security.yml

name: Security

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Saturday 11:07 UTC = Sat 21:07 AEST / 22:07 AEDT (Sydney night, year-round).
    # Weekly cadence: deep fuzz at 1h/target × 16 targets. Each matrix target is a
    # separate GitHub-hosted job, so they run in parallel (bounded by GitHub's
    # concurrency limit) rather than serialising on shared runners — and hosted minutes
    # are free for public repos. The longer opt-in run is via workflow_dispatch
    # (run_deep_fuzz). PR-time coverage (cargo audit/deny, Cargo Vet, Quick Fuzz,
    # CodeQL) catches regressions promptly; deep fuzz is for finding bugs, not
    # gating merges. Off-minute (:07) avoids the cron pile-up GitHub schedules at :00.
    - cron: '7 11 * * 6'
  # Deliberately no `release:` trigger. It existed only for an SBOM job that
  # attached a release asset, and that can never work here: immutable releases
  # are enabled on this repo and GitHub seals a release's assets at publish, so
  # the upload always failed with "Cannot upload assets to an immutable release"
  # — every release since v0.1.0 has zero assets (LAB-983). The SBOM is generated
  # and attested in release.yml via actions/attest-sbom; that attestation is the
  # verifiable artifact, and a plain release asset would be an unsigned weaker
  # copy of it. Re-adding this alone only makes empty runs; the asset upload would
  # additionally need the release created as a draft, attached, then published.
  # On-demand: lets the schedule-only jobs (e.g. Kani) be run and verified
  # without waiting for the weekly cron. A plain dispatch does NOT trigger the
  # heavy deep-fuzz matrix — set run_deep_fuzz=true to opt into that.
  workflow_dispatch:
    inputs:
      run_deep_fuzz:
        description: "Run the full deep-fuzz matrix (heavy — one hosted job per target)"
        type: boolean
        default: false
      fuzz_seconds:
        description: "Seconds per target for an on-demand deep fuzz (default 5h; hard cap 18000s to fit GitHub's 6h job limit)"
        type: string
        default: "18000"

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

jobs:
  fast-security:
    name: Fast Security Checks
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
        with:
          toolchain: "stable"
          components: clippy

      - name: Cache Rust dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-security-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-security-
            ${{ runner.os }}-cargo-

      - name: Install cargo-audit
        run: cargo install cargo-audit --locked

      - name: Install cargo-deny
        run: cargo install cargo-deny --locked

      - name: Run cargo audit (CVE scanning)
        run: cargo audit

      - name: Run cargo deny (license compliance + advisories)
        run: cargo deny check

      - name: Run clippy (strict linting)
        run: cargo clippy --all-features --all-targets -- -D warnings

      - name: Run tests
        run: cargo test --all-features

  quick-fuzz:
    name: Quick Fuzz (Corpus Only)
    runs-on: ubuntu-latest
    if: github.event_name == 'push' || github.event_name == 'pull_request'
    strategy:
      fail-fast: false
      matrix:
        target:
          - byte_storage_checksum_collision
          - byte_storage_compress
          - byte_storage_corrupted_envelope
          - byte_storage_decompress
          - byte_storage_empty_data
          - byte_storage_format_injection
          - byte_storage_integer_overflow
          - compression_bomb
          - encryption_aad_injection
          - encryption_key_derivation
          - encryption_large_payload
          - encryption_nonce_reuse
          - encryption_roundtrip
          - encryption_truncated_ciphertext
          - integration_layered_security
          - key_derivation
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly

      - name: Cache Rust dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            fuzz/target/
          key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-fuzz-nightly-
            ${{ runner.os }}-cargo-

      - name: Install cargo-fuzz
        # NOTE: --locked omitted: cargo-fuzz 0.13.1's published Cargo.lock pins
        # rustix 0.36.5, which uses unstable `rustc_attrs` cfg gates that newer
        # nightly rustc rejects. Let cargo resolve fresh deps.
        run: cargo install cargo-fuzz

