Skip to content

fix(ci): resolve all code scanning security alerts #57

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yacosta738 merged 3 commits into from
Jun 1, 2026
Merged

fix(ci): resolve all code scanning security alerts #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d8da7f8
fix(build): allow cargo check without node_modules in worktree
yacosta738 Jun 1, 2026
9ba5461
fix(ci): address all code scanning security alerts
yacosta738 Jun 1, 2026
cb18d8f
fix(ci): harden checkout credentials and build script
yacosta738 Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
144 changes: 105 additions & 39 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,13 +10,20 @@ env:
CARGO_TERM_COLOR: always
RUST_BACKTRACE: 1

permissions:
contents: read

jobs:
# === Fast checks first ===
fmt:
name: Format
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
Comment thread
coderabbitai[bot] marked this conversation as resolved.
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
with:
components: rustfmt
Expand All @@ -28,10 +35,14 @@ jobs:
markdown:
name: Markdown
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093
- uses: actions/setup-node@v6.4.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6
- uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
- name: Install dependencies
run: pnpm install
- name: Lint markdown
Expand All @@ -40,10 +51,14 @@ jobs:
clippy:
name: Clippy
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -58,10 +73,14 @@ jobs:
check:
name: Check
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -77,10 +96,14 @@ jobs:
test:
name: Test
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -95,10 +118,14 @@ jobs:
doc:
name: Doc
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -116,8 +143,12 @@ jobs:
audit:
name: Audit
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: dtolnay/rust-toolchain@dd44c20b1206a46e25fba8503d5d7c9a33bd355a
- name: Install cargo-audit
run: cargo install cargo-audit
Expand All @@ -129,10 +160,15 @@ jobs:
name: Coverage
runs-on: ubuntu-latest
needs: [test]
permissions:
contents: read
statuses: write
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -146,7 +182,7 @@ jobs:
- name: Generate coverage report
run: cargo llvm-cov --lcov --output-path lcov.info
- name: Upload coverage to Codecov
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
with:
files: lcov.info
fail_ci_if_error: true
Expand All @@ -158,10 +194,15 @@ jobs:
name: Coverage (Frontend)
runs-on: ubuntu-latest
needs: [test]
permissions:
contents: read
statuses: write
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -171,7 +212,7 @@ jobs:
working-directory: apps/rook/dashboard
run: pnpm exec vitest run --coverage --reporter=json --output-filename=coverage/coverage-final.json
- name: Upload coverage to Codecov
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354
uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6
with:
files: apps/rook/dashboard/coverage/lcov.info
fail_ci_if_error: true
Expand All @@ -184,10 +225,19 @@ jobs:
runs-on: ubuntu-latest
needs: [test]
if: secrets.SONAR_TOKEN != ''
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
- name: Install dependencies
run: pnpm install
- name: SonarQube Scan
uses: SonarSource/sonarqube-scan-action@7006c4492b2e0ee0f816d36501671557c97f5995 # v8.1.0
env:
Expand All @@ -205,10 +255,14 @@ jobs:
# aarch64-unknown-linux-gnu is removed: cross-compiling OpenSSL (ring, openssl-sys)
# requires target-specific headers which is complex. Windows ARM64 is covered
# natively in build-windows job.
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -232,10 +286,14 @@ jobs:
target:
- x86_64-pc-windows-msvc
- aarch64-pc-windows-msvc
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -259,10 +317,14 @@ jobs:
target:
- x86_64-apple-darwin
- aarch64-apple-darwin
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -284,10 +346,14 @@ jobs:
fail-fast: false
matrix:
os: [macos-latest, windows-latest]
permissions:
contents: read
steps:
- uses: actions/checkout@v6.0.2
- uses: pnpm/action-setup@v4.1.0
- uses: actions/setup-node@v4.2.0
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
- uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4.2.0
with:
node-version: 22
cache: 'pnpm'
Expand All @@ -299,4 +365,4 @@ jobs:
- name: Run tests
run: cargo test --workspace --all-features
- name: Run clippy
run: cargo clippy --workspace --all-targets -- -D warnings
run: cargo clippy --workspace --all-targets -- -D warnings
47 changes: 34 additions & 13 deletions apps/rook/build.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,21 +2,42 @@ use std::path::Path;
use std::process::Command;

fn main() {
let dashboard_dir = Path::new("dashboard");
let status = Command::new("sh")
.current_dir(dashboard_dir)
.arg("-c")
.arg("./node_modules/.bin/vite build")
.status()
.expect("failed to run dashboard build: sh or vite not found");

if !status.success() {
eprintln!("dashboard build failed with exit code: {}", status);
std::process::exit(1);
}

// Emit rerun-if-changed unconditionally so Cargo knows when to rebuild
println!("cargo:rerun-if-changed=dashboard/dist");
println!("cargo:rerun-if-changed=dashboard/src");
println!("cargo:rerun-if-changed=dashboard/vite.config.ts");
println!("cargo:rerun-if-changed=dashboard/package.json");

// Only build dashboard if node_modules/.bin/vite exists (i.e. deps are installed)
// This allows `cargo check` to pass without running the full vite build
let dashboard_dir = Path::new("dashboard");
let vite_path = dashboard_dir.join("node_modules/.bin/vite");

if vite_path.exists() {
let status = Command::new("sh")
.current_dir(dashboard_dir)
.arg("-c")
.arg("./node_modules/.bin/vite build")
.status()
.expect("failed to run dashboard build: sh or vite not found");

if !status.success() {
eprintln!("dashboard build failed with exit code: {}", status);
std::process::exit(1);
}
} else {
let profile = std::env::var("PROFILE").unwrap_or_default();
if profile == "release" {
eprintln!(
"error: dashboard/node_modules/.bin/vite not found in release mode"
);
eprintln!("hint: run `pnpm install` in the repo root before building release"
);
std::process::exit(1);
}
println!(
"cargo:warning=dashboard/node_modules/.bin/vite not found, skipping dashboard build"
);
println!("cargo:warning=hint: run `pnpm install` in the repo root to enable dashboard embedding");
}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
}
Loading