ci: ensure wasm integrity

[Uzlopak]

Ensure that the wasm files are not tampered with.

If the llhttp source files or llhttp wasm files are touched, we check also if the wasm files are correct or if they have some tampered binary code. Basically trying to remove the potential attack vector like it was built in into xz.

We can then close

https://github.com/nodejs/undici/security/code-scanning/251
https://github.com/nodejs/undici/security/code-scanning/252

If the code is tampered with, you will see it
https://github.com/nodejs/undici/actions/runs/8915422913/job/24485005620

@mweberxyz
Any Ideas how to improve it?

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.17%. Comparing base (51a97af) to head (7e71031).
Report is 11 commits behind head on main.

❗ Current head 7e71031 differs from pull request most recent head a2371db. Consider uploading reports for the commit a2371db to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3173      +/-   ##
==========================================
+ Coverage   94.16%   94.17%   +0.01%     
==========================================
  Files          90       90              
  Lines       24385    24437      +52     
==========================================
+ Hits        22962    23014      +52     
  Misses       1423     1423              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Uzlopak]

@mweberxyz can we maybe get somehow the parent commit?

[mcollina]

lgtm

[Uzlopak]

Please dont merge yet. I really think the solution is not proper yet. git diff --name-only HEAD^ HEAD will only process one commit. But I need to compare it with the last common commit (hash).

[ronag]

@Uzlopak please make it a draft PR to avoid merging

[Uzlopak]

@mcollina
@metcoder95
@mweberxyz

PTAL. Should be correct now.
Maybe @mweberxyz can have a more strict review.

[mcollina]

I'm not sure I would run this for every PR. Maybe only if those files were changed?

[Uzlopak]

It is a reusable workflow. It has two steps. First check if wasm related files were changed, if so run the integrity check. Maybe the first step can be further optimized by using https://github.com/tj-actions/changed-files so that we can also take care of cases where we directly push into main. Also makes sense to obligatory run the integrity check in the automated release workflow.

[mcollina]

Maybe we can just run it in the release workflow then.

[Uzlopak]

@mcollina

Imho we should ensure that the repo has the correct content at any time. So if somebody tries to upstream malicious code into the repo, then it should be imho detected early and not as the last step of the release workflow.

The only issue i see, is that people could force push into main and bypass the ci.

[mcollina]

we can limit that now that we have automated releases, open a separate issue.