feat(ci): audit every dependency tree for known vulnerabilities

.circleci/config.yml

@@ -427,6 +427,10 @@ jobs:
           command: make lint
           no_output_timeout: 30m
 
+      - run:
+          name: Check Go dependencies for known vulnerabilities
+          command: make vulncheck
+
       - run:
           name: Check grpc-go stays out of production code
           command: ./scripts/check-grpc-imports.sh
@@ -1221,6 +1225,12 @@ jobs:
             pip install --only-binary :all: jupyter_client==8.10.0 build==1.6.1
             make jupyter-kernel-install
 
+      - run:
+          name: Audit the Python packages' dependencies
+          command: |
+            scripts/download-sca-tools.sh pip-audit
+            make audit-python
+
       # The integration tests connect to a service on the standard port with
       # auto_start=False, which is the explicit opt-in to one the client does not
       # manage; without it they skip, exercising nothing, so one runs here for
@@ -1332,6 +1342,12 @@ jobs:
           name: Run Rust clippy
           command: cd client/rust && cargo clippy --all-targets -- -D warnings
 
+      - run:
+          name: Audit the Rust client's dependencies
+          command: |
+            scripts/download-sca-tools.sh cargo-audit
+            make audit-rust
+
       - run:
           name: Run Rust tests
           command: |
@@ -1490,6 +1506,12 @@ jobs:
           paths:
             - ~/.m2/repository
 
+      - run:
+          name: Audit the Java client's dependencies
+          command: |
+            scripts/download-sca-tools.sh osv-scanner
+            make audit-java JAVA_PROJECT_DIRS=client/java
+
       # opensysml.requireService turns "no binary, so skip" into a failure: the
       # workspace carries one, so its absence is the bug, not a pass. `install`
       # rather than `test`, so the sources and javadoc jars a release needs are
@@ -1560,6 +1582,12 @@ jobs:
             npm install --ignore-scripts --no-audit --no-fund
             git diff --exit-code package-lock.json
 
+      # Every npm lockfile, the editors' included: this job runs on tags too, where
+      # editors-node-test does not, and the audit needs only the lockfiles.
+      - run:
+          name: Audit every npm lockfile's dependencies
+          command: make audit-npm
+
       - run:
           name: Build the package
           command: |
@@ -1686,6 +1714,12 @@ jobs:
           name: Test and install the SysON backend
           command: mvn -B -f editors/syson/pom.xml install -Dopensysml.requireService=true
 
+      - run:
+          name: Audit the backend's dependencies
+          command: |
+            scripts/download-sca-tools.sh osv-scanner
+            make audit-java JAVA_PROJECT_DIRS=editors/syson
+
       - save_cache:
           key: maven-syson-v1-{{ checksum "client/java/pom.xml" }}-{{ checksum "client/java/opensysml-client/pom.xml" }}-{{ checksum "editors/syson/pom.xml" }}-{{ checksum "editors/syson/backend/pom.xml" }}
           paths:
@@ -1727,6 +1761,12 @@ jobs:
           name: Build and test the plugin
           command: mvn -B -f editors/mdk/pom.xml verify -Dopensysml.requireService=true
 
+      - run:
+          name: Audit the plugin's dependencies
+          command: |
+            scripts/download-sca-tools.sh osv-scanner
+            make audit-java JAVA_PROJECT_DIRS=editors/mdk
+
       - save_cache:
           key: maven-mdk-v1-{{ checksum "client/java/pom.xml" }}-{{ checksum "client/java/opensysml-client/pom.xml" }}-{{ checksum "editors/mdk/pom.xml" }}-{{ checksum "editors/mdk/plugin/pom.xml" }}
           paths:

.github/dependabot.yml

@@ -0,0 +1,103 @@
+# Weekly dependency updates, one grouped pull request per ecosystem and directory,
+# against develop. The pull requests run the same CI as any other and a maintainer
+# merges them (CONTRIBUTING.md § Dependabot pull requests). Dependabot alerts and
+# security updates are repository settings, not configured here.
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directories:
+      - /
+      - /tools
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      go-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: npm
+    directories:
+      - /client/node
+      - /packaging/npm/sysml-mcp
+      - /editors/vscode
+      - /editors/jupyterlab
+      - /editors/syson/frontend
+      - /scripts/asciidoc
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      npm-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: pip
+    directories:
+      - /client/python
+      - /client/jupyter-kernel
+      - /packaging/pypi-pysysml
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      pip-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: cargo
+    directory: /client/rust
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      cargo-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: maven
+    directories:
+      - /client/java
+      - /editors/syson
+      - /editors/mdk
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      maven-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    target-branch: develop
+    commit-message:
+      prefix: chore
+      include: scope
+    groups:
+      actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]

.github/workflows/nightly.yml

@@ -126,9 +126,74 @@ jobs:
           echo "Publishing $sha as $night and $TAG (previously ${published:-unpublished})."
           echo "publish=true" >> "$GITHUB_OUTPUT"
 
