archipelago
7ba3109b6d
git-subtree-dir: aiui git-subtree-mainline:0c4826f8ccgit-subtree-split:e30ac1d106
58 lines
2.1 KiB
YAML
58 lines
2.1 KiB
YAML
name: Weekly Dependency Audit
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 9 * * 1' # Every Monday at 9am UTC
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
issues: write
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: pnpm/action-setup@v4
|
|
with:
|
|
version: 10
|
|
- uses: actions/setup-node@v4
|
|
with:
|
|
node-version: 20
|
|
cache: pnpm
|
|
- run: pnpm install --frozen-lockfile
|
|
|
|
- name: Audit for vulnerabilities
|
|
id: audit
|
|
run: |
|
|
AUDIT_RESULT=$(pnpm audit --audit-level=moderate 2>&1) || true
|
|
echo "$AUDIT_RESULT"
|
|
if echo "$AUDIT_RESULT" | grep -q "critical"; then
|
|
echo "has_critical=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "has_critical=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Check licenses
|
|
id: licenses
|
|
run: |
|
|
LICENSE_RESULT=$(npx license-checker --production --onlyAllow 'MIT;Apache-2.0;ISC;BSD-2-Clause;BSD-3-Clause;0BSD;CC0-1.0;Unlicense;CC-BY-4.0;Python-2.0;BlueOak-1.0.0' --excludePrivatePackages 2>&1) || true
|
|
echo "$LICENSE_RESULT"
|
|
if echo "$LICENSE_RESULT" | grep -q "FAIL"; then
|
|
echo "has_violations=true" >> $GITHUB_OUTPUT
|
|
else
|
|
echo "has_violations=false" >> $GITHUB_OUTPUT
|
|
fi
|
|
|
|
- name: Create issue if violations found
|
|
if: steps.audit.outputs.has_critical == 'true' || steps.licenses.outputs.has_violations == 'true'
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
await github.rest.issues.create({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
title: '⚠️ Dependency audit: violations found',
|
|
body: `The weekly dependency audit found issues:\n\n- Critical vulnerabilities: ${{ steps.audit.outputs.has_critical }}\n- License violations: ${{ steps.licenses.outputs.has_violations }}\n\nRun \`pnpm audit\` and \`npx license-checker\` locally for details.`,
|
|
labels: ['security', 'dependencies'],
|
|
})
|