react-native-security-toolkit/.github/workflows/ci.yml at main · programmer443/react-native-security-toolkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
name: CI

on:
  push:
    branches: [main]
  pull_request:

# Least privilege by default; jobs opt in to more where they genuinely need it.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

env:
  # Never let a dependency's lifecycle script run implicitly in CI.
  npm_config_ignore_scripts: 'true'

jobs:
  verify:
    name: Lint, typecheck and unit tests
    runs-on: ubuntu-latest
    # Only this job needs to publish alerts; every other job stays read-only.
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Set up pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Check formatting
        run: pnpm format:check

      - name: Lint
        run: pnpm lint

      - name: Typecheck
        run: pnpm -r typecheck

      - name: Unit tests
        run: pnpm -r test

      - name: Native engine version is in sync
        run: node scripts/sync-native-version.mjs --check

      - name: Package build
        run: pnpm build

      # The toolkit scans its own repository (§58). Configured by
      # security-toolkit.config.ts, which is also the worked example of the format.
      - name: Security self-audit
        run: pnpm security:audit

      # Generated even when the audit gate fails, so the alerts still reach code
      # scanning. `--min info` because GitHub does the filtering, and a finding
      # missing from the SARIF is a finding nobody sees.
      - name: Generate SARIF
        if: always()
        run: >
          node packages/cli/bin/rn-security.mjs audit .
          --format sarif --min info --out rn-security.sarif

      - name: Upload SARIF to code scanning
        if: always()
        uses: github/codeql-action/upload-sarif@f3712979fa5f215279b101dd0a2e3bdfb4353324 # v3
        with:
          sarif_file: rn-security.sarif
          category: rn-security-auditor

  build-android:
    name: Build Android
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Set up pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Set up JDK
        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
        with:
          distribution: temurin
          java-version: '17'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Native unit tests
        working-directory: example/android
        run: ./gradlew :react-native-security-toolkit:testDebugUnitTest --console=plain

      - name: Build example app
        working-directory: example
        run: pnpm build:android

      # Google Play requires 16 KB page-size support for apps targeting Android
      # 15+. `react-native build-android` produces an app bundle, so the library
      # is read out of the .aab — an .apk is accepted too, for when that command
      # changes or someone runs this against a locally assembled build.
      - name: Native library is 16 KB aligned
        run: |
          set -euo pipefail
          ARTIFACT=$(find example/android/app/build/outputs \( -name '*.aab' -o -name '*.apk' \) -print -quit)
          if [ -z "$ARTIFACT" ]; then
            echo "no .aab or .apk under example/android/app/build/outputs"
            exit 1
          fi
          echo "artifact: $ARTIFACT"
          rm -rf "${RUNNER_TEMP}/nativecheck"
          unzip -o -q "$ARTIFACT" '*librnsecuritytoolkit.so' -d "${RUNNER_TEMP}/nativecheck"
          node scripts/check-elf-alignment.mjs "${RUNNER_TEMP}/nativecheck"

  build-ios:
    name: Build iOS
    runs-on: macos-latest
    steps:
      - name: Checkout
        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Set up pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Set up Node
        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
        with:
          node-version-file: .nvmrc
          cache: pnpm

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: iOS engine unit tests
        working-directory: packages/runtime
        run: swift test

      - name: Install pods
        working-directory: example/ios
        run: pod install

      - name: Build example app
        working-directory: example
        run: pnpm build:ios