Graduate firmware analysis modules into CLI #12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # FirmwareGuard: Local Hardware Validation | |
| # Offline-only CI/CD for firmware security validation | |
| # Runs on self-hosted runners only (no GitHub-hosted, no cloud) | |
| name: Local Build & Test | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - 'src/**' | |
| - 'kernel/**' | |
| - 'Makefile' | |
| jobs: | |
| build-and-scan: | |
| name: Build & Hardware Scan | |
| runs-on: self-hosted | |
| # IMPORTANT: Must run on self-hosted runner with hardware access | |
| # This workflow is completely local - no GitHub API calls | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Check for networking code | |
| run: | | |
| echo "Verifying offline-only codebase..." | |
| if grep -r "socket\|connect\|listen\|bind\|curl_" src/ --exclude-dir=.git 2>/dev/null; then | |
| echo "::error::Network code detected in codebase! FirmwareGuard must be offline-only." | |
| exit 1 | |
| fi | |
| echo "✅ No networking code detected" | |
| - name: Install build dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y build-essential linux-headers-$(uname -r) | |
| - name: Build FirmwareGuard | |
| run: | | |
| make clean | |
| make | |
| echo "✅ Build successful" | |
| - name: Load MSR module | |
| run: | | |
| sudo modprobe msr || echo "MSR module already loaded" | |
| - name: Run firmware scan (local only) | |
| id: scan | |
| run: | | |
| sudo ./firmwareguard scan --json -o scan-results.json | |
| cat scan-results.json | |
| echo "✅ Scan completed" | |
| - name: Check risk level (local only) | |
| run: | | |
| if ! command -v jq &> /dev/null; then | |
| echo "jq not installed, skipping risk check" | |
| exit 0 | |
| fi | |
| RISK=$(jq -r '.overall_risk' scan-results.json 2>/dev/null || echo "UNKNOWN") | |
| echo "Overall risk level: $RISK" | |
| case "$RISK" in | |
| "CRITICAL") | |
| echo "::error::CRITICAL firmware security risk detected" | |
| exit 1 | |
| ;; | |
| "HIGH") | |
| echo "::warning::HIGH firmware security risk detected" | |
| ;; | |
| "MEDIUM"|"LOW"|"NONE") | |
| echo "✅ Risk level acceptable: $RISK" | |
| ;; | |
| *) | |
| echo "::warning::Unable to determine risk level" | |
| ;; | |
| esac | |
| - name: Save scan results locally | |
| run: | | |
| mkdir -p /var/log/firmwareguard-ci | |
| cp scan-results.json /var/log/firmwareguard-ci/scan-$(date +%Y%m%d-%H%M%S).json | |
| echo "Scan results saved to /var/log/firmwareguard-ci/" |