Remove GitHub workflow metadata
ober
799b0963a010766e98f78485b22fcc30849c95dd
deleted file mode 100644 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,52 +0,0 @@ -name: CI - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -env: - JERBOA_VERSION: v0.2.3 - JERBUILD: ${{ github.workspace }}/.jerboa/bin/jerbuild - JERBOA_YUBIKEY_DIR: ${{ github.workspace }}/.deps/jerboa-yubikey - JERBOA_MAIL_DIR: ${{ github.workspace }}/.deps/jerboa-mail - JERBOA_HTTPS_DIR: ${{ github.workspace }}/.deps/jerboa-https - JERBOA_SSL_DIR: ${{ github.workspace }}/.deps/jerboa-ssl - -jobs: - build-test-audit: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - persist-credentials: false - - - name: Install system tools - run: | - set -eu - sudo apt-get update - sudo apt-get install -y --no-install-recommends build-essential git curl ca-certificates libssl-dev pkg-config - command -v cargo - cargo --version - - - name: Install Jerboa toolchain - run: sh support/ensure-jerboa.sh "$JERBOA_VERSION" .jerboa/bin - - - name: Fetch dependencies - run: sh support/fetch-locked-dependencies.sh "$GITHUB_WORKSPACE/.deps" - - - name: Install cargo-audit - run: cargo install cargo-audit --version 0.22.2 --locked - - - name: Verify - run: make verify - - - name: CLI status smoke - run: make run ARGS='status' - - - name: Release evidence - run: make release-evidence deleted file mode 100644 --- a/.github/workflows/security-baseline.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: Security Baseline - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - baseline: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - persist-credentials: false - - - name: Required release files - run: | - set -eu - test -f LICENSE - test -f SECURITY.md - test -f .gitignore - find . -maxdepth 1 -iname "README*" -type f | grep -q . - - - name: High-confidence secret scan - run: | - set -eu - pattern="(BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-(ant-api03|proj|svcacct)-[A-Za-z0-9_-]{30,}|AKIA[0-9A-Z]{16})" - matches="$(git grep -n -I -E "$pattern" -- . ":!*.png" ":!*.jpg" ":!*.jpeg" ":!*.gif" ":!*.so" ":!*.dylib" ":!*.o" ":!*.a" ":!*.boot" ":!*.tar.gz" || true)" - if [ -n "$matches" ]; then - echo "$matches" - echo "High-confidence secret pattern found." - exit 1 - fi