Skip to content

Commit 2edc8af

Browse files
loydcercenia-Paulloydcercenia-Paul
authored
Add security bots: automated scans, Solana monitoring, auto-updates
1 parent acd4060 commit 2edc8af

19 files changed

+1539
-10
lines changed

‎.github/dependabot.yml‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,28 @@
1-
# To get started with Dependabot version updates, you'll need to specify which
2-
# package ecosystems to update and where the package manifests are located.
3-
# Please see the documentation for all configuration options:
4-
# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
5-
61
version: 2
72
updates:
8-
- package-ecosystem: "gomod"
3+
- package-ecosystem: "npm"
94
directory: "/"
105
schedule:
11-
interval: "weekly"
12-
- package-ecosystem: "docker"
6+
interval: "daily"
7+
open-pull-requests-limit: 10
8+
reviewers:
9+
- "loydcercenia-Paul"
10+
labels:
11+
- "dependencies"
12+
- "automated"
13+
14+
- package-ecosystem: "github-actions"
1315
directory: "/"
1416
schedule:
1517
interval: "weekly"
16-
- package-ecosystem: "github-actions"
18+
labels:
19+
- "github-actions"
20+
- "automated"
21+
22+
- package-ecosystem: "docker"
1723
directory: "/"
1824
schedule:
1925
interval: "weekly"
26+
labels:
27+
- "docker"
28+
- "automated"

‎.github/workflows/auto-update.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Auto Update & Upgrade
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 * * 0'
6+
workflow_dispatch:
7+
8+
jobs:
9+
update-dependencies:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- name: Setup Node.js
15+
uses: actions/setup-node@v4
16+
with:
17+
node-version: '20'
18+
19+
- name: Update npm packages
20+
run: |
21+
npm update
22+
npm outdated || true
23+
24+
- name: Check Solana SDK Updates
25+
run: |
26+
CURRENT=$(npm list @solana/web3.js --depth=0 | grep @solana/web3.js | awk '{print $2}')
27+
LATEST=$(npm view @solana/web3.js version)
28+
echo "Current: $CURRENT"
29+
echo "Latest: $LATEST"
30+
if [ "$CURRENT" != "$LATEST" ]; then
31+
npm install @solana/web3.js@latest
32+
fi
33+
34+
- name: Search Solana Best Practices
35+
run: |
36+
echo "🔍 Searching for Solana best practices..."
37+
curl -s "https://api.github.com/search/repositories?q=solana+security+best+practices&sort=stars" | jq -r '.items[0:3] | .[] | .html_url'
38+
39+
- name: Create PR with Updates
40+
uses: peter-evans/create-pull-request@v6
41+
with:
42+
commit-message: "⬆️ Update dependencies and apply best practices"
43+
title: "Automated Dependency Updates"
44+
body: |
45+
## Automated Updates
46+
47+
This PR includes:
48+
- Updated npm dependencies
49+
- Latest Solana SDK
50+
- Security patches
51+
52+
Please review and merge.
53+
branch: auto-updates
54+
labels: automated, dependencies
55+
56+
solana-upgrade-check:
57+
runs-on: ubuntu-latest
58+
steps:
59+
- name: Check Solana Network Upgrades
60+
run: |
61+
echo "🔄 Checking Solana network upgrades..."
62+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
63+
{
64+
"jsonrpc": "2.0",
65+
"id": 1,
66+
"method": "getVersion"
67+
}' | jq .
68+
69+
- name: Check Program Upgrade Status
70+
run: |
71+
echo "📦 Checking program upgrade status..."
72+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
73+
{
74+
"jsonrpc": "2.0",
75+
"id": 1,
76+
"method": "getAccountInfo",
77+
"params": ["4Ec7ZxZS6Sbdg5UGSLHbAnM7GQHp2eFd4KYWRexAipQT", {"encoding": "base64"}]
78+
}' | jq .result
79+
80+
- name: Report Findings
81+
run: |
82+
echo "📊 Generating upgrade report..."
83+
cat > upgrade-report.md <<EOF
84+
# Solana Upgrade Report
85+
86+
**Date:** $(date)
87+
88+
## Network Status
89+
- Cluster: Mainnet-beta
90+
- Health: Active
91+
92+
## Recommendations
93+
- Keep dependencies updated
94+
- Monitor program upgrades
95+
- Review security advisories
96+
EOF
97+
cat upgrade-report.md

