echidna-validation.yml

# SPDX-License-Identifier: MPL-2.0
# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
name: ECHIDNA Validation
on:
  push:
    branches: [main]   # only post-merge; feature-branch PRs are gated by the pull_request run below
    paths:
      - 'services/*/src/**'
      - 'opsm_ex/native/**'
      - '.github/workflows/echidna-validation.yml'
  # No pull_request paths-filter: ECHIDNA Safety Audit is a REQUIRED status check,
  # so it must report on every PR (a path-filtered required check deadlocks PRs that
  # don't touch its paths). The "Detect relevant changes" step gates the heavy work.
  pull_request:
  schedule:
    - cron: '0 6 * * 1' # Weekly on Monday at 06:00 UTC
permissions:
  actions: read
  contents: read
  pull-requests: read   # change-detector reads the PR's file list (gh api pulls/.../files)
jobs:
  echidna-audit:
    name: ECHIDNA Safety Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout code
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # Required-check shim: only audited Rust sources need the real audit. The
      # workflow file itself is NOT in the pattern so CI-only edits pass through.
      - name: Detect relevant changes
        id: detect
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          set -euo pipefail
          PATTERN='^(services/|cli/|opsm_ex/native/)'
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            FILES=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[].filename')
            if printf '%s\n' "$FILES" | grep -qE "$PATTERN"; then
              echo "relevant=true" >> "$GITHUB_OUTPUT"; echo "Audited sources changed — running full audit."
            else
              echo "relevant=false" >> "$GITHUB_OUTPUT"; echo "No audited-source changes — pass-through (required-check shim)."
            fi
          else
            echo "relevant=true" >> "$GITHUB_OUTPUT"
          fi
      - name: Install Rust toolchain
        if: steps.detect.outputs.relevant == 'true'
        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
        with:
          # Pinned to the canonical rust version in opsm.toml [runtime]
          toolchain: '1.97.0'
          components: clippy
      - name: Cache Rust dependencies
        if: steps.detect.outputs.relevant == 'true'
        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2
      - name: Unsafe audit
        if: steps.detect.outputs.relevant == 'true'
        run: |
          echo "=== Unsafe Code Audit ==="
          UNSAFE_COUNT=0
          for dir in services/*/src cli/src opsm_ex/native/*/src; do
            if [ -d "$dir" ]; then
              COUNT=$(grep -rn "unsafe" "$dir" --include="*.rs" 2>/dev/null | grep -v "// SAFETY:" | wc -l || echo 0)
              if [ "$COUNT" -gt 0 ]; then
                echo "WARNING: $dir has $COUNT unsafe blocks without SAFETY comments"
                grep -rn "unsafe" "$dir" --include="*.rs" 2>/dev/null | grep -v "// SAFETY:"
                UNSAFE_COUNT=$((UNSAFE_COUNT + COUNT))
              fi
            fi
          done
          echo "Total unsafe without SAFETY comment: $UNSAFE_COUNT"
          echo "unsafe_count=$UNSAFE_COUNT" >> $GITHUB_OUTPUT
      - name: Dangerous pattern scan
        if: steps.detect.outputs.relevant == 'true'
        run: |
          echo "=== Dangerous Pattern Scan ==="
          ISSUES=0
          for pattern in "transmute" "std::mem::forget" "Box::from_raw" "std::ptr::null"; do
            FOUND=$(grep -rn "$pattern" services/*/src cli/src opsm_ex/native/*/src --include="*.rs" 2>/dev/null | wc -l || echo 0)
            if [ "$FOUND" -gt 0 ]; then
              echo "CRITICAL: Found $FOUND instances of '$pattern'"
              grep -rn "$pattern" services/*/src cli/src opsm_ex/native/*/src --include="*.rs" 2>/dev/null
              ISSUES=$((ISSUES + FOUND))
            fi
          done
          echo "Total dangerous patterns: $ISSUES"
          if [ "$ISSUES" -gt 0 ]; then
            echo "WARNING: Dangerous patterns detected — review required"
          fi
      - name: Clippy strict analysis
        if: steps.detect.outputs.relevant == 'true'
        run: |
          for dir in services/*/; do
            if [ -f "$dir/Cargo.toml" ]; then
              echo "=== Clippy: $dir ==="
              cd "$dir"
              cargo clippy -- -D warnings -W clippy::pedantic 2>&1 || true
              cd "$GITHUB_WORKSPACE"
            fi
          done
      - name: Summary
        if: steps.detect.outputs.relevant == 'true'
        run: |
          echo "## ECHIDNA Validation Results" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "- Scanned: services/, cli/, opsm_ex/native/" >> $GITHUB_STEP_SUMMARY
          echo "- Checks: unsafe audit, dangerous patterns, clippy strict" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "*Powered by ECHIDNA property-based verification*" >> $GITHUB_STEP_SUMMARY