Skip to content

Commit f6866ae

Browse files
hyperpolymathhyperpolymath
committed
security: standardize secret scanning on TruffleHog
1 parent 5912a37 commit f6866ae

15 files changed

Lines changed: 82 additions & 248 deletions

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,18 @@
33
# Erlang/OTP + LFE project
44

55
name: CI
6-
76
on:
87
push:
9-
branches: [ main, develop, claude/* ]
8+
branches: [main, develop, claude/*]
109
pull_request:
11-
branches: [ main, develop ]
10+
branches: [main, develop]
1211
schedule:
1312
# Run tests daily at 2 AM UTC
1413
- cron: '0 2 * * *'
15-
1614
env:
1715
OTP_VERSION: '26.2'
1816
REBAR3_VERSION: '3.22.1'
19-
2017
permissions: read-all
21-
2218
jobs:
2319
###########################################################################
2420
# Build Job
@@ -27,17 +23,14 @@ jobs:
2723
name: Build
2824
runs-on: ubuntu-latest
2925
timeout-minutes: 15
30-
3126
steps:
3227
- name: Checkout code
3328
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
34-
3529
- name: Setup Erlang/OTP
3630
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
3731
with:
3832
otp-version: ${{ env.OTP_VERSION }}
3933
rebar3-version: ${{ env.REBAR3_VERSION }}
40-
4134
- name: Cache build artifacts
4235
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
4336
with:
@@ -47,20 +40,16 @@ jobs:
4740
key: ${{ runner.os }}-build-${{ hashFiles('rebar.config') }}-${{ hashFiles('rebar.lock') }}
4841
restore-keys: |
4942
${{ runner.os }}-build-
50-
5143
- name: Get dependencies
5244
run: rebar3 get-deps
53-
5445
- name: Compile
5546
run: rebar3 compile
56-
5747
- name: Upload build artifacts
5848
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
5949
with:
6050
name: build-artifacts
6151
path: _build/
6252
retention-days: 1
63-
6453
###########################################################################
6554
# Test Jobs
6655
###########################################################################
@@ -69,39 +58,32 @@ jobs:
6958
runs-on: ubuntu-latest
7059
timeout-minutes: 15
7160
needs: build
72-
7361
strategy:
7462
matrix:
7563
otp: ['26', '27']
7664
fail-fast: false
77-
7865
steps:
7966
- name: Checkout code
8067
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
81-
8268
- name: Setup Erlang/OTP
8369
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
8470
with:
8571
otp-version: ${{ matrix.otp }}
8672
rebar3-version: ${{ env.REBAR3_VERSION }}
87-
8873
- name: Download build artifacts
8974
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
9075
with:
9176
name: build-artifacts
9277
path: _build/
93-
9478
- name: Run tests
9579
run: rebar3 lfe test
96-
9780
- name: Upload test results
9881
if: always()
9982
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
10083
with:
10184
name: test-results-otp${{ matrix.otp }}
10285
path: _build/test/logs/
10386
retention-days: 7
104-
10587
###########################################################################
10688
# Coverage Job
10789
###########################################################################
@@ -110,36 +92,29 @@ jobs:
11092
runs-on: ubuntu-latest
11193
timeout-minutes: 15
11294
needs: build
113-
11495
steps:
11596
- name: Checkout code
11697
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
117-
11898
- name: Setup Erlang/OTP
11999
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
120100
with:
121101
otp-version: ${{ env.OTP_VERSION }}
122102
rebar3-version: ${{ env.REBAR3_VERSION }}
123-
124103
- name: Download build artifacts
125104
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
126105
with:
127106
name: build-artifacts
128107
path: _build/
129-
130108
- name: Run tests with coverage
131109
run: rebar3 lfe test --cover
132-
133110
- name: Generate coverage report
134111
run: rebar3 cover --verbose
135-
136112
- name: Upload coverage to Codecov
137113
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
138114
with:
139115
files: _build/test/cover/cobertura.xml
140116
fail_ci_if_error: false
141117
verbose: true
142-
143118
###########################################################################
144119
# Static Analysis
145120
###########################################################################
@@ -148,47 +123,39 @@ jobs:
148123
runs-on: ubuntu-latest
149124
timeout-minutes: 15
150125
needs: build
151-
152126
steps:
153127
- name: Checkout code
154128
