otp/.github/workflows/openvex-sync.yml at b6663e8c452f65d39039c12894e779a978477382 · erlang/otp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
## %CopyrightBegin%
##
## SPDX-License-Identifier: Apache-2.0
##
## Copyright Ericsson AB 2024-2026. All Rights Reserved.
##
## Licensed under the Apache License, Version 2.0 (the "License");
## you may not use this file except in compliance with the License.
## You may obtain a copy of the License at
##
##     http://www.apache.org/licenses/LICENSE-2.0
##
## Unless required by applicable law or agreed to in writing, software
## distributed under the License is distributed on an "AS IS" BASIS,
## WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
## See the License for the specific language governing permissions and
## limitations under the License.
##
## %CopyrightEnd%

## Periodically syncs OpenVEX files against Erlang OTP Securities,
## creating an automatic PR with the missing published securities.
name: OpenVEX Securities Syncing
description: 'Sync OpenVEX Securities with Erlang/OTP published Securities'

on:
  workflow_dispatch:
  schedule:
    - cron: 0 1 * * *

permissions:
  contents: read

jobs:
  run-scheduled-openvex-sync:
    runs-on: ubuntu-latest
    permissions:
      contents: write       # use inside the otp-compliance.es
      pull-requests: write  # use inside the otp-compliance.es
    if: github.repository == 'erlang/otp'
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: 'master' # '' = default branch
          persist-credentials: false

      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
        with:
          otp-version: '28'

      - uses: openvex/setup-vexctl@e85ca48f3c8a376289f6476129d59cda82147e71 # ratchet:openvex/setup-vexctl@v0.1.1
        with:
          vexctl-release: '0.3.0'

      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        id: app-token
        with:
          # required
          app-id: ${{ vars.ERLANG_BOT_APP_ID }}
          private-key: ${{ secrets.ERLANG_BOT_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
          repositories: otp
          permission-contents: write
          permission-pull-requests: write

      - name: Authenticate gh
        env:
          STEPS_APP_TOKEN_OUTPUTS_TOKEN: ${{ steps.app-token.outputs.token }}
        run: |
          echo "${STEPS_APP_TOKEN_OUTPUTS_TOKEN}" | gh auth login --with-token

      - name: Get GitHub App User ID
        id: get-user-id
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: echo "user-id=$(gh api "/users/${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"

      - env:
          STEPS_APP_TOKEN_OUTPUTS_APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
          STEPS_GET_USER_ID_OUTPUTS_USER_ID: ${{ steps.get-user-id.outputs.user-id }}
        run: |
          git config --global user.name "${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]"
          git config --global user.email "${STEPS_GET_USER_ID_OUTPUTS_USER_ID}+${STEPS_APP_TOKEN_OUTPUTS_APP_SLUG}[bot]@users.noreply.github.com"

      - name: 'Open OpenVEX Pull Requests for newly released vulnerabilities'
        run: |
          .github/scripts/otp-compliance.es vex verify -p