Florian BRUNIAUX 66101ebb65 feat: add comprehensive security review workflow for PRs ...

This PR implements a 3-layer security review process to protect RTK
against shell injection, supply chain attacks, and backdoors from
external contributors.

**Layer 1: Automated GitHub Action**
- .github/workflows/security-check.yml: Runs on every PR
  - cargo audit for CVE detection in dependencies
  - Critical files alert (runner.rs, tracking.rs, Cargo.toml, workflows)
  - Dangerous pattern scanning (Command::new("sh"), reqwest::, unsafe, etc.)
  - New dependency auditing
  - Clippy security lints
  - Structured report in GitHub Actions summary

**Layer 2: Documentation**
- SECURITY.md: Public security policy with:
  - Vulnerability reporting process (responsible disclosure)
  - PR security review workflow for external contributors
  - Critical files requiring enhanced review (3 tiers)
  - Dangerous code patterns we check for
  - Dependency security criteria
  - Best practices for contributors

**Layer 3: Claude Code Skill (external)**
- Skill rtk-pr-security deployed in reviewer's local environment
- Provides comprehensive RTK-specific analysis
- Complements automated checks with semantic analysis

**Critical Files Protected:**
- src/runner.rs (shell execution engine)
- src/summary.rs (command aggregation)
- src/tracking.rs (SQLite database)
- src/pnpm_cmd.rs (input validation)
- Cargo.toml (supply chain)
- .github/workflows/ (CI/CD tampering)

**Detection Patterns:**
- Shell injection vectors (Command::new("sh"))
- Environment manipulation (.env("LD_PRELOAD"))
- Network operations (reqwest::, std::net::)
- Unsafe code blocks
- Panic-inducing code (.unwrap() in production)
- Time-based logic bombs
- Obfuscated code (base64, hex)

**Review Requirements:**
- Standard review: Non-critical files, <200 lines
- Enhanced review: Critical files OR >200 lines
- 2 maintainers: Cargo.toml changes OR workflow modifications

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

2026-02-02 13:57:51 +01:00

6.8 KiB

Raw Permalink Blame History

View Raw