Add RustSec audit job to CI #196
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Basic | |
| on: | |
| push: | |
| branches: [ "main" ] | |
| pull_request: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: "0 16 * * 0" # Every Sunday at 16:00 UTC | |
| workflow_dispatch: | |
| inputs: | |
| deploy_documentation: | |
| description: Deploy documentation | |
| required: false | |
| type: boolean | |
| default: false | |
| env: | |
| CARGO_TERM_COLOR: always | |
| permissions: | |
| contents: read | |
| jobs: | |
| build-and-test: | |
| if: github.event_name != 'schedule' | |
| runs-on: ["oneapi-rs", "Linux"] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Check if oneAPI is already installed | |
| id: check-oneapi | |
| run: | | |
| if [ -f /home/test-user/intel/oneapi/setvars.sh ]; then | |
| echo "installed=true" >> $GITHUB_OUTPUT | |
| source /home/test-user/intel/oneapi/setvars.sh | |
| # copy envs to github | |
| printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV | |
| else | |
| echo "installed=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Setup oneAPI | |
| if: steps.check-oneapi.outputs.installed != 'true' | |
| run: | | |
| installer="intel-oneapi-toolkit-2026.1.0.192_offline.sh" | |
| checksum="9d969de9cafbb698bf50f088c4b5174b50fc816f504049e685d6f6d198e10dbc17ef2cd4cfb0bc2b3d2179644a8d77d1" | |
| curl --fail --location --retry 3 --silent --show-error --output "$installer" \ | |
| "https://registrationcenter-download.intel.com/akdlm/IRC_NAS/33cb2a22-ddf1-4aa9-8d68-1f5a118acaf2/intel-oneapi-toolkit-2026.1.0.192_offline.sh" | |
| echo "$checksum $installer" | sha384sum --check | |
| sh "./$installer" -a --silent --cli --eula accept | |
| source /home/test-user/intel/oneapi/setvars.sh | |
| # copy envs to github | |
| printenv | grep -E '^(PATH|LD_LIBRARY_PATH|LIBRARY_PATH|CPATH|C_INCLUDE_PATH|CPLUS_INCLUDE_PATH)=' >> $GITHUB_ENV | |
| - name: Print system info | |
| run: | | |
| sycl-ls --verbose | |
| - name: Check formatting | |
| run: cargo fmt --all -- --check | |
| - name: Check C++ formatting | |
| run: | | |
| git ls-files -z -- ':(glob)**/*.cpp' ':(glob)**/*.hpp' ':(glob)**/*.h' \ | |
| | xargs -0 --no-run-if-empty clang-format --dry-run --Werror | |
| - name: Run Clippy | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| - name: Build | |
| run: cargo build --verbose | |
| - name: Run workspace tests | |
| run: cargo test --workspace --verbose | |
| - name: Run examples | |
| run: | | |
| for example_path in sycl/sycl-rs/examples/*.rs; do | |
| example="$(basename "$example_path" .rs)" | |
| cargo run -p sycl-rs --example "$example" --verbose | |
| done | |
| - name: Generate documentation | |
| run: | | |
| cargo doc -p sycl-rs --no-deps --verbose | |
| cat > target/doc/index.html <<'HTML' | |
| <!doctype html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta http-equiv="refresh" content="0; url=sycl_rs/"> | |
| <title>sycl-rs documentation</title> | |
| </head> | |
| <body> | |
| <p><a href="sycl_rs/">sycl-rs documentation</a></p> | |
| </body> | |
| </html> | |
| HTML | |
| - name: Upload documentation artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: documentation | |
| path: target/doc | |
| trivy: | |
| name: Trivy scan | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| security-events: write | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Generate SPDX SBOM with Trivy | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: spdx-json | |
| output: sbom.spdx.json | |
| - name: Submit SPDX SBOM to GitHub dependency graph | |
| if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main' | |
| uses: advanced-security/spdx-dependency-submission-action@b009efcf8b9d562a4569d2028c276522232e631f # v0.4.0 | |
| with: | |
| filePath: sbom.spdx.json | |
| - name: Scan repository with Trivy | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,secret,misconfig | |
| format: sarif | |
| output: trivy-results.sarif | |
| exit-code: '1' | |
| - name: Upload Trivy findings | |
| if: ${{ always() && hashFiles('trivy-results.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@d8073367669608af8fbcc5f63dd0a0d52bb90cff # v4 | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: trivy | |
| rustsec: | |
| name: RustSec audit | |
| runs-on: ["oneapi-rs", "Linux"] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Cargo Audit | |
| run: | | |
| # Cargo Audit 0.22.2 supports SARIF and requires Rust 1.88 or newer. | |
| rustup toolchain install stable --profile minimal | |
| cargo +stable install cargo-audit --version 0.22.2 --locked --no-default-features | |
| - name: Audit dependencies against RustSec | |
| run: cargo +stable audit --deny unsound --format sarif > cargo-audit.sarif | |
| - name: Upload RustSec findings | |
| # Upload the report even when the audit step fails on findings. | |
| if: ${{ always() && hashFiles('cargo-audit.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@d8073367669608af8fbcc5f63dd0a0d52bb90cff # v4 | |
| with: | |
| sarif_file: cargo-audit.sarif | |
| category: rustsec | |
| deploy-documentation: | |
| if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event_name == 'workflow_dispatch' && inputs.deploy_documentation == 'true') | |
| needs: build-and-test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Download documentation artifact | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: documentation | |
| path: target/doc | |
| - name: Configure GitHub Pages | |
| uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 | |
| - name: Upload documentation to GitHub Pages | |
| uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 | |
| with: | |
| path: target/doc | |
| - name: Deploy documentation to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 |