Skip to content

Commit c14e80f

Browse files
hyperpolymathhyperpolymath
authored
Merge branch 'main' into chore/hypatia-scan-reusable-wrapper
2 parents fc6f7c0 + 13538c5 commit c14e80f

8 files changed

Lines changed: 762 additions & 701 deletions

File tree

‎.github/workflows/codeql.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@ jobs:
3030
fail-fast: false
3131
matrix:
3232
include:
33-
- language: javascript-typescript
33+
# Repo has no JS/TS source — `javascript-typescript` matrix
34+
# produced "no source files" failures on every CodeQL run.
35+
# Switch to `actions` extractor (scans workflow files which
36+
# every repo has). Per hypatia rule `codeql_language_matrix_mismatch`.
37+
- language: actions
3438
build-mode: none
3539

3640
steps:

‎.github/workflows/hypatia-scan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,5 +25,5 @@ permissions:
2525

2626
jobs:
2727
hypatia:
28-
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@97df762107501909f50bb770e9bc200b6c415600
28+
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@915139d73560e65a8240b8fc7768698658502c89
2929
secrets: inherit

‎.github/workflows/mirror.yml‎

Lines changed: 3 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
# SPDX-License-Identifier: PMPL-1.0-or-later
2-
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell
32
name: Mirror to Git Forges
43

54
on:
@@ -11,135 +10,6 @@ permissions:
1110
contents: read
1211

1312
jobs:
14-
mirror-gitlab:
15-
runs-on: ubuntu-latest
16-
if: vars.GITLAB_MIRROR_ENABLED == 'true'
17-
steps:
18-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
19-
with:
20-
fetch-depth: 0
21-
22-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
23-
with:
24-
ssh-private-key: ${{ secrets.GITLAB_SSH_KEY }}
25-
26-
- name: Mirror to GitLab
27-
run: |
28-
ssh-keyscan -t ed25519 gitlab.com >> ~/.ssh/known_hosts
29-
git remote add gitlab git@gitlab.com:${{ vars.GITLAB_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
30-
git push --force gitlab main
31-
32-
mirror-bitbucket:
33-
runs-on: ubuntu-latest
34-
if: vars.BITBUCKET_MIRROR_ENABLED == 'true'
35-
steps:
36-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
37-
with:
38-
fetch-depth: 0
39-
40-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
41-
with:
42-
ssh-private-key: ${{ secrets.BITBUCKET_SSH_KEY }}
43-
44-
- name: Mirror to Bitbucket
45-
run: |
46-
ssh-keyscan -t ed25519 bitbucket.org >> ~/.ssh/known_hosts
47-
git remote add bitbucket git@bitbucket.org:${{ vars.BITBUCKET_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
48-
git push --force bitbucket main
49-
50-
mirror-codeberg:
51-
runs-on: ubuntu-latest
52-
if: vars.CODEBERG_MIRROR_ENABLED == 'true'
53-
steps:
54-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
55-
with:
56-
fetch-depth: 0
57-
58-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
59-
with:
60-
ssh-private-key: ${{ secrets.CODEBERG_SSH_KEY }}
61-
62-
- name: Mirror to Codeberg
63-
run: |
64-
ssh-keyscan -t ed25519 codeberg.org >> ~/.ssh/known_hosts
65-
git remote add codeberg git@codeberg.org:${{ vars.CODEBERG_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
66-
git push --force codeberg main
67-
68-
mirror-sourcehut:
69-
runs-on: ubuntu-latest
70-
if: vars.SOURCEHUT_MIRROR_ENABLED == 'true'
71-
steps:
72-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
73-
with:
74-
fetch-depth: 0
75-
76-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
77-
with:
78-
ssh-private-key: ${{ secrets.SOURCEHUT_SSH_KEY }}
79-
80-
- name: Mirror to SourceHut
81-
run: |
82-
ssh-keyscan -t ed25519 git.sr.ht >> ~/.ssh/known_hosts
83-
git remote add sourcehut git@git.sr.ht:~${{ vars.SOURCEHUT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }} || true
84-
git push --force sourcehut main
85-
86-
mirror-disroot:
87-
runs-on: ubuntu-latest
88-
if: vars.DISROOT_MIRROR_ENABLED == 'true'
89-
steps:
90-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
91-
with:
92-
fetch-depth: 0
93-
94-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
95-
with:
96-
ssh-private-key: ${{ secrets.DISROOT_SSH_KEY }}
97-
98-
- name: Mirror to Disroot
99-
run: |
100-
ssh-keyscan -t ed25519 git.disroot.org >> ~/.ssh/known_hosts
101-
git remote add disroot git@git.disroot.org:${{ vars.DISROOT_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
102-
git push --force disroot main
103-
104-
mirror-gitea:
105-
runs-on: ubuntu-latest
106-
if: vars.GITEA_MIRROR_ENABLED == 'true'
107-
steps:
108-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
109-
with:
110-
fetch-depth: 0
111-
112-
- uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
113-
with:
114-
ssh-private-key: ${{ secrets.GITEA_SSH_KEY }}
115-
116-
- name: Mirror to Gitea
117-
run: |
118-
ssh-keyscan -t ed25519 ${{ vars.GITEA_HOST }} >> ~/.ssh/known_hosts
119-
git remote add gitea git@${{ vars.GITEA_HOST }}:${{ vars.GITEA_ORG || vars.MIRROR_ORG || github.repository_owner }}/${{ github.event.repository.name }}.git || true
120-
git push --force gitea main
121-
122-
mirror-radicle:
123-
runs-on: ubuntu-latest
124-
if: vars.RADICLE_MIRROR_ENABLED == 'true'
125-
steps:
126-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
127-
with:
128-
fetch-depth: 0
129-
130-
- name: Setup Rust
131-
uses: dtolnay/rust-toolchain@efa25f7f19611383d5b0ccf2d1c8914531636bf9 # stable
132-
with:
133-
toolchain: stable
134-
135-
- name: Install Radicle
136-
run: |
137-
# Install via cargo (safer than curl|sh)
138-
cargo install radicle-cli --locked
139-
echo "$HOME/.cargo/bin" >> $GITHUB_PATH
140-
141-
- name: Mirror to Radicle
142-
run: |
143-
echo "${{ secrets.RADICLE_KEY }}" > ~/.radicle/keys/radicle
144-
chmod 600 ~/.radicle/keys/radicle
145-
rad sync --announce || echo "Radicle sync attempted"
13+
mirror:
14+
uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@e6b2884722350515934d443daf23442f2195796f
15+
secrets: inherit