‎.github/workflows/security-scan.yml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Security Scan & Auto-Update
2+
3+
on:
4+
push:
5+
branches: [main]
6+
schedule:
7+
- cron: '0 */6 * * *'
8+
workflow_dispatch:
9+
10+
jobs:
11+
security-scan:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- name: Run Trivy Security Scanner
17+
uses: aquasecurity/trivy-action@master
18+
with:
19+
scan-type: 'fs'
20+
scan-ref: '.'
21+
format: 'sarif'
22+
output: 'trivy-results.sarif'
23+
24+
- name: Upload Trivy Results
25+
uses: github/codeql-action/upload-sarif@v3
26+
with:
27+
sarif_file: 'trivy-results.sarif'
28+
29+
- name: Dependency Review
30+
uses: actions/dependency-review-action@v4
31+
if: github.event_name == 'pull_request'
32+
33+
- name: Check Solana Program Security
34+
run: |
35+
echo "🔍 Checking Solana program security..."
36+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
37+
{
38+
"jsonrpc": "2.0",
39+
"id": 1,
40+
"method": "getAccountInfo",
41+
"params": ["JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4", {"encoding": "base64"}]
42+
}' | jq .
43+
44+
solana-updates:
45+
runs-on: ubuntu-latest
46+
steps:
47+
- uses: actions/checkout@v4
48+
49+
- name: Check Solana Updates
50+
run: |
51+
echo "📦 Checking for Solana updates..."
52+
LATEST=$(curl -s https://api.github.com/repos/solana-labs/solana/releases/latest | jq -r .tag_name)
53+
echo "Latest Solana version: $LATEST"
54+
echo "SOLANA_VERSION=$LATEST" >> $GITHUB_ENV
55+
56+
- name: Check Program Upgrades
57+
run: |
58+
echo "🔄 Checking program upgrade status..."
59+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
60+
{
61+
"jsonrpc": "2.0",
62+
"id": 1,
63+
"method": "getProgramAccounts",
64+
"params": ["BPFLoaderUpgradeab1e11111111111111111111111"]
65+
}' | jq '.result | length'
66+
67+
- name: Create Issue on Errors
68+
if: failure()
69+
uses: actions/github-script@v7
70+
with:
71+
script: |
72+
github.rest.issues.create({
73+
owner: context.repo.owner,
74+
repo: context.repo.repo,
75+
title: '🚨 Security Scan Failed',
76+
body: 'Automated security scan detected issues. Please review.',
77+
labels: ['security', 'automated']
78+
})
79+
80+
npm-audit:
81+
runs-on: ubuntu-latest
82+
steps:
83+
- uses: actions/checkout@v4
84+
85+
- name: Setup Node.js
86+
uses: actions/setup-node@v4
87+
with:
88+
node-version: '20'
89+
90+
- name: Run npm audit
91+
run: |
92+
npm audit --audit-level=moderate || true
93+
npm audit fix --force || true
94+
95+
- name: Commit fixes
96+
run: |
97+
git config user.name "Security Bot"
98+
git config user.email "security@github.com"
99+
git add package*.json
100+
git diff --staged --quiet || git commit -m "🔒 Auto-fix security vulnerabilities"
101+
git push || true
102+
103+
solana-validator-check:
104+
runs-on: ubuntu-latest
105+
steps:
106+
- name: Check Validator Health
107+
run: |
108+
echo "🏥 Checking Solana validator health..."
109+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
110+
{
111+
"jsonrpc": "2.0",
112+
"id": 1,
113+
"method": "getHealth"
114+
}' | jq .
115+
116+
- name: Check Cluster Nodes
117+
run: |
118+
echo "🌐 Checking cluster nodes..."
119+
curl -s https://api.mainnet-beta.solana.com -X POST -H "Content-Type: application/json" -d '
120+
{
121+
"jsonrpc": "2.0",
122+
"id": 1,
123+
"method": "getClusterNodes"
124+
}' | jq '.result | length'

‎.github/workflows/solana-monitor.yml‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: Solana Program Monitor
2+
3+
on:
4+
schedule:
5+
- cron: '*/30 * * * *'
6+
workflow_dispatch:
7+
8+
jobs:
9+
monitor:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v4
13+
14+
- name: Setup Node.js
15+
uses: actions/setup-node@v4
16+
with:
17+
node-version: '20'
18+
19+
- name: Install Dependencies
20+
run: npm install @solana/web3.js
21+
22+
- name: Monitor Jupiter Program
23+
run: |
24+
node -e "
25+
const { Connection, PublicKey } = require('@solana/web3.js');
26+
(async () => {
27+
const conn = new Connection('https://api.mainnet-beta.solana.com');
28+
const program = new PublicKey('JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4');
29+
const info = await conn.getAccountInfo(program);
30+
console.log('✅ Program Status: Active');
31+
console.log('Executable:', info.executable);
32+
console.log('Owner:', info.owner.toBase58());
33+
})();
34+
"
35+
36+
- name: Check Authority
37+
run: |
38+
node -e "
39+
const { Connection, PublicKey } = require('@solana/web3.js');
40+
(async () => {
41+
const conn = new Connection('https://api.mainnet-beta.solana.com');
42+
const auth = new PublicKey('CvQZZ23qYDWF2RUpxYJ8y9K4skmuvYEEjH7fK58jtipQ');
43+
const balance = await conn.getBalance(auth);
44+
console.log('Authority Balance:', balance / 1e9, 'SOL');
45+
if (balance < 10000) {
46+
console.log('⚠️ Low balance warning');
47+
process.exit(1);
48+
}
49+
})();
50+
"
51+
52+
- name: Check New Controller
53+
run: |
54+
node -e "
55+
const { Connection, PublicKey } = require('@solana/web3.js');
56+
(async () => {
57+
const conn = new Connection('https://api.mainnet-beta.solana.com');
58+
const controller = new PublicKey('GLzZk1sczzW6fM4uPFeQCtTZQaf8H5VaBt99tUMbJAAW');
59+
const balance = await conn.getBalance(controller);
60+
console.log('New Controller Balance:', balance / 1e9, 'SOL');
61+
})();
62+
"
63+
64+
- name: Alert on Issues
65+
if: failure()
66+
uses: actions/github-script@v7
67+
with:
68+
script: |
69+
github.rest.issues.create({
70+
owner: context.repo.owner,
71+
repo: context.repo.repo,
72+
title: '⚠️ Solana Program Monitor Alert',
73+
body: 'Program monitoring detected an issue. Check workflow logs.',
74+
labels: ['monitoring', 'solana', 'alert']
75+
})

0 commit comments

Comments
 (0)