security-medium.yml

name: Security Medium

on:
  push:
    branches: [ main ]
  workflow_dispatch:  # Manual re-run / pre-merge validation of the workflow itself

permissions:
  contents: read
  security-events: write  # Required for security tool integrations

env:
  CARGO_TERM_COLOR: always
  RUST_BACKTRACE: 1

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Medium security checks - post-merge validation
  cargo-geiger:
    name: Unsafe Code Tracking
    runs-on: ubuntu-latest
    # cargo-geiger pulls in the `cargo` crate; measured ~4 min cold on a hosted
    # runner, and rust-cache keeps the binary across runs.
    timeout-minutes: 10
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
      with:
        # After a Cargo.lock change, rust-cache restores an older target/ whose
        # dep-info names crates the new lockfile never unpacks; cargo-geiger
        # reads every dep-info file and fails on the first missing source. A
        # clean target/ takes about as long here; the binary and registry stay cached.
        cache-targets: "false"

    - name: Install cargo-geiger
      run: cargo install --locked cargo-geiger

    - name: Run unsafe code analysis
      run: |
        cd rust
        cargo geiger --output-format Json > geiger-report.json
        cat geiger-report.json

    - name: Check unsafe in cachekit-rs (must be zero)
      run: |
        cd rust
        UNSAFE_FUNCS=$(jq '.packages[] | select(.package.id.name == "cachekit-rs") | .unsafety.used.functions.unsafe_' geiger-report.json)
        if [ -z "$UNSAFE_FUNCS" ]; then
          echo "cachekit-rs not found in geiger report"
          exit 1
        fi
        echo "cachekit-rs unsafe functions: $UNSAFE_FUNCS"
        if [ "$UNSAFE_FUNCS" -ne 0 ]; then
          echo "cachekit-rs has $UNSAFE_FUNCS unsafe functions — must be zero"
          exit 1
        fi
        echo "cachekit-rs has zero unsafe functions"

    - name: Archive geiger report
      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
      if: always()
      with:
        name: geiger-report
        path: rust/geiger-report.json
        retention-days: 30

  miri-subset:
    name: Miri UB Detection (Subset)
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

    - name: Install nightly Rust with Miri
      run: |
        rustup toolchain install nightly --component miri
        rustup default nightly

    - name: Run Miri on byte_storage module
      run: |
        cd rust
        cargo miri test --lib --no-default-features --features compression,checksum,messagepack byte_storage

    - name: Run Miri on encryption module
      run: |
        cd rust
        cargo miri test --lib --no-default-features --features encryption encryption

  # Note: cargo-semver-checks removed - cachekit-rs is PyO3 bindings only,
  # not a public Rust API. The actual Rust library (cachekit-core) is a
  # separate crate published at https://crates.io/crates/cachekit-core

  # Summary job
  security-medium-success:
    name: Security Medium Success
    runs-on: ubuntu-latest
    needs: [cargo-geiger, miri-subset]
    if: always()
    steps:
    - name: Check all security checks passed
      run: |
        if [[ "${{ needs.cargo-geiger.result }}" != "success" ]] || \
           [[ "${{ needs.miri-subset.result }}" != "success" ]]; then
          echo "❌ One or more medium security checks failed"
          exit 1
        fi
        echo "✅ All medium security checks passed"