‎.github/workflows/rust-ci.yml‎

Lines changed: 7 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,17 @@
1-
# SPDX-License-Identifier: PMPL-1.0-or-later
2-
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
3-
#
4-
# rust-ci.yml — Cargo build, test, clippy, and fmt for Rust projects.
5-
# Only runs if Cargo.toml exists in the repo root.
1+
# SPDX-License-Identifier: MPL-2.0
2+
# Rust CI — thin wrapper calling the shared estate reusable in
3+
# hyperpolymath/standards. Configure once, propagate everywhere.
4+
# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
65
name: Rust CI
76

87
on:
9-
pull_request:
10-
branches: ['**']
118
push:
129
branches: [main, master]
10+
pull_request:
1311

1412
permissions:
1513
contents: read
1614

1715
jobs:
18-
check:
19-
name: Cargo check + clippy + fmt
20-
runs-on: ubuntu-latest
21-
if: hashFiles('Cargo.toml') != ''
22-
23-
steps:
24-
- name: Checkout repository
25-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
26-
27-
- name: Install Rust toolchain
28-
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
29-
with:
30-
components: clippy, rustfmt
31-
32-
- name: Cache cargo registry and build
33-
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
34-
35-
- name: Cargo check
36-
run: cargo check --all-targets 2>&1
37-
38-
- name: Cargo fmt
39-
run: cargo fmt --all -- --check
40-
41-
- name: Cargo clippy
42-
run: cargo clippy --all-targets -- -D warnings
43-
44-
test:
45-
name: Cargo test
46-
runs-on: ubuntu-latest
47-
needs: check
48-
if: hashFiles('Cargo.toml') != ''
49-
50-
steps:
51-
- name: Checkout repository
52-
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
53-
54-
- name: Install Rust toolchain
55-
uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
56-
57-
- name: Cache cargo registry and build
58-
uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
59-
60-
- name: Run tests
61-
run: cargo test --all-targets
62-
63-
- name: Write summary
64-
if: always()
65-
run: |
66-
echo "## Rust CI Results" >> "$GITHUB_STEP_SUMMARY"
67-
echo "" >> "$GITHUB_STEP_SUMMARY"
68-
echo "- **cargo check**: passed" >> "$GITHUB_STEP_SUMMARY"
69-
echo "- **cargo test**: completed" >> "$GITHUB_STEP_SUMMARY"
16+
rust-ci:
17+
uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@4fdf4314b4ab54269adbaff10e30e483b5e86845

