Repository navigation
Expand file tree
/
Copy pathquantum-readiness.yml
More file actions
59 lines (52 loc) · 2.1 KB
/
Copy pathquantum-readiness.yml
File metadata and controls
59 lines (52 loc) · 2.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# Quantum-readiness gate for CI.
#
# Drop this at .github/workflows/quantum-readiness.yml in your repository.
# It scans the codebase on every pull request and push to main, fails the
# build when NEW quantum-vulnerable cryptography at/above "high" is introduced,
# uploads a SARIF report to GitHub code scanning, and comments a summary on PRs.
name: Quantum Readiness
on:
pull_request:
push:
branches: [main]
permissions:
contents: read
security-events: write
# Required by upload-sarif to resolve the run it attaches results to.
actions: read # upload SARIF to the Security tab
pull-requests: write # comment on pull requests
jobs:
quantakrypto:
name: quantakrypto — Quantum Readiness Scan
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Scan for quantum-vulnerable crypto
id: quantakrypto
uses: quantakrypto/pqc-tools/packages/action@v1
with:
path: "."
severity-threshold: "high"
fail-on-findings: "true"
format: "sarif"
output: "quantakrypto.sarif.json"
# Only fail on NEW findings relative to a committed baseline:
# baseline: ".quantakrypto/baseline.json"
comment-pr: "true"
github-token: ${{ github.token }}
# Code scanning needs GitHub Advanced Security on a PRIVATE repository
# (it is free on public ones). Without it this step fails with "Advanced
# Security must be enabled". continue-on-error keeps the scan useful
# meanwhile: the job summary and diff annotations are written regardless.
- name: Upload SARIF to code scanning
continue-on-error: true
if: always() # upload even when the scan failed the job
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: ${{ steps.quantakrypto.outputs.sarif-file }}
- name: Show readiness score
if: always()
run: |
echo "Readiness score: ${{ steps.quantakrypto.outputs.readiness-score }}/100"
echo "Blocking findings: ${{ steps.quantakrypto.outputs.findings-count }}"