ci: pinned ci-workflows reusables — ci, supply-chain, codeql, releases

.github/dependabot.yml

@@ -0,0 +1,48 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore"
+      include: scope
+    labels:
+      - dependencies
+    groups:
+      cargo:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      cargo-security:
+        applies-to: security-updates
+        patterns: ["*"]
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+      time: "06:00"
+      timezone: "UTC"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+    commit-message:
+      prefix: "chore"
+      include: scope
+    labels:
+      - dependencies
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
+      github-actions-security:
+        applies-to: security-updates
+        patterns: ["*"]

.github/rulesets/tags-release.json

@@ -0,0 +1,20 @@
+{
+  "name": "Protect release tags",
+  "target": "tag",
+  "enforcement": "active",
+  "bypass_actors": [],
+  "conditions": {
+    "ref_name": {
+      "include": ["refs/tags/[0-9]*.[0-9]*.[0-9]*"],
+      "exclude": []
+    }
+  },
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -7,65 +7,43 @@ on:
 
 # Two supported targets: Linux x86_64 (Ubuntu) and macOS arm64.
 # GitHub-hosted runners only — this is a public module.
+#
+# The build/test/lint jobs are the pinned `rust-ci` reusable from
+# NDDev-OpenNetwork/ci-workflows; one pin per repository (see
+# supply-chain.yml, codeql.yml, release.yml — same SHA).
 
-env:
-  CARGO_TERM_COLOR: always
+permissions: {}
 
-jobs:
-  fmt:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-        with:
-          components: rustfmt
-      - run: cargo fmt --check
-
-  check:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-        with:
-          components: clippy
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-      - run: cargo clippy --workspace --all-targets -- -D warnings
-      - name: clippy with owned transport backend (noq) and owned relay
-        run: >-
-          cargo clippy --workspace --all-targets
-          --features rds-net/transport-noq,rds-agent/transport-noq,rds-cli/transport-noq,rds-bench/transport-noq,rds-relay/owned-relay
-          -- -D warnings
-      - name: clippy with metrics export feature
-        run: >-
-          cargo clippy -p rds-net --all-targets --features metrics
-          -- -D warnings
-      - name: clippy with x11/desktop feature (linux)
-        if: matrix.os == 'ubuntu-latest'
-        run: cargo clippy --workspace --all-targets --features rds-desktop/x11 -- -D warnings
-      - name: clippy with desktop feature on agent/cli
-        run: >-
-          cargo clippy --workspace --all-targets
-          --features rds-agent/desktop,rds-cli/desktop -- -D warnings
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
 
-  test:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
-      - run: cargo test --workspace
-      - name: test owned transport backend (noq) and owned relay
-        run: >-
-          cargo test -p rds-net -p rds-agent -p rds-relay
-          --features rds-net/transport-noq,rds-agent/transport-noq,rds-relay/owned-relay
-      - name: test metrics (known-traffic + prometheus render)
-        run: cargo test -p rds-net --features metrics --test metrics
-      - name: test with x11/desktop feature (linux)
-        if: matrix.os == 'ubuntu-latest'
-        run: cargo test --workspace --features rds-desktop/x11
+jobs:
+  rust:
+    name: rust
+    permissions:
+      contents: read
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26
+    with:
+      runner: ubuntu-latest
+      toolchain: stable
+      components: "clippy,rustfmt"
+      build_command: "cargo build --locked --workspace --all-targets"
+      # Tests run per-OS. The noq/owned-relay and metrics lanes run on both
+      # targets; the x11 lane is Linux-only (no X11 on macOS runners).
+      test_matrix_os: '["ubuntu-latest", "macos-latest"]'
+      test_command: >-
+        cargo test --locked --workspace
+        && cargo test --locked -p rds-net -p rds-agent -p rds-relay --features rds-net/transport-noq,rds-agent/transport-noq,rds-relay/owned-relay
+        && cargo test --locked -p rds-net --features metrics --test metrics
+        && { [ "$(uname -s)" != "Linux" ] || cargo test --locked --workspace --features rds-desktop/x11; }
+      fmt_command: "cargo fmt --all -- --check"
+      # Clippy runs once on Linux: default features, then every
+      # feature-gated lane (owned transport, metrics export, x11/desktop).
+      clippy_command: >-
+        cargo clippy --locked --workspace --all-targets -- -D warnings
+        && cargo clippy --locked --workspace --all-targets --features rds-net/transport-noq,rds-agent/transport-noq,rds-cli/transport-noq,rds-bench/transport-noq,rds-relay/owned-relay -- -D warnings
+        && cargo clippy --locked -p rds-net --all-targets --features metrics -- -D warnings
+        && cargo clippy --locked --workspace --all-targets --features rds-desktop/x11 -- -D warnings
+        && cargo clippy --locked --workspace --all-targets --features rds-agent/desktop,rds-cli/desktop -- -D warnings
+      timeout_minutes: 45

