1+ --- a/.github/workflows/security.yml
2+ +++ b/.github/workflows/security.yml
3+ @@ -598,54 +598,156 @@ jobs:
4+ # - PagerDuty for critical vulnerabilities
5+
6+ # Job 6: Automated security fixes (optional)
7+ auto-fixes:
8+ name: Automated Security Fixes
9+ runs-on: ubuntu-latest
10+ + timeout-minutes: 30
11+ needs: [dependency-scan]
12+ if: |
13+ needs.dependency-scan.result == 'failure' &&
14+ github.event_name == 'schedule' &&
15+ github.ref == 'refs/heads/main'
16+
17+ steps:
18+ - name: Checkout code
19+ uses: actions/checkout@v4
20+ with:
21+ token: ${{ secrets.GITHUB_TOKEN }}
22+
23+ - name: Setup Node.js
24+ uses: actions/setup-node@v4
25+ with:
26+ node-version: ${{ env.NODE_VERSION }}
27+ cache: 'npm'
28+
29+ - - name: Attempt automatic fixes
30+ + - name: Configure Git with timeouts
31+ + timeout-minutes: 1
32+ run: |
33+ - echo "🔧 Attempting automatic security fixes..."
34+ + set -e
35+ + echo "⚙️ Configuring Git with security timeouts..."
36+
37+ - # Run npm audit fix for non-breaking changes
38+ - npm audit fix --only=prod
39+ + # Configure Git timeouts for security
40+ + git config http.postBuffer 524288000
41+ + git config http.timeout 60
42+ + git config user.name "Security Bot"
43+ + git config user.email "security-bot@github.com"
44+
45+ - # Check if package-lock.json changed
46+ - if git diff --quiet package-lock.json; then
47+ - echo "ℹ️ No automatic fixes available"
48+ - else
49+ - echo "✅ Automatic fixes applied"
50+ -
51+ - # Create PR with fixes
52+ - git config user.name "Security Bot"
53+ - git config user.email "security-bot@github.com"
54+ - git add package-lock.json
55+ - git commit -m "fix: automatic security vulnerability fixes
56+ -
57+ - - Applied npm audit fix for non-breaking security updates
58+ - - Automated fix via security scanning pipeline"
59+ -
60+ - # Push to new branch and create PR
61+ - BRANCH_NAME="security/auto-fixes-$(date +%Y%m%d-%H%M%S)"
62+ - git checkout -b "$BRANCH_NAME"
63+ - git push origin "$BRANCH_NAME"
64+ -
65+ - echo "🔀 Created branch: $BRANCH_NAME"
66+ - echo "📝 Manual PR creation recommended for review"
67+ - fi
68+ + echo "✅ Git configuration completed"
69+ +
70+ + - name: Apply automatic security fixes
71+ + timeout-minutes: 2
72+ + run: |
73+ + set -e
74+ + echo "🔧 Attempting automatic security fixes..."
75+ +
76+ + # Run npm audit fix for non-breaking changes only
77+ + npm audit fix --only=prod || {
78+ + echo "⚠️ npm audit fix encountered issues, but continuing..."
79+ + true
80+ + }
81+ +
82+ + echo "✅ Automatic fixes attempt completed"
83+ +
84+ + - name: Commit security fixes
85+ + timeout-minutes: 2
86+ + run: |
87+ + set -e
88+ + echo "📝 Committing security fixes if any were applied..."
89+ +
90+ + # Check if any files were modified
91+ + if git diff --quiet && git diff --quiet --cached; then
92+ + echo "ℹ️ No changes detected - no automatic fixes were available"
93+ + echo "NO_CHANGES=true" >> $GITHUB_ENV
94+ + else
95+ + echo "✅ Changes detected - proceeding with commit"
96+ +
97+ + # Add all changed files
98+ + git add package-lock.json package.json || true
99+ +
100+ + # Create commit with detailed message
101+ + git commit -m "fix: automatic security vulnerability fixes
102+ +
103+ + - Applied npm audit fix for non-breaking security updates
104+ + - Automated fix via security scanning pipeline
105+ + - Scan Date: $(date)
106+ + - Workflow Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
107+ +
108+ + echo "✅ Security fixes committed successfully"
109+ + echo "BRANCH_NAME=security/auto-fixes-$(date +%Y%m%d-%H%M%S)" >> $GITHUB_ENV
110+ + fi
111+ +
112+ + - name: Push security fixes with retry logic
113+ + timeout-minutes: 5
114+ + if: env.NO_CHANGES != 'true'
115+ + run: |
116+ + set -e
117+ + echo "🚀 Pushing security fixes to new branch with retry logic..."
