Production hardening & animated startup/exit #1
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Security Report | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Existing git tag to generate a security report for (e.g., v1.2.3)' | |
| required: true | |
| type: string | |
| permissions: | |
| contents: write | |
| concurrency: | |
| group: release-security-${{ github.event.release.id || github.run_id }} | |
| cancel-in-progress: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| RELEASE_TAG: ${{ github.event.release.tag_name || inputs.tag }} | |
| jobs: | |
| security-report: | |
| if: ${{ github.event_name == 'release' || github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - name: Checkout release tag | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: refs/tags/${{ env.RELEASE_TAG }} | |
| - name: Validate manual tag input | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| run: | | |
| $tag = "${{ inputs.tag }}" | |
| if ([string]::IsNullOrWhiteSpace($tag)) { | |
| throw "Input 'tag' is required for manual runs." | |
| } | |
| git rev-parse --verify "refs/tags/$tag" | Out-Null | |
| - name: Install system dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install --no-install-recommends -y pkg-config libasound2-dev | |
| - name: Install stable Rust toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit --locked | |
| - name: Generate structured security report | |
| id: security_report | |
| run: | | |
| ./scripts/generate-security-report.ps1 ` | |
| -Tag "$env:RELEASE_TAG" ` | |
| -OutputDir "dist/security-reports" | |
| - name: Upload report as workflow artifact | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-report-${{ env.RELEASE_TAG }} | |
| path: dist/security-reports/* | |
| if-no-files-found: error | |
| - name: Upload report to release assets | |
| if: always() | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| tag_name: ${{ env.RELEASE_TAG }} | |
| fail_on_unmatched_files: true | |
| files: | | |
| dist/security-reports/chatify-security-report-*.json | |
| dist/security-reports/chatify-security-report-*.md | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Enforce required security checks | |
| if: always() | |
| run: | | |
| $report = Get-ChildItem -Path dist/security-reports -Filter "chatify-security-report-*.json" | | |
| Sort-Object LastWriteTime -Descending | | |
| Select-Object -First 1 | |
| if (-not $report) { | |
| throw "Security report JSON not found in dist/security-reports" | |
| } | |
| $data = Get-Content -Path $report.FullName -Raw | ConvertFrom-Json | |
| if ($data.summary.overall_status -ne "pass") { | |
| throw "Required security checks failed for tag '$env:RELEASE_TAG'. See attached security report." | |
| } |