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
155-
156129
- name: Setup Erlang/OTP
157130
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
158131
with:
159132
otp-version: ${{ env.OTP_VERSION }}
160133
rebar3-version: ${{ env.REBAR3_VERSION }}
161-
162134
- name: Cache PLT
163135
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
164136
with:
165137
path: _build/default/*_plt
166138
key: ${{ runner.os }}-plt-${{ hashFiles('rebar.config') }}
167139
restore-keys: |
168140
${{ runner.os }}-plt-
169-
170141
- name: Download build artifacts
171142
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
172143
with:
173144
name: build-artifacts
174145
path: _build/
175-
176146
- name: Run Dialyzer
177147
run: rebar3 dialyzer
178148
continue-on-error: true
179-
180149
###########################################################################
181150
# Security Checks
182151
###########################################################################
183152
security:
184153
name: Security Checks
185154
runs-on: ubuntu-latest
186155
timeout-minutes: 15
187-
188156
steps:
189157
- name: Checkout code
190158
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
191-
192159
- name: Check for hardcoded secrets
193160
run: |
194161
echo "Checking for hardcoded passwords..."
@@ -198,7 +165,6 @@ jobs:
198165
echo "Checking for API keys..."
199166
! grep -r "api_key\s*=" src/ || (echo "❌ Found hardcoded API keys" && exit 1)
200167
echo "✓ No hardcoded API keys found"
201-
202168
- name: Verify safety mechanisms
203169
run: |
204170
echo "Checking for pause mechanism..."
@@ -208,68 +174,24 @@ jobs:
208174
echo "Checking for rate limiting..."
209175
grep -r "rate_limit" src/ || (echo "❌ Rate limiting missing!" && exit 1)
210176
echo "✓ Rate limiting verified"
211-
212177
###########################################################################
213178
# RSR Compliance Check
214179
###########################################################################
215180
rsr-compliance:
216181
name: RSR Framework Compliance
217182
runs-on: ubuntu-latest
218183
timeout-minutes: 15
219-
220184
steps:
221185
- name: Checkout code
222186
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
223-
224187
- name: Check required files
225-
run: |
226-
echo "Checking RSR Bronze Level compliance..."
227-
228-
echo "✓ Checking core documentation..."
229-
test -f README.md || (echo "❌ README.md missing" && exit 1)
230-
test -f LICENSE || (echo "❌ LICENSE missing" && exit 1)
231-
test -f CHANGELOG.md || (echo "❌ CHANGELOG.md missing" && exit 1)
232-
test -f CODE_OF_CONDUCT.md || (echo "❌ CODE_OF_CONDUCT.md missing" && exit 1)
233-
test -f MAINTAINERS.md || (echo "❌ MAINTAINERS.md missing" && exit 1)
234-
235-
echo "✓ Checking documentation directory..."
236-
test -f docs/CONTRIBUTING.md || (echo "❌ CONTRIBUTING.md missing" && exit 1)
237-
test -f docs/SECURITY.md || (echo "❌ SECURITY.md missing" && exit 1)
238-
test -f docs/USAGE.md || (echo "❌ USAGE.md missing" && exit 1)
239-
test -f docs/API_REFERENCE.md || (echo "❌ API_REFERENCE.md missing" && exit 1)
240-
test -f docs/QUICKSTART.md || (echo "❌ QUICKSTART.md missing" && exit 1)
241-
242-
echo "✓ Checking .well-known directory..."
243-
test -f .well-known/security.txt || (echo "❌ security.txt missing" && exit 1)
244-
test -f .well-known/ai.txt || (echo "❌ ai.txt missing" && exit 1)
245-
test -f .well-known/humans.txt || (echo "❌ humans.txt missing" && exit 1)
246-
247-
echo "✓ Checking build system..."
248-
test -f rebar.config || (echo "❌ rebar.config missing" && exit 1)
249-
test -f Makefile || (echo "❌ Makefile missing" && exit 1)
250-
251-
echo ""
252-
echo "🎉 RSR Bronze Level Compliance: VERIFIED"
253-
echo ""
254-
echo "RSR Compliance Checklist:"
255-
echo "✓ Documentation complete"
256-
echo "✓ .well-known/ directory present"
257-
echo "✓ Build system configured"
258-
echo "✓ Code of Conduct adopted"
259-
echo "✓ Security policy defined"
260-
echo "✓ License specified (MIT)"
261-
echo "✓ Contribution guidelines available"
262-
echo "✓ Maintainers documented"
263-
echo ""
264-
echo "TPCF Perimeter: 3 (Community Sandbox)"
265-
188+
