security¶

# Checks that ask "is anything in here dangerous": leaked secrets, known
# vulnerable dependencies, and a risky Dockerfile.
#
# The dependency audit talks to a vulnerability database that changes daily,
# so its result is never reused: yesterday's pass says nothing about today.

def ci(ctx):
    return [
        step(
            "secrets",
            image = "zricethezav/gitleaks:latest",
            run = "gitleaks dir . --no-banner --redact",
        ),
        step(
            "dependencies",
            image = "aquasec/trivy:latest",
            run = "trivy fs --scanners vuln --exit-code 1 --severity HIGH,CRITICAL .",
            inputs = ["**/package-lock.json", "**/go.sum", "**/uv.lock"],
            cache = False,
        ),
        step(
            "dockerfile",
            image = "hadolint/hadolint:latest-debian",
            run = "hadolint Dockerfile",
            inputs = ["Dockerfile"],
        ),
    ]

# Generated by `starci compile` from security.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - Passes are remembered in this repository's Actions cache, which GitHub
#    scopes by branch and evicts when old. starci's own store has neither
#    limit.

name: CI

on:
  push:
    branches: ['**']
    tags: ['**']
  pull_request:
  workflow_dispatch:

jobs:
  secrets:
    name: "secrets"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-secrets-4961da7da930b596-${{ hashFiles('**', '!.git/**') }}
      - name: "secrets"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            gitleaks dir . --no-banner --redact
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            zricethezav/gitleaks:latest sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

  dependencies:
    name: "dependencies"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /**/go.sum
            /**/package-lock.json
            /**/uv.lock
      - name: "dependencies"
        env:
          STARCI_RUN: |-
            trivy fs --scanners vuln --exit-code 1 --severity HIGH,CRITICAL .
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            aquasec/trivy:latest sh -c "$STARCI_RUN"

  dockerfile:
    name: "dockerfile"
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          sparse-checkout-cone-mode: false
          sparse-checkout: |
            /Dockerfile
      - name: Has this already passed with these inputs?
        id: passed
        uses: actions/cache@v4
        with:
          path: ${{ runner.temp }}/starci-passed
          key: starci-passed-dockerfile-3d2d0d6bd8b032e1-${{ hashFiles('Dockerfile', 'Dockerfile/**') }}
      - name: "dockerfile"
        if: steps.passed.outputs.cache-hit != 'true'
        env:
          STARCI_RUN: |-
            hadolint Dockerfile
        run: |
          docker run --rm \
            -v "$PWD:/workspace" \
            -w /workspace \
            hadolint/hadolint:latest-debian sh -c "$STARCI_RUN"
      - name: Remember this pass
        if: steps.passed.outputs.cache-hit != 'true'
        run: mkdir -p "$RUNNER_TEMP/starci-passed" && date > "$RUNNER_TEMP/starci-passed/at"

# Generated by `starci compile --target circleci` from security.ci.star. Edit that, not this.
#
# Each job is one step of the plan: the same image, command, tools and
# packages, given only the step's inputs. A job skips its work when it has
# already passed with the same inputs.
#
# What does not carry over:
#  - Passes are remembered in this project's CircleCI cache, which expires.
#    starci's own store does not.

version: 2.1

jobs:
  secrets:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top)' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-secrets-4961da7da930b596-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "secrets"
          environment:
            STARCI_RUN: |-
              gitleaks dir . --no-banner --redact
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              zricethezav/gitleaks:latest sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-secrets-4961da7da930b596-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

  dependencies:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/**/go.sum' '/**/package-lock.json' '/**/uv.lock'
      - run:
          name: "dependencies"
          environment:
            STARCI_RUN: |-
              trivy fs --scanners vuln --exit-code 1 --severity HIGH,CRITICAL .
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              aquasec/trivy:latest sh -c "$STARCI_RUN"

  dockerfile:
    machine:
      image: ubuntu-2404:current
    resource_class: medium
    steps:
      - checkout
      - run:
          name: "Keep only this step's inputs"
          command: |
            git sparse-checkout set --no-cone '/Dockerfile'
      - run:
          name: "Identify the inputs"
          command: |
            git ls-files -s -- ':(top,literal)Dockerfile' > /tmp/starci-inputs
      - restore_cache:
          name: Has this already passed with these inputs?
          keys:
            - starci-passed-dockerfile-3d2d0d6bd8b032e1-{{ checksum "/tmp/starci-inputs" }}
      - run:
          name: "Stop here if it has"
          command: |
            if [ -e ~/starci-passed/at ]; then
              echo "Passed before with the same inputs, on $(cat ~/starci-passed/at). Nothing to do."
              circleci-agent step halt
            fi
      - run:
          name: "dockerfile"
          environment:
            STARCI_RUN: |-
              hadolint Dockerfile
          command: |
            docker run --rm \
              -v "$PWD:/workspace" \
              -w /workspace \
              hadolint/hadolint:latest-debian sh -c "$STARCI_RUN"
      - run:
          name: "Remember this pass"
          command: |
            mkdir -p ~/starci-passed && date > ~/starci-passed/at
      - save_cache:
          key: starci-passed-dockerfile-3d2d0d6bd8b032e1-{{ checksum "/tmp/starci-inputs" }}
          paths:
            - ~/starci-passed

workflows:
  ci:
    jobs:
      - secrets
      - dependencies
      - dockerfile