| '## 🛡️ Frontend Security Scan', | |
| '', | |
| '<details><summary>npm audit</summary>', | |
| '', | |
| '```', | |
| read('/tmp/npm-audit.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>ESLint</summary>', | |
| '', | |
| '```', | |
| read('/tmp/eslint-output.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| '', | |
| '<details><summary>Hardcoded secrets check</summary>', | |
| '', | |
| '```', | |
| read('/tmp/secrets-output.txt'), | |
| '```', | |
| '', | |
| '</details>', | |
| ].join('\n') | |
| await github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.issue.number, | |
| body, | |
| }) |