docs: fix RELEASING.md's stale secrets cross-reference to DEPLOYMENT.md #224
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: quality-gates | |
| # Merge-time quality gates: a thin caller of the zircote/.github central | |
| # reusable workflows. Each gate normalizes on SARIF and lands in the | |
| # code-scanning hub; the "Code scanning results" required check is the merge | |
| # gate. Pins resolve to the central repo's default-branch HEAD at wiring time; | |
| # Dependabot (github-actions ecosystem) keeps them fresh. | |
| # | |
| # Deploy-time attestation — the "seam" that signs each gate's verdict bound to | |
| # a release subject — lives in release.yml (publish-gated, tag-triggered). | |
| # | |
| # SAST (CodeQL) here supersedes a standalone codeql-analysis workflow; the SCA | |
| # (OSV) gate is an independent second opinion that complements the RustSec | |
| # cargo-audit run in security-audit.yml, not a replacement for it. | |
| "on": | |
| push: | |
| branches: [develop, main] | |
| pull_request: | |
| branches: [develop, main] | |
| schedule: | |
| # Weekly Monday 06:23 UTC — scattered minute (avoid GitHub's :00 load | |
| # spike) for the scheduled supply-chain posture + SAST sweep. | |
| - cron: "23 6 * * 1" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| # SAST — CodeQL (Rust, build-mode none). Net-new SAST coverage for nsip. | |
| # packages: read — the reusable's analyze job declares it (CodeQL package | |
| # resolution); a caller must grant >= the reusable's permissions or the call | |
| # fails at startup. | |
| sast: | |
| permissions: | |
| security-events: write | |
| contents: read | |
| actions: read | |
| packages: read | |
| # zircote/.github main @ 77a87549 (resolved 2026-06-16) | |
| uses: >- | |
| zircote/.github/.github/workflows/reusable-sast-codeql.yml@740cb8efb57af0187f88e9b4f939355b871a5895 | |
| with: | |
| languages: rust | |
| build-mode: none | |
| # SCA — OSV-Scanner (independent second opinion vs RustSec/cargo-audit) plus | |
| # dependency review (PR merge gate). Complements the cargo Dependabot setup | |
| # and security-audit.yml's RustSec run. | |
| sca: | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| # zircote/.github main @ 77a87549 (resolved 2026-06-16) | |
| uses: >- | |
| zircote/.github/.github/workflows/reusable-sca-osv.yml@229e6e6887c2493d43020b934983259361f2cc1b | |
| with: | |
| fail-on-severity: high | |
| # Scope OSV to the Rust crate lockfile so the gate characterizes exactly | |
| # the dependencies the crate ships; --config applies the shared ignore | |
| # policy (osv-scanner.toml) that mirrors deny.toml / cargo-audit. | |
| scan-args: |- | |
| --config=osv-scanner.toml | |
| --lockfile=Cargo.lock | |
| # Supply-chain posture — OpenSSF Scorecard. Requires the default branch, so | |
| # it does not run on pull_request. | |
| posture: | |
| if: github.event_name == 'push' || github.event_name == 'schedule' | |
| permissions: | |
| security-events: write | |
| id-token: write | |
| contents: read | |
| actions: read | |
| # zircote/.github main @ 77a87549 (resolved 2026-06-16) | |
| uses: >- | |
| zircote/.github/.github/workflows/reusable-scorecard.yml@5a805176eb4f3f22cba7bb0a25d46dc7306872e3 | |
| # IaC + license — Trivy filesystem scan (Dockerfile, manifests, licenses). | |
| # No image-ref here: the container image is scanned + attested on the release | |
| # path. packages: read — the reusable's (skipped) image job declares it; the | |
| # caller must still grant >= all the reusable's job permissions or the call | |
| # fails at startup, even for conditional jobs. | |
| trivy: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| packages: read | |
| # zircote/.github main @ 77a87549 (resolved 2026-06-16) | |
| uses: >- | |
| zircote/.github/.github/workflows/reusable-trivy.yml@b2c87d254e899550e543bedea186335b48b9a41e | |
| with: | |
| scan-iac: true |