+  audit:
+    name: Audit the dependencies
+    # Independent of the snapshot: an advisory published against an unchanged develop
+    # fails this job the next night whether or not anything new was built.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Check out develop
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          ref: ${{ env.BRANCH }}
+
+      - name: Set up Go
+        uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        with:
+          node-version: '22'
+
+      - name: Set up Python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        with:
+          python-version: '3.11'
+
+      - name: Set up Java
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+
+      # The editors depend on the Java client at the tree's version, which only a local install provides before its release.
+      - name: Install the Java client the editors build against
+        run: mvn -B -q -f client/java/pom.xml -pl :opensysml -am install -DskipTests -Dmaven.javadoc.skip=true
+
+      - name: Provision the audit tools
+        run: scripts/download-sca-tools.sh
+
+      # Each audit runs even when an earlier one failed, so one night reports every tree.
+      - name: Check Go dependencies for known vulnerabilities
+        run: make vulncheck
+
+      - name: Audit every npm lockfile's dependencies
+        if: ${{ !cancelled() }}
+        run: make audit-npm
+
+      - name: Audit the Python packages' dependencies
+        if: ${{ !cancelled() }}
+        run: make audit-python
+
+      - name: Audit the Rust client's dependencies
+        if: ${{ !cancelled() }}
+        run: make audit-rust
+
+      - name: Audit the Java client's dependencies
+        if: ${{ !cancelled() }}
+        run: make audit-java
+
   publish:
     name: Build and publish the snapshot
-    needs: select
+    # A failed audit skips the night's publication: a snapshot never ships a known vulnerability.
+    needs: [select, audit]
     if: needs.select.outputs.publish == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60

.github/workflows/pr.yml

@@ -322,6 +322,9 @@ jobs:
           make build-mcp
           scripts/npm-mcp-test.sh
 
+      - name: Audit the npm runner's and Asciidoctor's dependencies
+        run: make audit-npm NPM_LOCK_DIRS="packaging/npm/sysml-mcp scripts/asciidoc"
+
       - name: Provision the pinned corpora
         if: needs.changes.outputs.tier == 'full'
         uses: ./.github/actions/corpora
@@ -340,6 +343,9 @@ jobs:
           go vet ./...
           go vet -C tools ./...
 
+      - name: Check Go dependencies for known vulnerabilities
+        run: make vulncheck
+
       - name: Vet and test the RE sysml build (-tags sysml_re)
         run: |
           go vet -tags sysml_re ./cmd/sysml/... ./internal/frontend/repl/...
@@ -938,6 +944,9 @@ jobs:
           npm install --ignore-scripts --no-audit --no-fund
           git diff --exit-code package-lock.json
 
+      - name: Audit the extension's dependencies
+        run: make audit-npm NPM_LOCK_DIRS=editors/vscode
+
       # Type-check, bundle and package. The generated TextMate grammars are
       # gated by go test ./editors/... in the job above.
       - name: Package the VS Code extension
@@ -984,6 +993,9 @@ jobs:
       - name: Install JupyterLab
         run: pip install --only-binary ":all:" jupyterlab==4.6.4
 
+      - name: Audit the extension's dependencies
+        run: make audit-npm NPM_LOCK_DIRS=editors/jupyterlab
+
       - name: Test the tokenizer
         run: make jupyterlab-test
 
@@ -1031,6 +1043,11 @@ jobs:
       - name: Build and test the plugin
         run: mvn -B -f editors/mdk/pom.xml verify -Dopensysml.requireService=true
 
+      - name: Audit the plugin's dependencies
+        run: |
+          scripts/download-sca-tools.sh osv-scanner
+          make audit-java JAVA_PROJECT_DIRS=editors/mdk
+
   docs:
     name: Documentation site
     needs: changes
@@ -1183,6 +1200,9 @@ jobs:
           npm install --ignore-scripts --no-audit --no-fund
           git diff --exit-code package-lock.json
 
+      - name: Audit the client's dependencies
+        run: make audit-npm NPM_LOCK_DIRS=client/node
+
       - name: Build, typecheck and lint
         working-directory: client/node
         run: |
@@ -1299,6 +1319,11 @@ jobs:
           pip install --only-binary :all: jupyter_client==8.10.0 build==1.6.1
           make jupyter-kernel-install
 
+      - name: Audit the Python packages' dependencies
+        run: |
+          scripts/download-sca-tools.sh pip-audit
+          make audit-python
+
       # The FMI runner test's FMUs, same pin as the Go gate's.
       - name: Cache the Reference-FMUs
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
@@ -1399,6 +1424,11 @@ jobs:
           rustc --version
           cargo --version
 
+      - name: Audit the Rust client's dependencies
+        run: |
+          scripts/download-sca-tools.sh cargo-audit
+          make audit-rust
+
       - name: Check Rust formatting
         working-directory: client/rust
         run: cargo fmt --all -- --check
@@ -1620,6 +1650,11 @@ jobs:
       - name: Make the service binary executable
         run: chmod +x bin/sysml-grpc
 
+      - name: Audit the Java client's dependencies
+        run: |
+          scripts/download-sca-tools.sh osv-scanner
+          make audit-java JAVA_PROJECT_DIRS=client/java
+
       # opensysml.requireService turns "no binary, so skip" into a failure, and
       # `install` builds the sources and javadoc jars a release needs on every commit.
       - name: Test and install the client
@@ -1675,6 +1710,11 @@ jobs:
       - name: Test and install the SysON backend
         run: mvn -B -f editors/syson/pom.xml install -Dopensysml.requireService=true
 
+      - name: Audit the backend's dependencies
+        run: |
+          scripts/download-sca-tools.sh osv-scanner
+          make audit-java JAVA_PROJECT_DIRS=editors/syson
+
       - name: Set up Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
@@ -1691,6 +1731,9 @@ jobs:
           npm test
           npm run build
 
+      - name: Audit the frontend's dependencies
+        run: make audit-npm NPM_LOCK_DIRS=editors/syson/frontend
+
   conformance-pkg:
     name: Conformance suite
     needs: changes