Reusable flow to check for vulns in dependencies of a Nsolid branch #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable flow to check for vulns in dependencies of a Node.js branch | |
| on: | |
| workflow_call: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| secrets: | |
| NVD_API_KEY: | |
| required: true | |
| workflow_dispatch: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| check-vulns: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set_matrix.outputs.matrix }} | |
| steps: | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Checkout current repository | |
| uses: actions/checkout@v4 | |
| - name: Installing pre-reqs | |
| working-directory: ./dep_checker | |
| run: pip install -r requirements.txt | |
| - name: Checkout node.js repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: nodesource/nsolid | |
| path: nsolid | |
| ref: ${{ inputs.nsolidStream }} | |
| - name: Run the check | |
| working-directory: ./dep_checker | |
| run: | | |
| ( | |
| set -o pipefail | |
| python main.py --json-output --gh-token ${{ secrets.GITHUB_TOKEN }} --nvd-key=${{ secrets.NVD_API_KEY }} ../nsolid ${{ inputs.nsolidStream }} 2>&1 | tee result.log | |
| ) | |
| - name: build matrix | |
| id: set_matrix | |
| if: ${{ failure() }} | |
| working-directory: ./dep_checker | |
| run: | | |
| matrix=$(grep -o '{.*}' result.log | jq -c .) | |
| echo "matrix=$matrix" >> $GITHUB_OUTPUT | |
| create-issues: | |
| needs: check-vulns | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.check-vulns.outputs.matrix) }} | |
| max-parallel: 1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dblock/create-a-github-issue@v3 | |
| with: | |
| update_existing: false | |
| search_existing: open | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VULN_ID: ${{ matrix.vulnerabilities.id }} | |
| VULN_URL: ${{ matrix.vulnerabilities.url }} | |
| VULN_DEP_NAME: ${{ matrix.vulnerabilities.dependency }} | |
| VULN_DEP_VERSION: ${{ matrix.vulnerabilities.version }} | |
| NODEJS_STREAM: ${{ inputs.nsolidStream }} | |
| ACTION_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" |