prompt-mint/.github/workflows/dependency-scan.yml at main · PromptMintLabs/prompt-mint · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
name: Dependency Vulnerability Scan

# Automated dependency vulnerability scanning for both the JS/TS frontend
# (yarn/npm advisories) and the Rust/Soroban contract (RustSec advisories).
#
# - Runs on every PR/push that touches a manifest or lockfile and fails the
#   build on high/critical severity findings.
# - Also runs weekly on a schedule (and can be triggered manually) to catch
#   newly-disclosed vulnerabilities in dependencies that haven't changed,
#   publishing a report artifact and job summary for tracking remediation.
on:
  pull_request:
    branches: ["main"]
    paths:
      - "package.json"
      - "yarn.lock"
      - ".yarnrc.yml"
      - "server/package.json"
      - "server/package-lock.json"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".github/workflows/dependency-scan.yml"
  push:
    branches: ["main"]
    paths:
      - "package.json"
      - "yarn.lock"
      - ".yarnrc.yml"
      - "server/package.json"
      - "server/package-lock.json"
      - "Cargo.toml"
      - "Cargo.lock"
      - ".github/workflows/dependency-scan.yml"
  schedule:
    # Every Monday at 06:00 UTC — catches newly-disclosed CVEs against
    # dependencies that haven't changed since the last push.
    - cron: "0 6 * * 1"
  workflow_dispatch: {}

permissions:
  contents: read

concurrency:
  group: dependency-scan-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  npm-audit:
    name: "npm: dependency audit"
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v7

      - name: Enable Corepack
        run: corepack enable

      - name: Set up Node.js
        uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "yarn"

      - name: Install dependencies
        run: yarn install --immutable

      - name: Run npm audit (JSON report)
        # Always capture a full JSON report for the weekly artifact, even
        # if no vulnerabilities are found (yarn exits non-zero on findings,
        # so the report step must not fail the job by itself).
        run: |
          mkdir -p reports
          yarn npm audit --recursive --json > reports/npm-audit.json || true

      - name: Set up Node.js (server lockfile)
        uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: npm
          cache-dependency-path: server/package-lock.json

      - name: Install server dependencies
        working-directory: server
        run: npm ci

      - name: Run server npm audit (JSON report)
        working-directory: server
        run: npm audit --json > ../reports/npm-audit-server.json || true

      - name: Upload npm audit reports
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: npm-audit-reports
          path: reports/npm-audit*.json
          retention-days: 90

      - name: Fail on high/critical frontend vulnerabilities
        run: yarn npm audit --recursive --severity high

      - name: Fail on high/critical server vulnerabilities
        working-directory: server
        run: npm audit --audit-level=high

      - name: Weekly summary
        if: always() && github.event_name == 'schedule'
        run: |
          echo "### npm dependency audit — $(date -u +%Y-%m-%d)" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Frontend (yarn):**" >> "$GITHUB_STEP_SUMMARY"
          echo '```json' >> "$GITHUB_STEP_SUMMARY"
          cat reports/npm-audit.json >> "$GITHUB_STEP_SUMMARY" || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "**Server (npm):**" >> "$GITHUB_STEP_SUMMARY"
          echo '```json' >> "$GITHUB_STEP_SUMMARY"
          cat reports/npm-audit-server.json >> "$GITHUB_STEP_SUMMARY" || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"

  cargo-audit:
    name: "cargo: dependency audit"
    runs-on: ubuntu-latest

    steps:
      - name: Check out repository
        uses: actions/checkout@v7

      - name: Set up Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          toolchain: "1.89.0"

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Run cargo audit (JSON report)
        run: |
          mkdir -p reports
          cargo audit --json > reports/cargo-audit.json || true

      - name: Upload cargo audit report
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: cargo-audit-report
          path: reports/cargo-audit.json
          retention-days: 90

      - name: Fail on RustSec advisories (contract dependencies)
        run: cargo audit --deny vulnerabilities

      - name: Weekly summary
        if: always() && github.event_name == 'schedule'
        run: |
          echo "### cargo dependency audit — $(date -u +%Y-%m-%d)" >> "$GITHUB_STEP_SUMMARY"
          echo '```json' >> "$GITHUB_STEP_SUMMARY"
          cat reports/cargo-audit.json >> "$GITHUB_STEP_SUMMARY" || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"