‎.github/workflows/scorecard.yml‎

Lines changed: 9 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,16 @@
11
# SPDX-License-Identifier: PMPL-1.0
2-
name: OSSF Scorecard
2+
name: Scorecards supply-chain security
3+
34
on:
4-
push:
5-
branches: [main, master]
5+
branch_protection_rule:
66
schedule:
7-
- cron: '0 4 * * *'
8-
workflow_dispatch:
9-
10-
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11-
# updates do not pile up queued runs against the shared account-wide
12-
# Actions concurrency pool. Applied only to read-only check workflows
13-
# (no publish/mutation), so cancelling a superseded run is always safe.
14-
concurrency:
15-
group: ${{ github.workflow }}-${{ github.ref }}
16-
cancel-in-progress: true
7+
- cron: '23 4 * * 1'
8+
push:
9+
branches: [main]
1710

18-
permissions:
19-
contents: read
11+
permissions: read-all
2012

2113
jobs:
2214
analysis:
23-
runs-on: ubuntu-latest
24-
permissions:
25-
security-events: write
26-
id-token: write
27-
steps:
28-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
29-
with:
30-
persist-credentials: false
31-
32-
- name: Run Scorecard
33-
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.3.1
34-
with:
35-
results_file: results.sarif
36-
results_format: sarif
37-
38-
- name: Upload results
39-
uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v3.31.8
40-
with:
41-
sarif_file: results.sarif
15+
uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@e0caf11508a3989574713c78f5f444f2ce5e33ef
16+
secrets: inherit

‎.github/workflows/secret-scanner.yml‎

Lines changed: 3 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,11 @@
11
# SPDX-License-Identifier: PMPL-1.0
2-
# Prevention workflow - scans for hardcoded secrets before they reach main
32
name: Secret Scanner
43

54
on:
65
pull_request:
76
push:
87
branches: [main]
98

10-
# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
11-
# updates do not pile up queued runs against the shared account-wide
12-
# Actions concurrency pool. Applied only to read-only check workflows
13-
# (no publish/mutation), so cancelling a superseded run is always safe.
149
concurrency:
1510
group: ${{ github.workflow }}-${{ github.ref }}
1611
cancel-in-progress: true
@@ -19,63 +14,6 @@ permissions:
1914
contents: read
2015

2116
jobs:
22-
trufflehog:
23-
runs-on: ubuntu-latest
24-
steps:
25-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
26-
with:
27-
fetch-depth: 0 # Full history for scanning
28-
29-
- name: TruffleHog Secret Scan
30-
uses: trufflesecurity/trufflehog@6c05c4a00b91aa542267d8e32a8254774799d68d # v3
31-
with:
32-
# The v3 action injects --fail automatically on pull_request events.
33-
# Passing --fail here triggers "flag 'fail' cannot be repeated".
34-
extra_args: --only-verified
35-
36-
gitleaks:
37-
runs-on: ubuntu-latest
38-
steps:
39-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
40-
with:
41-
fetch-depth: 0
42-
43-
- name: Gitleaks Secret Scan
44-
uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2
45-
env:
46-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
47-
48-
# Rust-specific: Check for hardcoded crypto values
49-
rust-secrets:
50-
runs-on: ubuntu-latest
51-
steps:
52-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
53-
54-
- name: Check for hardcoded secrets in Rust
55-
run: |
56-
if ! find . -name Cargo.toml -not -path './target/*' -print -quit | grep -q .; then
57-
echo 'No Cargo.toml found — skipping Rust secrets check'
58-
exit 0
59-
fi
60-
# Patterns that suggest hardcoded secrets
61-
PATTERNS=(
62-
'const.*SECRET.*=.*"'
63-
'const.*KEY.*=.*"[a-zA-Z0-9]{16,}"'
64-
'const.*TOKEN.*=.*"'
65-
'let.*api_key.*=.*"'
66-
'HMAC.*"[a-fA-F0-9]{32,}"'
67-
'password.*=.*"[^"]+"'
68-
)
69-
70-
found=0
71-
for pattern in "${PATTERNS[@]}"; do
72-
if grep -rn --include="*.rs" -E "$pattern" src/; then
73-
echo "WARNING: Potential hardcoded secret found matching: $pattern"
74-
found=1
75-
fi
76-
done
77-
78-
if [ $found -eq 1 ]; then
79-
echo "::error::Potential hardcoded secrets detected. Use environment variables instead."
80-
exit 1
81-
fi
17+
scan:
18+
uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@3e4bd4c93911750727e2e4c66dff859e00079da0
19+
secrets: inherit

0 commit comments

Comments
 (0)