[820] General: Add frontend .env validation script for contract deployment #597
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Vulnerability Audit | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| jobs: | |
| dependency-audit: | |
| name: Dependency Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: | | |
| backend/package-lock.json | |
| frontend/package-lock.json | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install backend dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| working-directory: frontend | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Run cargo audit | |
| run: | | |
| cargo audit --ignore RUSTSEC-2026-0097 \ | |
| --ignore RUSTSEC-2024-0388 \ | |
| --ignore RUSTSEC-2024-0436 \ | |
| --json > cargo-audit.json || true | |
| node scripts/dependency-audit.js cargo cargo-audit cargo-audit.json | |
| - name: Run npm audit for backend | |
| run: | | |
| npm audit --json > backend/backend-audit.json || true | |
| node scripts/dependency-audit.js npm backend backend/backend-audit.json | |
| - name: Run npm audit for frontend | |
| run: | | |
| npm audit --json > frontend/frontend-audit.json || true | |
| node scripts/dependency-audit.js npm frontend frontend/frontend-audit.json | |
| - name: Run cargo-clippy (linting) | |
| run: cargo clippy --all-targets --all-features -- -D warnings | |
| continue-on-error: true | |
| - name: Run cargo-deny (supply chain security) | |
| continue-on-error: true | |
| run: | | |
| cargo install cargo-deny | |
| cargo deny check advisories | |
| - name: Check for unsafe code | |
| run: | | |
| echo "🔍 Scanning for unsafe code blocks..." | |
| if grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"; then | |
| echo "⚠️ Unsafe code found in non-test code. Please review:" | |
| grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz" | |
| echo "" | |
| echo "✓ Verify these unsafe blocks are documented and necessary" | |
| else | |
| echo "✓ No unsafe code found in production code" | |
| fi |