Encryption-tool/.github/workflows/security.yml at master · ElmanCod110/Encryption-tool · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: Security and Release Integrity

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  php-security:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7

      - name: Setup PHP
        uses: shivammathur/setup-php@2.37.2
        with:
          php-version: '8.3'
          extensions: sodium,zip,pdo_mysql
          coverage: none

      - name: PHP syntax check
        run: |
          find app bin public tests -type f -name '*.php' -print0 | xargs -0 -n1 php -l

      - name: Composer manifest validation
        run: composer validate --no-check-publish

      - name: Strict lock validation when a lock is committed
        run: |
          if [ -f composer.lock ]; then
            composer validate --strict --no-check-publish
          else
            echo "::notice::composer.lock is not committed; dependency installation will resolve composer.json."
          fi

      - name: Install dependencies
        run: |
          if [ -f composer.lock ]; then
            composer install --no-interaction --no-progress --prefer-dist
          else
            echo "::warning::composer.lock is not committed; dependency installation will resolve composer.json.";
            composer install --no-interaction --no-progress --prefer-dist
          fi

      - name: Dependency audit
        run: composer audit --no-interaction

      - name: Core tests
        run: |
          set -e
          php tests/CryptoRoundTripTest.php
          php tests/FileRoundTripTest.php
          php tests/KdfParameterTest.php
          php tests/TamperDetectionTest.php
          php tests/ResumableUploadTest.php
          php tests/SecurityInvariantTest.php
          php tests/ApiRequestPolicyTest.php
          php tests/ApiHttpIntegrationTest.php
          php tests/ArchiveWorkflowRollbackTest.php
          php tests/RestoreTokenTest.php
          php tests/RestoreTokenCleanupTest.php
          php tests/RestoreFailureCleanupTest.php
          php tests/RestoredDownloadSafetyTest.php
          php tests/AccountStoreCorruptionTest.php
          php tests/AccountStoreBehaviorTest.php
          php tests/PackageAccessTokenStoreTest.php
          php tests/PackageCatalogMutationTest.php
          php tests/ResumableUploadQuotaTest.php
          php tests/WebSecuritySessionConfigurationTest.php
          php tests/RateLimiterTest.php
          php tests/SignedStateTest.php
          php tests/ReleaseIntegrityTest.php
          php tests/ReleaseVerifierTrustRootTest.php
          php tests/V13DescriptorTest.php
          php tests/V13UploadTest.php
          php tests/V14DescriptorTest.php
          php tests/V14HeaderBindingTest.php
          php tests/V14PackageRoundTripTest.php
          php tests/V14RecoveryTest.php
          php tests/V14TamperHeaderTest.php
          php tests/V14BlobTamperTest.php
          php tests/V14RestoreSafetyTest.php
          php tests/V14PackageArchiveTest.php
          php tests/V14PackageArchiveStorageTest.php

      - name: Self check
        run: php bin/self-check.php

      - name: Source security audit
        run: php bin/source-audit.php

      - name: Legacy browser V13 round-trip
        run: node tests/BrowserV13RoundTripTest.mjs