CI/CD & Security

CI/CD, SARIF 2.1.0 & GitHub Actions

Automated pipeline integration with GitHub Code Scanning, OASIS SARIF 2.1.0 output, JUnit XML, and OpenTelemetry OTLP tracing.

Continuous Concurrency Security in CI/CD

Database concurrency vulnerabilities are formally classified under CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization). In enterprise financial and mission-critical systems, an isolation defect that permits duplicate withdrawals or inventory overselling is not merely a software bug: it represents a high-severity security and financial vulnerability.

ChaosSQL transforms database isolation testing into an automated Continuous Quality Gate, integrating with GitHub's native Security / Code Scanning dashboard using the international OASIS SARIF 2.1.0 standard.

Using the Official GitHub Action (`action.yml`)

Incorporate ChaosSQL into your GitHub Actions workflow by adding .github/workflows/concurrency_fuzzer.yml:

name: Database Concurrency & Isolation Audit

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  concurrency-audit:
    name: ChaosSQL Isolation Gating
    runs-on: ubuntu-latest
    permissions:
      security-events: write # Required to publish findings to GitHub Security tab
      contents: read

    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Run ChaosSQL Action
        uses: bregaldahq/chaossql@v1
        with:
          spec-path: 'specs/banking_lost_update.yaml'
          workers: 8
          iterations: 50
          seed: 42
          export-junit: 'reports/chaossql-junit.xml'
          export-summary: '$GITHUB_STEP_SUMMARY'
          export-repro: 'true'

      - name: Run Audit with SARIF Export
        if: always()
        run: |
          go run ./cmd/chaossql run specs/banking_lost_update.yaml \
            --export-sarif=reports/chaossql.sarif || true

      - name: Upload SARIF to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: reports/chaossql.sarif
          category: chaossql-isolation-audit

OASIS SARIF 2.1.0 Catalog: All 9 Formal Anomaly Rules

ChaosSQL's SARIF reporting engine (internal/reporter/sarif.go) generates structured reports adhering to Static Analysis Results Interchange Format (SARIF) v2.1.0, mapping each isolation anomaly to formal audit rules (CHAOS001 through CHAOS009):

Rule ID	Formal Anomaly Name	Level	Phenomenon and Recommended Remediation
`chaossql/P4-lost-update` (CHAOS001)	LostUpdateAnomaly	error	Two concurrent transactions overwrite the same entity based on stale reads. Remediation: Upgrade to `SERIALIZABLE`, acquire pessimistic locks via `SELECT ... FOR UPDATE`, or execute atomic in-place increments.
`chaossql/A5B-write-skew` (CHAOS002)	WriteSkewAnomaly	error	Transactions with disjoint write sets violate a global invariant over overlapping read sets. Remediation: Enable Serializable Snapshot Isolation (SSI) or enforce table/materialized conflict locks.
`chaossql/A5A-read-skew` (CHAOS003)	ReadSkewAnomaly	warning	Transaction reads item X, concurrent transaction modifies X and Y, and first transaction reads inconsistent Y. Remediation: Elevate transaction isolation level to `REPEATABLE READ` or `SNAPSHOT ISOLATION`.
`chaossql/G0-dirty-write` (CHAOS004)	DirtyWriteAnomaly	error	Transaction modifies data previously written by another uncommitted transaction. Remediation: Enforce exclusive write locks throughout transaction duration (Strict 2PL).
`chaossql/G1a-dirty-read` (CHAOS005)	DirtyReadAnomaly	error	Transaction reads transient uncommitted mutations from another transaction that subsequently aborts. Remediation: Elevate isolation level to `READ COMMITTED` or higher.
`chaossql/G1b-intermediate-read` (CHAOS006)	IntermediateReadAnomaly	error	Transaction observes an intermediate, incomplete state of an active concurrent transaction. Remediation: Enforce atomic multi-version concurrency control (MVCC) visibility snapshots.
`chaossql/G1c-circular-info` (CHAOS007)	CircularInfoAnomaly	error	Circular read and write dependencies between concurrent transactions. Remediation: Upgrade to `SERIALIZABLE` to enforce an acyclic serialization graph order.
`chaossql/G2-anti-dependency` (CHAOS008)	AntiDependencyCycle	error	Serialization cycle containing anti-dependency edges (rw), breaking strict serializability. Remediation: Enable true SSI (Serializable Snapshot Isolation) or predicate locking.
`chaossql/G-DL-deadlock` (CHAOS009)	DeadlockCycleAnomaly	warning	Circular lock wait between concurrent transactions resulting in transactional abort. Remediation: Adopt a global canonical lock acquisition order (e.g., sort entities by primary key).

JUnit XML & GitHub Step Summary Reports

Beyond SARIF, ChaosSQL generates standard CI test reports for immediate visibility across delivery pipelines:

JUnit XML (--export-junit=junit.xml): Emits test suites consumable by GitHub Actions Test Reporter, GitLab CI, and Azure Pipelines. Concurrency failures are mapped to <failure> tags containing anomaly classifications and embedded Mermaid sequence graphs.
GitHub Step Summary (--export-summary=$GITHUB_STEP_SUMMARY): Renders rich GitHub-flavored Markdown tables summarizing execution metrics, caught anomalies, and the minimal reproducible counterexample directly on the GitHub Actions run summary page.

Observability with OpenTelemetry (OTLP JSON)

Supplying the --export-otel=trace_otel.json flag converts the entire concurrent execution schedule into a distributed trace conforming to the OpenTelemetry Tracing API. Each worker goroutine is represented as a root Span, and each SQL query is recorded as a child Span enriched with semantic conventions (db.system, db.statement, db.operation, thread.id). The exported JSON file can be ingested directly into Jaeger, Grafana Tempo, or Datadog for deep concurrency and latency profiling.