security: enforce supply chain gates

Author: farhan-syah

.github/workflows/codeql.yml

@@ -0,0 +1,27 @@
+name: CodeQL
+
+on:
+  pull_request:
+  push:
+    branches: [main, security]
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze Rust
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
+        with:
+          languages: rust
+          build-mode: none
+      - name: Analyze
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4

.github/workflows/fuzz.yml

@@ -36,7 +36,7 @@ jobs:
         with:
           toolchain: nightly
       - name: Install cargo-fuzz
-        run: cargo install cargo-fuzz --locked
+        run: cargo install cargo-fuzz --version 0.13.2 --locked
       - name: Run bounded ASan fuzzing
         run: |
           cargo fuzz run --sanitizer address --target x86_64-unknown-linux-gnu "${{ matrix.target.name }}" -- \

.github/workflows/labels.yml

@@ -15,8 +15,8 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: crazy-max/ghaction-github-labeler@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d # v6
         with:
           yaml-file: .github/labels.yml
           # Set to true only after confirming the manifest is complete —

.github/workflows/release-prepare.yml

@@ -41,10 +41,48 @@ jobs:
     needs: validate-version
     uses: ./.github/workflows/test.yml
 
+  sbom:
+    name: Generate release SBOM
+    needs: validate-version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+
+      - name: Stamp release source and generate CycloneDX SBOM
+        env:
+          VERSION: ${{ needs.validate-version.outputs.version }}
+        run: |
+          set -euo pipefail
+          export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$GITHUB_SHA")"
+          bash scripts/ci/stamp_version.sh "$VERSION"
+          cargo install cargo-cyclonedx --version 0.5.9 --locked
+          cargo cyclonedx \
+            --manifest-path nodedb/Cargo.toml \
+            --format json \
+            --spec-version 1.5 \
+            --all-features \
+            --target all \
+            --override-filename nodedb-${VERSION}-sbom.cdx
+          test -f nodedb/nodedb-${VERSION}-sbom.cdx.json
+          python3 -m json.tool nodedb/nodedb-${VERSION}-sbom.cdx.json > /dev/null
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: nodedb-sbom
+          path: nodedb/nodedb-${{ needs.validate-version.outputs.version }}-sbom.cdx.json
+          retention-days: 14
+
   build-server:
     name: Build server (${{ matrix.label }})
     needs: [validate-version, ci]
     runs-on: ${{ matrix.runs-on }}
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
     strategy:
       fail-fast: false
       matrix:
@@ -56,14 +94,14 @@ jobs:
             target: aarch64-unknown-linux-gnu
             label: linux-arm64
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
         with:
           targets: ${{ matrix.target }}
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           prefix-key: server-${{ matrix.target }}
 
@@ -87,23 +125,30 @@ jobs:
           tar czf nodedb-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}.tar.gz nodedb
           ls -lh nodedb-*.tar.gz
 
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        with:
+          subject-path: |
+            target/${{ matrix.target }}/release/nodedb
+            target/${{ matrix.target }}/release/nodedb-${{ needs.validate-version.outputs.version }}-${{ matrix.label }}.tar.gz
+
       # Two artifacts per arch: the tarball ships in the GitHub Release, the
       # bare binary is the Docker build context. Same bytes, different shape.
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: server-${{ matrix.label }}
           path: target/${{ matrix.target }}/release/nodedb-*.tar.gz
           retention-days: 14
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: binary-${{ matrix.label }}
           path: target/${{ matrix.target }}/release/nodedb
           retention-days: 14
 
   summary:
     name: Release instructions
-    needs: [validate-version, build-server]
+    needs: [validate-version, build-server, sbom]
     runs-on: ubuntu-latest
     steps:
       - name: Write summary

.github/workflows/release-validate.yml

@@ -30,12 +30,12 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       is_full_release: ${{ steps.version.outputs.is_full_release }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.ref }}
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Validate tag against Cargo.toml
         id: version

.github/workflows/release.yml

@@ -84,12 +84,12 @@ jobs:
     runs-on: ubuntu-latest
     environment: crates.io
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag }}
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
 
       - name: Install system deps
         run: |
@@ -204,12 +204,12 @@ jobs:
             label: arm64
             binary: binary-linux-arm64
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.ref || inputs.tag }}
 
       - name: Download prebuilt binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: ${{ matrix.binary }}
           run-id: ${{ inputs.prepare_run_id }}
@@ -220,16 +220,16 @@ jobs:
         run: chmod +x ./binctx/nodedb
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push platform image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           build-contexts: binary=./binctx
@@ -256,7 +256,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -283,21 +283,29 @@ jobs:
       contents: write
       actions: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag }}
 
       - name: Download binary artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           pattern: "server-*"
           run-id: ${{ inputs.prepare_run_id }}
           github-token: ${{ github.token }}
           path: ./artifacts
           merge-multiple: true
 
+      - name: Download SBOM artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: nodedb-sbom
+          run-id: ${{ inputs.prepare_run_id }}
+          github-token: ${{ github.token }}
+          path: ./artifacts
+
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
         with:
           tag_name: ${{ inputs.tag }}
           name: NodeDB ${{ needs.validate-version.outputs.version }}
@@ -325,7 +333,7 @@ jobs:
     # guarded only by the `notify` input: leave `notify: false` when re-dispatching
     # already-announced releases, or you will double-post.
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag }}
           fetch-depth: 0

.github/workflows/secrets.yml

@@ -0,0 +1,25 @@
+name: Secret scan
+
+on:
+  pull_request:
+  push:
+    branches: [main, security]
+  schedule:
+    - cron: "29 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: Gitleaks history scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+      - name: Install Gitleaks
+        run: go install github.com/gitleaks/gitleaks/v8@v8.30.0
+      - name: Scan Git history
+        run: gitleaks git --redact --verbose

.github/workflows/supply-chain.yml

@@ -0,0 +1,48 @@
+name: Supply Chain
+
+on:
+  pull_request:
+    branches: [main, security]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - supply-chain/**
+      - deny.toml
+      - scripts/ci/check_advisory_ignores.py
+      - .github/workflows/supply-chain.yml
+  push:
+    branches: [main, security]
+    paths:
+      - "**/Cargo.toml"
+      - "**/Cargo.lock"
+      - supply-chain/**
+      - deny.toml
+      - scripts/ci/check_advisory_ignores.py
+      - .github/workflows/supply-chain.yml
+  schedule:
+    - cron: "17 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-vet:
+    name: cargo vet
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Verify advisory-ignore policy
+        run: |
+          python3 scripts/ci/check_advisory_ignores.py --self-test
+          python3 scripts/ci/check_advisory_ignores.py
+
+      - name: Install stable Rust
+        uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4 # stable
+
+      - name: Install cargo-vet
+        run: cargo install cargo-vet --version 0.10.2 --locked
+
+      - name: Verify dependency audits
+        run: cargo vet --locked