      - name: Run quick fuzz (corpus only)
        run: |
          cd fuzz
          # Build first - fail fast on compile errors
          cargo fuzz build ${{ matrix.target }}
          # libFuzzer self-exits at -max_total_time (graceful "Done ..."); the outer
          # `timeout` is a +30s hang safety-net only. Buffer matters because libFuzzer's
          # clock starts after build/corpus-load, so an equal `timeout` would always
          # SIGTERM first ("run interrupted") and the graceful path would be unreachable.
          # Exit 124 (timeout fired = genuine hang) is still tolerated.
          timeout 150 cargo fuzz run ${{ matrix.target }} -- -runs=0 -max_total_time=120 || [ $? -eq 124 ]

  deep-fuzz:
    name: Deep Fuzzing
    runs-on: ubuntu-latest
    # Scheduled weekly run is light (1h/target). The longer on-demand run is opt-in
    # via workflow_dispatch (run_deep_fuzz) and clamped to fit the hosted 6h cap.
    if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.run_deep_fuzz)
    # 360min = GitHub's hosted job cap. The inner timeout governs the actual
    # scheduled (1h) vs dispatched (<=5h, clamped below) duration.
    timeout-minutes: 360
    permissions:
      contents: read
      actions: read # list and download the previous run's corpus artifact
    strategy:
      fail-fast: false
      matrix:
        target:
          - byte_storage_checksum_collision
          - byte_storage_compress
          - byte_storage_corrupted_envelope
          - byte_storage_decompress
          - byte_storage_empty_data
          - byte_storage_format_injection
          - byte_storage_integer_overflow
          - compression_bomb
          - encryption_aad_injection
          - encryption_key_derivation
          - encryption_large_payload
          - encryption_nonce_reuse
          - encryption_roundtrip
          - encryption_truncated_ciphertext
          - integration_layered_security
          - key_derivation
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@5b842231ba77f5c045dba54ac5560fed2db780e2 # nightly

      - name: Cache Rust dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            fuzz/target/
          key: ${{ runner.os }}-cargo-fuzz-nightly-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-fuzz-nightly-
            ${{ runner.os }}-cargo-

      - name: Install cargo-fuzz
        # NOTE: --locked omitted: cargo-fuzz 0.13.1's published Cargo.lock pins
        # rustix 0.36.5, which uses unstable `rustc_attrs` cfg gates that newer
        # nightly rustc rejects. Let cargo resolve fresh deps.
        run: cargo install cargo-fuzz

      - name: Find previous fuzz corpus
        id: corpus
        # Each run resumes from the corpus the previous run uploaded, so coverage
        # accumulates instead of restarting cold. An artifact, not the Actions cache:
        # cache entries are evicted under size pressure and after 7 days unused, which
        # a weekly run cannot outlast. Only this repository's runs on the same ref
        # qualify, so a branch or fork run cannot seed this one.
        env:
          GH_TOKEN: ${{ github.token }}
          TARGET: ${{ matrix.target }}
          REF_NAME: ${{ github.ref_name }}
          REPO_ID: ${{ github.repository_id }}
        run: |
          # Two steps, so a failed listing fails this step (set -e) instead of
          # reading as "no artifact". --paginate walks every page: newer artifacts
          # from other branches must not push this ref's corpus off page one.
          artifacts=$(gh api --paginate "repos/${GITHUB_REPOSITORY}/actions/artifacts?name=fuzz-corpus-${TARGET}&per_page=100" \
            --jq '.artifacts[]')
          run_id=$(jq -rs --arg ref "$REF_NAME" --argjson repo "$REPO_ID" '
              [.[]
               | select(.expired | not)
               | select(.workflow_run.head_branch == $ref and .workflow_run.head_repository_id == $repo)]
              | sort_by(.created_at) | last | .workflow_run.id // empty' <<< "$artifacts")
          if [ -z "$run_id" ]; then
            echo "::warning::No fuzz-corpus-${TARGET} artifact from ${REF_NAME}; starting from an empty corpus"
          fi
          echo "run_id=${run_id}" >> "$GITHUB_OUTPUT"

      - name: Restore fuzz corpus
        if: steps.corpus.outputs.run_id != ''
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: fuzz-corpus-${{ matrix.target }}
          path: fuzz/corpus/${{ matrix.target }}
          run-id: ${{ steps.corpus.outputs.run_id }}
          github-token: ${{ github.token }}

