Repository navigation
Reconcile Echo identity evidence and record Agda checks #728
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # | |
| # Self-contained Hypatia neurosymbolic security scan + SARIF upload (`category: | |
| # hypatia`) satisfying the `Hypatia` code-scanning tool requirement in the | |
| # `Base` branch ruleset on `main`, as well as push, weekly schedule, and manual | |
| # dispatch runs. | |
| name: Hypatia Security Scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, master, develop] | |
| schedule: | |
| - cron: '0 0 * * 0' | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| hypatia: | |
| name: Hypatia Neurosymbolic Analysis | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| vulnerability-alerts: read # Dependabot alerts, for Hypatia's DA rules | |
| env: | |
| HYPATIA_SHA: '7c10e5d712af7178f8c175e10a21c5216216c198' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup Elixir 1.19.4 / OTP 28.3 for Hypatia scanner | |
| uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1 | |
| with: | |
| elixir-version: '1.19.4' | |
| otp-version: '28.3' | |
| - name: Cache pinned Hypatia build | |
| id: cache-hypatia | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/hypatia | |
| ~/.hex | |
| ~/.mix | |
| key: hypatia-sarif-${{ runner.os }}-otp28-elx1194-${{ env.HYPATIA_SHA }} | |
| - name: Build pinned Hypatia scanner | |
| run: | | |
| set -euo pipefail | |
| if [ ! -x "$HOME/hypatia/hypatia" ] || [ ! -x "$HOME/hypatia/hypatia-cli.sh" ]; then | |
| rm -rf "$HOME/hypatia" | |
| git init "$HOME/hypatia" | |
| git -C "$HOME/hypatia" remote add origin https://github.com/hyperpolymath/hypatia.git | |
| git -C "$HOME/hypatia" fetch --depth=1 origin "$HYPATIA_SHA" | |
| git -C "$HOME/hypatia" checkout --detach FETCH_HEAD | |
| ( | |
| cd "$HOME/hypatia" | |
| mix local.hex --force | |
| mix local.rebar --force | |
| mix deps.get | |
| MIX_NO_PUBSUB=1 mix escript.build | |
| ) | |
| chmod +x "$HOME/hypatia/hypatia" "$HOME/hypatia/hypatia-cli.sh" | |
| fi | |
| - name: Run Hypatia JSON and SARIF analysis | |
| id: scan | |
| env: | |
| # The API-backed rules (code-scanning, Dependabot, secret-scanning, | |
| # branch-protection, baseline-health) return no findings without a | |
| # token. Scoped to this step. The job token reaches code-scanning | |
| # (security-events) and Dependabot (vulnerability-alerts) alerts; | |
| # it cannot read secret-scanning alerts, which need an App or PAT. | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| HYPATIA_FORMAT=json "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia-findings.json | |
| jq -e 'type == "array"' hypatia-findings.json >/dev/null | |
| HYPATIA_FORMAT=sarif "$HOME/hypatia/hypatia-cli.sh" scan . --exit-zero > hypatia.sarif | |
| jq -e '.runs | type == "array" and length > 0' hypatia.sarif >/dev/null | |
| CRITICAL="$(jq '[.[] | select(.severity == "critical")] | length' hypatia-findings.json)" | |
| HIGH="$(jq '[.[] | select(.severity == "high")] | length' hypatia-findings.json)" | |
| TOTAL="$(jq 'length' hypatia-findings.json)" | |
| { | |
| echo "critical=$CRITICAL" | |
| echo "high=$HIGH" | |
| echo "total=$TOTAL" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Upload Hypatia SARIF to GitHub Code Scanning | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 | |
| with: | |
| sarif_file: hypatia.sarif | |
| category: hypatia | |
| - name: Enforce zero critical Hypatia findings | |
| env: | |
| CRITICAL_COUNT: ${{ steps.scan.outputs.critical }} | |
| HIGH_COUNT: ${{ steps.scan.outputs.high }} | |
| TOTAL_COUNT: ${{ steps.scan.outputs.total }} | |
| run: | | |
| set -euo pipefail | |
| { | |
| echo "## Hypatia Neurosymbolic Scan" | |
| echo "" | |
| echo "- Critical: ${CRITICAL_COUNT}" | |
| echo "- High: ${HIGH_COUNT}" | |
| echo "- Total findings: ${TOTAL_COUNT}" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| if [ "$CRITICAL_COUNT" != "0" ]; then | |
| echo "::error::Hypatia reported ${CRITICAL_COUNT} critical finding(s)" | |
| exit 1 | |
| fi |