Remove GitHub workflow metadata
ober
dd4a3839782230b73a725a65e97ccf478625265b
deleted file mode 100644 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,54 +0,0 @@ -name: CI - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -env: - JERBOA_VERSION: v0.2.3 - -jobs: - test-audit: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - - name: Install system tools - run: | - set -eu - sudo apt-get update - sudo apt-get install -y --no-install-recommends \ - build-essential \ - ca-certificates \ - curl \ - file \ - git \ - python3 - - - name: Install Jerboa toolchain - run: sh support/ensure-jerboa.sh "$JERBOA_VERSION" .jerboa/bin - - - name: Security gate - run: make security - - - name: Run unit tests - run: make test - - - name: Native audit - run: make audit - - - name: Release evidence - run: make release-evidence - - - name: High-confidence secret scan - run: | - set -eu - if git grep -I -n -E '(AKIA[0-9A-Z]{16}|-----BEGIN (RSA |DSA |EC |OPENSSH |PGP )?PRIVATE KEY-----|ghp_[A-Za-z0-9_]{36,}|xox[baprs]-[A-Za-z0-9-]{10,})' -- . ':!_vendor' ':!vendor' ':!.jerboa'; then - echo "secret-like pattern detected" >&2 - exit 1 - fi deleted file mode 100644 --- a/.github/workflows/security-baseline.yml +++ /dev/null @@ -1,38 +0,0 @@ -name: Security Baseline - -on: - push: - branches: [main, master] - pull_request: - workflow_dispatch: - -permissions: - contents: read - -jobs: - baseline: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - - - name: Required release files - run: | - set -eu - test -f LICENSE - test -f SECURITY.md - test -f .gitignore - find . -maxdepth 1 -iname "README*" -type f | grep -q . - - - name: Project security gate - run: make security - - - name: High-confidence secret scan - run: | - set -eu - pattern="(BEGIN (RSA|OPENSSH|EC|DSA|PRIVATE) KEY|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|sk-(ant-api03|proj|svcacct)-[A-Za-z0-9_-]{30,}|AKIA[0-9A-Z]{16})" - matches="$(git grep -n -I -E "$pattern" -- . ":!*.png" ":!*.jpg" ":!*.jpeg" ":!*.gif" ":!*.so" ":!*.dylib" ":!*.o" ":!*.a" ":!*.boot" ":!*.tar.gz" || true)" - if [ -n "$matches" ]; then - echo "$matches" - echo "High-confidence secret pattern found." - exit 1 - fi