      - name: Run deep fuzz
        # Scheduled runs use 1h/target; a manual workflow_dispatch can request a
        # longer duration (up to the 5h clamp below) via fuzz_seconds.
        env:
          FUZZ_SECONDS: ${{ (github.event_name == 'workflow_dispatch' && inputs.fuzz_seconds) || '3600' }}
        run: |
          # Validate the dispatch-supplied duration before it reaches shell arithmetic
          # and the fuzzer. Must be a positive integer within the hosted 6h job cap.
          # Ceiling is 18000s (5h): +180s hang slack (below) still leaves headroom
          # under timeout-minutes 360 (21600s), so a dispatched job cannot exceed 6h.
          case "$FUZZ_SECONDS" in
            ''|*[!0-9]*) echo "::error::fuzz_seconds must be a positive integer (got '$FUZZ_SECONDS')"; exit 1 ;;
          esac
          if [ "$FUZZ_SECONDS" -lt 1 ] || [ "$FUZZ_SECONDS" -gt 18000 ]; then
            echo "::error::fuzz_seconds must be 1..18000 (<= 6h hosted job cap), got $FUZZ_SECONDS"; exit 1
          fi
          cd fuzz
          # Build first - fail fast on compile errors
          cargo fuzz build ${{ matrix.target }}
          # libFuzzer self-exits at -max_total_time with a graceful "Done N runs ..."
          # (final stats + corpus consolidation). The outer `timeout` is +3min slack so
          # it only fires on a genuine hang — NOT as the normal end-of-budget stop. An
          # equal `timeout` would always win the race (libFuzzer's clock starts later,
          # after build/corpus-load) and every run would log "run interrupted" instead,
          # making a real hang indistinguishable from normal completion. Exit 124 (hang
          # killed by timeout) remains tolerated.
          timeout "$((FUZZ_SECONDS + 180))" cargo fuzz run ${{ matrix.target }} -- -max_total_time="$FUZZ_SECONDS" || [ $? -eq 124 ]

      - name: Save fuzz corpus
        # always(): a run that found a crash still grew the corpus.
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fuzz-corpus-${{ matrix.target }}
          path: fuzz/corpus/${{ matrix.target }}/
          retention-days: 90
          if-no-files-found: warn

      - name: Upload crash artifacts
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: fuzz-crashes-${{ matrix.target }}
          path: fuzz/artifacts/${{ matrix.target }}/
          if-no-files-found: ignore

  kani:
    name: Kani Formal Verification
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
    permissions:
      contents: read # least-privilege: the job only checks out and verifies
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          # Host toolchain for the kani-verifier installer only — Kani downloads its
          # own pinned verification toolchain in `cargo kani setup`. Must be current
          # stable: kani-verifier's deps (e.g. home 0.5.12) now require rustc >= 1.88,
          # so the old "1.85" pin failed to compile the installer.
          toolchain: stable

      - name: Cache Rust dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-kani-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-kani-
            ${{ runner.os }}-cargo-

      - name: Install Kani
        # No `|| echo` swallowing: a failed install/setup MUST fail the job. Silently
        # skipping verification gives false green-CI assurance. --force makes the
        # install idempotent on the runner's persistent cargo cache.
        run: |
          cargo install --locked --force kani-verifier
          cargo kani setup

      - name: Run Kani verification
        # No continue-on-error, no `|| echo`: a failed proof must turn CI red.
        run: cargo kani --all-features

  cargo-vet:
    name: Cargo Vet (Supply Chain)
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'pull_request'
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9 # master
        with:
          toolchain: "1.85"

      - name: Cache Rust dependencies
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
        with:
          path: |
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            ~/.cargo/git/db/
            target/
          key: ${{ runner.os }}-cargo-vet-${{ hashFiles('**/Cargo.lock') }}
          restore-keys: |
            ${{ runner.os }}-cargo-vet-
            ${{ runner.os }}-cargo-

      - name: Install cargo-vet
        run: cargo install cargo-vet --locked

      - name: Run cargo vet
        run: cargo vet