rust-security.yml

name: Dependency Vulnerability Audit

on:
  pull_request:
  push:
    branches:
      - main
      - develop

jobs:
  dependency-audit:
    name: Dependency Vulnerability Scan
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Rust toolchain
        uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: npm
          cache-dependency-path: |
            backend/package-lock.json
            frontend/package-lock.json

      - name: Cache Rust dependencies
        uses: Swatinem/rust-cache@v2

      - name: Install backend dependencies
        run: npm ci
        working-directory: backend

      - name: Install frontend dependencies
        run: npm ci
        working-directory: frontend

      - name: Install cargo-audit
        run: cargo install cargo-audit

      - name: Run cargo audit
        run: |
          cargo audit --ignore RUSTSEC-2026-0097 \
            --ignore RUSTSEC-2024-0388 \
            --ignore RUSTSEC-2024-0436 \
            --json > cargo-audit.json || true
          node scripts/dependency-audit.js cargo cargo-audit cargo-audit.json

      - name: Run npm audit for backend
        run: |
          npm audit --json > backend/backend-audit.json || true
          node scripts/dependency-audit.js npm backend backend/backend-audit.json

      - name: Run npm audit for frontend
        run: |
          npm audit --json > frontend/frontend-audit.json || true
          node scripts/dependency-audit.js npm frontend frontend/frontend-audit.json

      - name: Run cargo-clippy (linting)
        run: cargo clippy --all-targets --all-features -- -D warnings
        continue-on-error: true

      - name: Run cargo-deny (supply chain security)
        continue-on-error: true
        run: |
          cargo install cargo-deny
          cargo deny check advisories

      - name: Check for unsafe code
        run: |
          echo "🔍 Scanning for unsafe code blocks..."
          if grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"; then
            echo "⚠️ Unsafe code found in non-test code. Please review:"
            grep -r "unsafe {" contracts/vault/src --include="*.rs" | grep -v "test\|fuzz"
            echo ""
            echo "✓ Verify these unsafe blocks are documented and necessary"
          else
            echo "✓ No unsafe code found in production code"
          fi