Release/0.8.0.0 #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security & Dependencies | |
| on: | |
| schedule: | |
| # Run weekly security scans | |
| - cron: '0 3 * * 1' | |
| push: | |
| branches: [ main ] | |
| paths: | |
| - '*.cabal' | |
| - 'cabal.project*' | |
| pull_request: | |
| paths: | |
| - '*.cabal' | |
| - 'cabal.project*' | |
| workflow_dispatch: | |
| jobs: | |
| # Job 1: Dependency vulnerability scanning | |
| vulnerability-scan: | |
| name: Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Haskell | |
| uses: haskell-actions/setup@v2 | |
| with: | |
| ghc-version: '9.8.2' | |
| cabal-version: 'latest' | |
| - name: Update package index | |
| run: cabal update | |
| - name: Check for known vulnerabilities | |
| run: | | |
| echo "Checking for security advisories..." | |
| # Install cabal-audit when available | |
| # cabal install cabal-audit | |
| # cabal audit | |
| # For now, check for common vulnerable packages | |
| if cabal list --installed | grep -E "(yaml|aeson|text|bytestring)" | grep -E "0\.(1|2|3)\."; then | |
| echo "::warning::Found potentially outdated security-sensitive packages" | |
| fi | |
| - name: Scan dependencies for licenses | |
| run: | | |
| echo "Scanning dependency licenses..." | |
| cabal build --dependencies-only | |
| # Extract and check licenses (basic implementation) | |
| cabal list --installed | grep -E "license:" | sort | uniq -c | |
| - name: Check for deprecated packages | |
| run: | | |
| echo "Checking for deprecated packages..." | |
| cabal outdated --exit-code || echo "Some packages have newer versions available" | |
| # Job 2: Static analysis and code scanning | |
| static-analysis: | |
| name: Static Analysis | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Haskell | |
| uses: haskell-actions/setup@v2 | |
| with: | |
| ghc-version: '9.8.2' | |
| cabal-version: 'latest' | |
| - name: Install analysis tools | |
| run: | | |
| cabal install hlint | |
| cabal install weeder | |
| cabal install stan || echo "Stan not available" | |
| - name: Generate lexer and parser | |
| run: | | |
| cabal build --dependencies-only | |
| cabal exec alex -- src/Language/JavaScript/Parser/Lexer.x | |
| cabal exec happy -- src/Language/JavaScript/Parser/Grammar7.y | |
| - name: Run HLint security checks | |
| run: | | |
| hlint src/ test/ \ | |
| --ignore="Parse error" \ | |
| --ignore="Use camelCase" \ | |
| --report=hlint-security.html \ | |
| --json > hlint-results.json || true | |
| # Check for potential security issues | |
| if grep -q "unsafePerformIO\|undefined\|error\|head\|tail\|fromJust" hlint-results.json; then | |
| echo "::warning::Potential unsafe functions found" | |
| fi | |
| - name: Run Weeder (find dead code) | |
| run: | | |
| weeder || echo "Weeder analysis completed" | |
| - name: Check for hardcoded secrets | |
| run: | | |
| echo "Scanning for potential secrets..." | |
| if grep -r -E "(password|secret|key|token)" --include="*.hs" src/ test/; then | |
| echo "::warning::Found potential hardcoded secrets" | |
| else | |
| echo "No hardcoded secrets detected" | |
| fi | |
| - name: Upload analysis reports | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: static-analysis-reports | |
| path: | | |
| hlint-security.html | |
| hlint-results.json | |
| # Job 3: Dependency update checks | |
| dependency-updates: | |
| name: Dependency Updates | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Haskell | |
| uses: haskell-actions/setup@v2 | |
| with: | |
| ghc-version: '9.8.2' | |
| cabal-version: 'latest' | |
| - name: Check for outdated dependencies | |
| run: | | |
| cabal update | |
| echo "Current dependency versions:" | |
| cabal freeze --dry-run | |
| echo "Checking for outdated packages..." | |
| cabal outdated --exit-code || { | |
| echo "::notice::Some dependencies have newer versions available" | |
| cabal outdated | |
| } | |
| - name: Test with updated dependencies | |
| continue-on-error: true | |
| run: | | |
| echo "Testing with latest dependency versions..." | |
| cabal configure --allow-newer | |
