|
| 1 | +# Copyright (c) Microsoft Corporation. |
| 2 | +# Licensed under the MIT License. |
| 3 | +# |
| 4 | +# Weekly dependency security refresh. |
| 5 | +# |
| 6 | +# Dependabot cannot see npm `overrides`, and almost every vulnerability in this repo is |
| 7 | +# transitive and pinned through `overrides`. That gap is why S360/Component Governance |
| 8 | +# keeps re-raising the same alerts and why they have to be fixed by hand each time. |
| 9 | +# |
| 10 | +# This workflow closes it: |
| 11 | +# 1. `npm update` refreshes package-lock.json inside the ranges already declared. |
| 12 | +# Historically this alone clears most alerts - the ranges were fine, the lock was stale. |
| 13 | +# 2. `scripts/audit-overrides.js --write` raises any range that is genuinely too low, |
| 14 | +# resolving each advisory against the GitHub Advisory DB for its real patched version. |
| 15 | +# 3. The build must pass before a PR is opened. |
| 16 | +# |
| 17 | +# Anything the script cannot fix safely (bundled copies, multi-major packages, advisories |
| 18 | +# with no published fix) is reported in the PR body for a human to pick up. |
| 19 | +name: Dependency security refresh |
| 20 | + |
| 21 | +on: |
| 22 | + schedule: |
| 23 | + - cron: "0 6 * * 1" # Mondays 06:00 UTC |
| 24 | + workflow_dispatch: |
| 25 | + |
| 26 | +permissions: |
| 27 | + contents: write |
| 28 | + pull-requests: write |
| 29 | + |
| 30 | +jobs: |
| 31 | + refresh: |
| 32 | + runs-on: ubuntu-latest |
| 33 | + steps: |
| 34 | + - uses: actions/checkout@v4 |
| 35 | + |
| 36 | + - name: Setup Node.js environment |
| 37 | + uses: actions/setup-node@v4 |
| 38 | + with: |
| 39 | + node-version: 20 |
| 40 | + registry-url: https://npm.pkg.github.com |
| 41 | + |
| 42 | + - name: Configure npm |
| 43 | + run: npm config set //npm.pkg.github.com/:_authToken=${{ secrets.GPR_ACCESS_TOKEN }} |
| 44 | + |
| 45 | + - name: Install npm@11 globally |
| 46 | + run: npm i -g npm@11 |
| 47 | + |
| 48 | + - name: Install dependencies |
| 49 | + run: npm ci |
| 50 | + |
| 51 | + - name: Refresh lock file within existing ranges |
| 52 | + run: npm update |
| 53 | + |
| 54 | + - name: Raise ranges that are still too low |
| 55 | + id: overrides |
| 56 | + env: |
| 57 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 58 | + run: | |
| 59 | + node scripts/audit-overrides.js --write | tee audit-report.md |
| 60 | + npm install |
| 61 | +
|
| 62 | + - name: Check for changes |
| 63 | + id: diff |
| 64 | + run: | |
| 65 | + if git diff --quiet -- package.json package-lock.json; then |
| 66 | + echo "changed=false" >> "$GITHUB_OUTPUT" |
| 67 | + else |
| 68 | + echo "changed=true" >> "$GITHUB_OUTPUT" |
| 69 | + fi |
| 70 | +
|
| 71 | + # The PR is only opened if the build is green, so a broken tree is never proposed. |
| 72 | + - name: Build and test |
| 73 | + if: steps.diff.outputs.changed == 'true' |
| 74 | + run: npm run ci |
| 75 | + env: |
| 76 | + AZ_DevOps_Read_PAT: ${{ secrets.AZ_DevOps_Read_PAT }} |
| 77 | + PA_BT_ORG_PASSWORD: ${{ secrets.PA_BT_ORG_PASSWORD }} |
| 78 | + RUN_ID: ${{ github.run_id }} |
| 79 | + |
| 80 | + - name: Open pull request |
| 81 | + if: steps.diff.outputs.changed == 'true' |
| 82 | + env: |
| 83 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 84 | + run: | |
| 85 | + BRANCH="bot/dependency-refresh-$(date -u +%Y%m%d)" |
| 86 | + git config user.name "github-actions[bot]" |
| 87 | + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" |
| 88 | + git checkout -b "$BRANCH" |
| 89 | + git add package.json package-lock.json |
| 90 | + git commit -m "chore: weekly dependency security refresh" |
| 91 | + git push -u origin "$BRANCH" |
| 92 | +
|
| 93 | + { |
| 94 | + echo "## Summary" |
| 95 | + echo |
| 96 | + echo "Automated weekly refresh of vulnerable dependencies." |
| 97 | + echo |
| 98 | + cat audit-report.md |
| 99 | + echo |
| 100 | + echo "## Test plan" |
| 101 | + echo |
| 102 | + echo "- [x] \`npm ci\` clean" |
| 103 | + echo "- [x] \`npm run ci\` passed before this PR was opened" |
| 104 | + echo "- [ ] Functional tests - exempt (require \`PA_BT_ORG_PASSWORD\`)" |
| 105 | + echo |
| 106 | + echo "Anything listed under **Needs a human** could not be fixed safely by the script" |
| 107 | + echo "and still requires a manual override, a lock-file patch, or an accepted-risk note." |
| 108 | + } > pr-body.md |
| 109 | +
|
| 110 | + # No --assignee / --reviewer here: .github/CODEOWNERS already requests a review from |
| 111 | + # @microsoft/managed-app-devops-team for every file this PR touches, and passing a |
| 112 | + # team reviewer explicitly can fail depending on the GITHUB_TOKEN's permissions. |
| 113 | + gh pr create --base main --head "$BRANCH" \ |
| 114 | + --title "chore: weekly dependency security refresh" \ |
| 115 | + --body-file pr-body.md |
0 commit comments