Use custom Semgrep Rules

rules/src/github-actions/publish-actions-cache-used.yml

@@ -0,0 +1,18 @@
+rules:
+  - id: publish-actions-cache-used
+    languages:
+      - yaml
+    severity: ERROR
+    message: Detected usage of 'actions/cache' in a publish-related GitHub workflow.
+      Using GitHub's Action Cache in publishing workflows can potentially be dangerous. See
+      https://github.com/MetaMask/MetaMask-planning/issues/3925 for more
+      details.
+    patterns:
+      - patterns:
+          - pattern: "uses: $ACTION_NAME"
+          - metavariable-regex:
+              metavariable: $ACTION_NAME
+              regex: actions/cache@v[0-9]+
+    paths:
+      include:
+        - ".github/**/*publish*.yml"

rules/test/github-actions/publish-actions-cache-used.test.yaml

@@ -0,0 +1,101 @@
+name: Publish Release
+
+on:
+  workflow_call:
+    secrets:
+      NPM_TOKEN:
+        required: true
+      SLACK_WEBHOOK_URL:
+        required: true
+
+jobs:
+  publish-release:
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+      - name: Install Yarn
+        run: corepack enable
+      - name: Restore Yarn cache
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+          cache: yarn
+      # ruleid: publish-actions-cache-used
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ./packages/**/dist
+            ./node_modules/.yarn-state.yml
+          key: ${{ github.sha }}
+      - uses: MetaMask/action-publish-release@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - run: yarn --immutable
+      - run: yarn build
+
+  publish-npm-dry-run:
+    runs-on: ubuntu-latest
+    needs: publish-release
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+      - name: Install Yarn
+        run: corepack enable
+      # ruleid: publish-actions-cache-used
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ./packages/**/dist
+            ./node_modules/.yarn-state.yml
+          key: ${{ github.sha }}
+          fail-on-cache-miss: true
+      - name: Dry Run Publish
+        # omit npm-token token to perform dry run publish
+        uses: MetaMask/action-npm-publish@v5
+        with:
+          slack-webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
+          subteam: S042S7RE4AE # @metamask-npm-publishers
+        env:
+          SKIP_PREPACK: true
+
+  publish-npm:
+    environment: npm-publish
+    runs-on: ubuntu-latest
+    needs: publish-npm-dry-run
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.sha }}
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: '.nvmrc'
+      - name: Install Yarn
+        run: corepack enable
+      # ruleid: publish-actions-cache-used
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ./packages/**/dist
+            ./node_modules/.yarn-state.yml
+          key: ${{ github.sha }}
+          fail-on-cache-miss: true
+      - name: Publish
+        uses: MetaMask/action-npm-publish@v5
+        with:
+          npm-token: ${{ secrets.NPM_TOKEN }}
+        env:
+          SKIP_PREPACK: true