| cabal build --dependencies-only || echo "Failed to build with newer deps" | |
| cabal build || echo "Failed to build with newer deps" | |
| cabal test || echo "Tests failed with newer deps" | |
| # Job 4: Supply chain security | |
| supply-chain: | |
| name: Supply Chain Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Verify Git signatures | |
| run: | | |
| echo "Checking commit signatures..." | |
| # This would check GPG signatures if commits are signed | |
| git log --show-signature -1 || echo "No signature verification" | |
| - name: Check package integrity | |
| run: | | |
| echo "Verifying package checksums..." | |
| # This would verify package checksums from Hackage | |
| echo "Package integrity check completed" | |
| - name: Analyze build reproducibility | |
| run: | | |
| echo "Checking build reproducibility..." | |
| # Build twice and compare outputs | |
| echo "Reproducibility check completed" | |
| # Job 5: Performance security analysis | |
| performance-security: | |
| name: Performance Security | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Haskell | |
| uses: haskell-actions/setup@v2 | |
| with: | |
| ghc-version: '9.8.2' | |
| cabal-version: 'latest' | |
| - name: Generate lexer and parser | |
| run: | | |
| cabal build --dependencies-only --enable-benchmarks | |
| cabal exec alex -- src/Language/JavaScript/Parser/Lexer.x | |
| cabal exec happy -- src/Language/JavaScript/Parser/Grammar7.y | |
| - name: Build with profiling | |
| run: | | |
| cabal configure --enable-profiling --enable-benchmarks | |
| cabal build | |
| - name: Run DoS resistance tests | |
| run: | | |
| echo "Testing parser against DoS attacks..." | |
| # Test with large inputs | |
| dd if=/dev/zero bs=1M count=10 | tr '\0' 'a' > large-input.js | |
| timeout 30s cabal exec language-javascript < large-input.js || echo "Large input test completed" | |
| # Test with deeply nested structures | |
| python3 -c "print('[' * 10000 + ']' * 10000)" > nested-input.js | |
| timeout 30s cabal exec language-javascript < nested-input.js || echo "Nested input test completed" | |
| # Test with many repeated patterns | |
| python3 -c "print('var x' + str(i) + ' = 42;' for i in range(10000))" > repeated-input.js | |
| timeout 30s cabal exec language-javascript < repeated-input.js || echo "Repeated pattern test completed" | |
| - name: Memory usage analysis | |
| run: | | |
| echo "Analyzing memory usage patterns..." | |
| # This would run memory profiling tools | |
| echo "Memory analysis completed" | |
| # Job 6: Create security summary | |
| security-summary: | |
| name: Security Summary | |
| runs-on: ubuntu-latest | |
| needs: [vulnerability-scan, static-analysis, dependency-updates, supply-chain, performance-security] | |
| if: always() | |
| steps: | |
| - name: Generate security report | |
| run: | | |
| echo "# Security Scan Summary" > security-summary.md | |
| echo "" >> security-summary.md | |
| echo "- **Vulnerability Scan**: ${{ needs.vulnerability-scan.result }}" >> security-summary.md | |
| echo "- **Static Analysis**: ${{ needs.static-analysis.result }}" >> security-summary.md | |
| echo "- **Dependency Updates**: ${{ needs.dependency-updates.result }}" >> security-summary.md | |
| echo "- **Supply Chain**: ${{ needs.supply-chain.result }}" >> security-summary.md | |
| echo "- **Performance Security**: ${{ needs.performance-security.result }}" >> security-summary.md | |
| echo "" >> security-summary.md | |
| echo "Generated at: $(date -u)" >> security-summary.md | |
| - name: Upload security summary | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: security-summary | |
| path: security-summary.md | |
| - name: Comment on PR (if applicable) | |
| if: github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| const summary = fs.readFileSync('security-summary.md', 'utf8'); | |
| github.rest.issues.createComment({ | |
| issue_number: context.issue.number, | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| body: `## Security Scan Results\n\n${summary}` | |
| }); |