agent-desktop/.github/workflows/supply-chain.yml

name: Supply Chain

on:
  pull_request:
  push:
    branches: [main, master]
  schedule:
    - cron: '37 9 * * 1'
  workflow_dispatch:

concurrency:
  group: supply-chain-${{ github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  audit:
    name: Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          # Full history so the secret scan below can walk commits, not just
          # the final tree. A shallow clone would silently reduce it to a
          # working-tree scan.
          fetch-depth: 0

      - name: Check release metadata consistency
        run: scripts/check-release-consistency.sh

      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '24'

      - name: Check npm package and publish policy
        run: node scripts/check-npm-package.js

      - name: Cargo dependency policy
        uses: EmbarkStudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe # v2.0.20
        with:
          command: check
          arguments: --locked
          command-arguments: advisories licenses bans sources

      - name: Secret and privacy scan
        env:
          GITLEAKS_VERSION: 8.30.1
          GITLEAKS_SHA256: 551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb
        run: |
          set -euo pipefail
          archive="gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz"
          curl -fsSL -o "$archive" \
            "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/${archive}"
          echo "${GITLEAKS_SHA256}  ${archive}" | sha256sum --check --status
          tar -xzf "$archive" gitleaks
          # Scan commit history, not just the checked-out tree: a value added
          # in one commit and removed in a later one stays reachable in branch
          # history, and a tree-only scan would pass it.
          ./gitleaks git . --config .gitleaks.toml --redact --no-banner --exit-code 1          

      - name: Workflow security audit
        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          version: 1.25.2
          persona: regular
          min-severity: medium
          min-confidence: high
          advanced-security: false
          inputs: .github/workflows