fix(backend): add IdempotencyKey model, regenerate contract snapshots, generate Prisma client before build #17
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeQL Security Scanning | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - develop | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| schedule: | |
| - cron: '0 6 * * 1' # Weekly Monday 06:00 UTC | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| jobs: | |
| analyze-rust: | |
| name: CodeQL (Rust) | |
| runs-on: ubuntu-latest | |
| if: >- | |
| github.event_name == 'schedule' || | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop')) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['rust'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: rustfmt | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| config: | | |
| paths: | |
| - contracts/ | |
| paths-ignore: | |
| - contracts/mock-strategy/ | |
| - contracts/vault/src/test.rs | |
| - contracts/vault/src/fuzz_math.rs | |
| - contracts/vault/src/*_tests.rs | |
| query-filters: | |
| - exclude: | |
| id: rust/unsafe-cast | |
| - name: Build Rust contracts | |
| run: | | |
| cargo build --release --target wasm32-unknown-unknown -p vault 2>&1 || \ | |
| cargo build --release -p vault 2>&1 || true | |
| working-directory: contracts | |
| env: | |
| RUSTFLAGS: "-C link-arg=-s" | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| output: rust-results | |
| - name: Upload Rust security artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: codeql-rust-results | |
| path: rust-results/ | |
| retention-days: 90 | |
| analyze-typescript: | |
| name: CodeQL (TypeScript) | |
| runs-on: ubuntu-latest | |
| if: >- | |
| github.event_name == 'schedule' || | |
| github.event_name == 'push' || | |
| (github.event_name == 'pull_request' && | |
| (github.event.pull_request.base.ref == 'main' || github.event.pull_request.base.ref == 'develop')) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: ['typescript'] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Setup Node | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '20' | |
| cache: npm | |
| cache-dependency-path: | | |
| backend/package-lock.json | |
| frontend/package-lock.json | |
| packages/api-schemas/package-lock.json | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| config: | | |
| paths: | |
| - frontend/src/ | |
| - backend/src/ | |
| - packages/api-schemas/ | |
| paths-ignore: | |
| - '**/*.test.ts' | |
| - '**/*.test.tsx' | |
| - '**/*.spec.ts' | |
| - '**/*.spec.tsx' | |
| - '**/node_modules/' | |
| - name: Install backend dependencies | |
| run: npm ci | |
| working-directory: backend | |
| - name: Install frontend dependencies | |
| run: npm ci | |
| working-directory: frontend | |
| - name: Build shared API schemas | |
| run: npm ci && npm run build | |
| working-directory: packages/api-schemas | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@v3 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:${{ matrix.language }}" | |
| output: ts-results | |
| - name: Upload TypeScript security artifacts | |
| uses: actions/upload-artifact@v4 | |
| if: always() | |
| with: | |
| name: codeql-typescript-results | |
| path: ts-results/ | |
| retention-days: 90 | |
| security-review: | |
| name: Security Review Summary | |
| runs-on: ubuntu-latest | |
| needs: [analyze-rust, analyze-typescript] | |
| if: always() | |
| steps: | |
| - name: Download all CodeQL artifacts | |
| uses: actions/download-artifact@v4 | |
| with: | |
| path: all-results/ | |
| pattern: codeql-*-results | |
| merge-multiple: true | |
| - name: Generate security review summary | |
| run: | | |
| echo "## CodeQL Security Scan Results" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "**Scan completed at:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >> $GITHUB_STEP_SUMMARY | |
| echo "**Triggered by:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY | |
| echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Rust Contracts" >> $GITHUB_STEP_SUMMARY | |
| if [ -d "all-results/rust-results" ]; then | |
| echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "No Rust results generated." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### TypeScript (Frontend + Backend)" >> $GITHUB_STEP_SUMMARY | |
| if [ -d "all-results/ts-results" ]; then | |
| echo "Results available in CodeQL security tab." >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "No TypeScript results generated." >> $GITHUB_STEP_SUMMARY | |
| fi | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo "### Next Steps" >> $GITHUB_STEP_SUMMARY | |
| echo "1. Review any alerts in the GitHub Security tab" >> $GITHUB_STEP_SUMMARY | |
| echo "2. Triage findings by severity (error > warning > note)" >> $GITHUB_STEP_SUMMARY | |
| echo "3. Address critical/high findings before merge" >> $GITHUB_STEP_SUMMARY | |
| - name: Notify Slack on security findings | |
| if: failure() | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SECURITY_SLACK_WEBHOOK_URL }} | |
| run: | | |
| if [ -z "$SLACK_WEBHOOK_URL" ]; then | |
| echo "SECURITY_SLACK_WEBHOOK_URL secret not set; skipping notification." | |
| exit 0 | |
| fi | |
| text="🔍 CodeQL scan completed on *${GITHUB_REPOSITORY}* (${GITHUB_REF_NAME}). Review security findings in the GitHub Security tab." | |
| payload=$(jq -n --arg text "$text" '{text: $text}') | |
| curl --fail --silent --show-error -X POST \ | |
| -H "Content-Type: application/json" \ | |
| --data "$payload" \ | |
| "$SLACK_WEBHOOK_URL" |