run: "echo \"Checking RSR Bronze Level compliance...\"\n\necho \"✓ Checking core documentation...\"\ntest -f README.md || (echo \"❌ README.md missing\" && exit 1)\ntest -f LICENSE || (echo \"❌ LICENSE missing\" && exit 1)\ntest -f CHANGELOG.md || (echo \"❌ CHANGELOG.md missing\" && exit 1)\ntest -f CODE_OF_CONDUCT.md || (echo \"❌ CODE_OF_CONDUCT.md missing\" && exit 1)\ntest -f MAINTAINERS.md || (echo \"❌ MAINTAINERS.md missing\" && exit 1)\n\necho \"✓ Checking documentation directory...\"\ntest -f docs/CONTRIBUTING.md || (echo \"❌ CONTRIBUTING.md missing\" && exit 1)\ntest -f docs/SECURITY.md || (echo \"❌ SECURITY.md missing\" && exit 1)\ntest -f docs/USAGE.md || (echo \"❌ USAGE.md missing\" && exit 1)\ntest -f docs/API_REFERENCE.md || (echo \"❌ API_REFERENCE.md missing\" && exit 1)\ntest -f docs/QUICKSTART.md || (echo \"❌ QUICKSTART.md missing\" && exit 1)\n\necho \"✓ Checking .well-known directory...\"\ntest -f .well-known/security.txt || (echo \"❌ security.txt missing\" && exit 1)\ntest -f .well-known/ai.txt || (echo \"❌ ai.txt missing\" && exit 1)\ntest -f .well-known/humans.txt || (echo \"❌ humans.txt missing\" && exit 1)\n\necho \"✓ Checking build system...\"\ntest -f rebar.config || (echo \"❌ rebar.config missing\" && exit 1)\ntest -f Makefile || (echo \"❌ Makefile missing\" && exit 1)\n\necho \"\"\necho \"\U0001F389 RSR Bronze Level Compliance: VERIFIED\"\necho \"\"\necho \"RSR Compliance Checklist:\"\necho \"✓ Documentation complete\"\necho \"✓ .well-known/ directory present\"\necho \"✓ Build system configured\"\necho \"✓ Code of Conduct adopted\"\necho \"✓ Security policy defined\"\necho \"✓ License specified (MIT)\"\necho \"✓ Contribution guidelines available\"\necho \"✓ Maintainers documented\"\necho \"\"\necho \"TPCF Perimeter: 3 (Community Sandbox)\"\n"
266189
- name: Validate security.txt (RFC 9116)
267190
run: |
268191
echo "Validating security.txt format..."
269192
grep -q "Contact:" .well-known/security.txt || (echo "❌ Missing Contact field" && exit 1)
270193
grep -q "Expires:" .well-known/security.txt || (echo "❌ Missing Expires field" && exit 1)
271194
echo "✓ security.txt format valid"
272-
273195
###########################################################################
274196
# Documentation
275197
###########################################################################
@@ -278,34 +200,28 @@ jobs:
278200
runs-on: ubuntu-latest
279201
timeout-minutes: 15
280202
needs: build
281-
282203
steps:
283204
- name: Checkout code
284205
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
285-
286206
- name: Setup Erlang/OTP
287207
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
288208
with:
289209
otp-version: ${{ env.OTP_VERSION }}
290210
rebar3-version: ${{ env.REBAR3_VERSION }}
291-
292211
- name: Download build artifacts
293212
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
294213
with:
295214
name: build-artifacts
296215
path: _build/
297-
298216
- name: Build EDoc
299217
run: rebar3 edoc
300218
continue-on-error: true
301-
302219
- name: Upload documentation
303220
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
304221
with:
305222
name: documentation
306223
path: doc/
307224
retention-days: 30
308-
309225
###########################################################################
310226
# Release (on tags)
311227
###########################################################################
@@ -315,22 +231,18 @@ jobs:
315231
timeout-minutes: 15
316232
needs: [test, coverage, security, rsr-compliance]
317233
if: startsWith(github.ref, 'refs/tags/v')
318-
319234
steps:
320235
- name: Checkout code
321236
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4
322-
323237
- name: Setup Erlang/OTP
324238
uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1
325239
with:
326240
otp-version: ${{ env.OTP_VERSION }}
327241
rebar3-version: ${{ env.REBAR3_VERSION }}
328-
329242
- name: Build release
330243
run: |
331244
rebar3 as prod release
332245
rebar3 as prod tar
333-
334246
- name: Create GitHub Release
335247
uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
336248
with:
@@ -340,7 +252,6 @@ jobs:
340252
prerelease: false
341253
env:
342254
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
343-
344255
###########################################################################
345256
# Notify
346257
###########################################################################
@@ -350,7 +261,6 @@ jobs:
350261
timeout-minutes: 15
351262
needs: [test, coverage, security, rsr-compliance]
352263
if: failure()
353-
354264
steps:
355265
- name: Notify failure
356266
run: |

0 commit comments

Comments
 (0)