.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: codeql
+
+# Code scanning via the pinned public reusable. Default setup stays
+# `not-configured` on purpose: a pinned workflow is reviewable in a diff,
+# and enabling default setup later means removing this file first.
+#
+# Rust needs no build step (CodeQL build-mode `none`, GA): extraction runs
+# rust-analyzer over the workspace directly, so no build_command is passed.
+# The weekly schedule keeps scanning a repository that stops changing.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "41 5 * * 4"
+
+permissions: {}
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  codeql:
+    name: codeql
+    permissions:
+      actions: read           # the callee reads this run for SARIF upload bookkeeping
+      contents: read          # check out the tree being analysed
+      security-events: write  # publish CodeQL results to code scanning
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26
+    with:
+      languages: '["rust", "actions"]'
+      runner: ubuntu-latest

.github/workflows/release.yml

@@ -0,0 +1,97 @@
+name: release
+
+# Tag-driven immutable release: push a signed tag `X.Y.Z` where VERSION and
+# the CHANGELOG `## [X.Y.Z]` heading match, and the pinned supply-chain
+# reusable publishes one GitHub Release carrying a deterministic source
+# archive, an SPDX SBOM of it, release notes, a manifest and SHA256SUMS —
+# plus SLSA build-provenance and SBOM attestations (public repo: artifact
+# attestations are included on every plan).
+#
+# Graph: resolve (read-only) → authorize (the `release` environment is the
+# authority seam — add a required reviewer in Settings → Environments to
+# make it a human gate) → publish (the only job holding write scopes).
+#
+# workflow_dispatch must run from the tag ref: the reusable fails closed
+# when the checked-out HEAD is not the tagged commit.
+
+on:
+  push:
+    tags:
+      - "[0-9]+.[0-9]+.[0-9]+"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version to release. Run from the tag ref; must equal VERSION and the tag."
+        required: true
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  resolve:
+    name: Resolve release version
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions: {}
+    outputs:
+      version: ${{ steps.v.outputs.version }}
+    steps:
+      - name: Resolve and shape-check the version
+        id: v
+        env:
+          INPUT_VERSION: ${{ inputs.version }}
+          EVENT_NAME: ${{ github.event_name }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="$REF_NAME"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            version="$INPUT_VERSION"
+          fi
+          if ! [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "release: version must be numeric SemVer X.Y.Z" >&2
+            exit 1
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+
+  authorize:
+    name: Authorize release
+    needs: resolve
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    environment: release
+    permissions: {}
+    steps:
+      - name: Record the authorized candidate
+        env:
+          RELEASE_VERSION: ${{ needs.resolve.outputs.version }}
+        run: |
+          set -euo pipefail
+          {
+            echo "### Release authorized"
+            echo
+            echo "- version: \`${RELEASE_VERSION}\`"
+            echo "- approver: recorded by the \`release\` environment"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  publish:
+    name: Build and publish release
+    needs: [resolve, authorize]
+    permissions:
+      contents: write         # create the GitHub Release and upload assets
+      id-token: write         # OIDC identity for SLSA build provenance
+      attestations: write     # attest the SBOM and the release archive
+      artifact-metadata: write # actions/attest artifact storage record
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26
+    with:
+      runner: ubuntu-latest
+      version: ${{ needs.resolve.outputs.version }}
+      package_name: remote-device-sync
+      archive_paths: >-
+        README.md LICENSE VERSION CHANGELOG.md AGENTS.md deny.toml
+        rust-toolchain.toml Cargo.toml Cargo.lock crates deploy docs
+        scripts .github

.github/workflows/supply-chain.yml

@@ -0,0 +1,35 @@
+name: supply-chain
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Weekly: RustSec advisories land continuously — catch one that
+    # appeared after the last commit.
+    - cron: "23 4 * * 3"
+
+# cargo-deny (deny.toml: bans/licenses/advisories/sources), cargo-audit
+# (RustSec) and cargo-machete (unused deps) via the pinned reusable.
+
+permissions: {}
+
+concurrency:
+  group: supply-chain-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  supply-chain:
+    name: rust supply chain
+    permissions:
+      contents: read
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@a7b90bdf1ac12465cbd07072e3360442cfc8eec6 # 0.1.26
+    with:
+      runner: ubuntu-latest
+      toolchain: stable
+      enable_deny: true
+      enable_audit: true
+      enable_machete: true
+      working_directory: "."
+      deny_arguments: "--all-features --config deny.toml"
+      deny_command: "check bans licenses advisories sources"

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+- CI/CD: the hand-rolled `ci.yml` is replaced by pinned
+  `ci-workflows` reusables (0.1.26): `rust-ci` (locked build, fmt,
+  five clippy lanes, ubuntu+macos test matrix), `rust-supply-chain`
+  (cargo-deny per `deny.toml`, cargo-audit, cargo-machete — weekly
+  advisory sweep), `public-codeql` (rust + actions, build-mode none)
+  and `release-supply-chain` (tag `X.Y.Z` → immutable release: source
+  archive + SPDX SBOM + SHA256SUMS + SLSA/SBOM attestations, behind a
+  `release` environment). `deny.toml` now allows `Unlicense` and
+  `CDLA-Permissive-2.0` (iroh transitive deps) and ignores the two
+  unfixable unmaintained advisories; 13 unused crate dependencies
+  removed; `VERSION` file added for the release contract; dependabot
+  tracks cargo + github-actions weekly.
 - WS8 deployment: `deploy/systemd/rds-server.service` and
   `rds-agent.service` — hardened units (ProtectSystem=strict,
   NoNewPrivileges, PrivateTmp/Devices, ProtectKernel*/ControlGroups,