118+ +
119+ + BRANCH_NAME="${{ env.BRANCH_NAME }}"
120+ + MAX_ATTEMPTS=3
121+ + ATTEMPT=1
122+ +
123+ + # Create and switch to new branch
124+ + git checkout -b "$BRANCH_NAME"
125+ + echo "📋 Created branch: $BRANCH_NAME"
126+ +
127+ + # Retry logic for git push
128+ + while [ $ATTEMPT -le $MAX_ATTEMPTS ]; do
129+ + echo "🔄 Push attempt $ATTEMPT of $MAX_ATTEMPTS..."
130+ +
131+ + if git push origin "$BRANCH_NAME"; then
132+ + echo "✅ Successfully pushed branch $BRANCH_NAME on attempt $ATTEMPT"
133+ + echo "PUSH_SUCCESS=true" >> $GITHUB_ENV
134+ + break
135+ + else
136+ + echo "❌ Push attempt $ATTEMPT failed"
137+ +
138+ + if [ $ATTEMPT -eq $MAX_ATTEMPTS ]; then
139+ + echo "🚨 All push attempts failed - manual intervention required"
140+ + echo "PUSH_SUCCESS=false" >> $GITHUB_ENV
141+ + exit 1
142+ + else
143+ + echo "⏳ Waiting 5 seconds before retry..."
144+ + sleep 5
145+ + ATTEMPT=$((ATTEMPT + 1))
146+ + fi
147+ + fi
148+ + done
149+ +
150+ + - name: Verify remote branch creation
151+ + timeout-minutes: 2
152+ + if: env.NO_CHANGES != 'true' && env.PUSH_SUCCESS == 'true'
153+ + run: |
154+ + set -e
155+ + echo "🔍 Verifying remote branch creation..."
156+ +
157+ + BRANCH_NAME="${{ env.BRANCH_NAME }}"
158+ + MAX_VERIFICATION_ATTEMPTS=3
159+ + ATTEMPT=1
160+ +
161+ + while [ $ATTEMPT -le $MAX_VERIFICATION_ATTEMPTS ]; do
162+ + echo "🔄 Verification attempt $ATTEMPT of $MAX_VERIFICATION_ATTEMPTS..."
163+ +
164+ + # Check if remote branch exists and has our commit
165+ + if git ls-remote --heads origin "$BRANCH_NAME" | grep -q "$BRANCH_NAME"; then
166+ + REMOTE_SHA=$(git ls-remote --heads origin "$BRANCH_NAME" | cut -f1)
167+ + LOCAL_SHA=$(git rev-parse HEAD)
168+ +
169+ + if [ "$REMOTE_SHA" = "$LOCAL_SHA" ]; then
170+ + echo "✅ Remote branch verification successful"
171+ + echo "📋 Branch: $BRANCH_NAME"
172+ + echo "📋 Local SHA: $LOCAL_SHA"
173+ + echo "📋 Remote SHA: $REMOTE_SHA"
174+ + break
175+ + else
176+ + echo "⚠️ SHA mismatch - Local: $LOCAL_SHA, Remote: $REMOTE_SHA"
177+ + fi
178+ + else
179+ + echo "❌ Remote branch not found on attempt $ATTEMPT"
180+ + fi
181+ +
182+ + if [ $ATTEMPT -eq $MAX_VERIFICATION_ATTEMPTS ]; then
183+ + echo "⚠️ Branch verification failed - branch may still be propagating"
184+ + else
185+ + sleep 3
186+ + ATTEMPT=$((ATTEMPT + 1))
187+ + fi
188+ + done
189+ +
190+ + - name: Provide PR creation instructions
191+ + timeout-minutes: 1
192+ + if: env.NO_CHANGES != 'true' && env.PUSH_SUCCESS == 'true'
193+ + run: |
194+ + echo "📝 Security fixes have been applied and pushed successfully!"
195+ + echo ""
196+ + echo "🔗 Create a Pull Request:"
197+ + echo "Branch: ${{ env.BRANCH_NAME }}"
198+ + echo "Title: 'fix: automatic security vulnerability fixes'"
199+ + echo "URL: ${{ github.server_url }}/${{ github.repository }}/compare/${{ env.BRANCH_NAME }}"
200+ + echo ""
201+ + echo "📋 PR Description Template:"
202+ + echo "## 🔒 Automatic Security Fixes"
203+ + echo "This PR contains automatic security vulnerability fixes generated by the security scanning pipeline."
204+ + echo ""
205+ + echo "### Changes"
206+ + echo "- Applied npm audit fix for non-breaking security updates"
207+ + echo "- Updated package-lock.json with security patches"
208+ + echo ""
209+ + echo "### Verification"
210+ + echo "- [ ] Review all dependency changes"
211+ + echo "- [ ] Run tests to ensure no breaking changes"
212+ + echo "- [ ] Verify application functionality"
213+ + echo ""
214+ + echo "Workflow Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
0 commit comments