Reusable flow to check for vulns in dependencies of a Nsolid branch #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable flow to check for vulns in dependencies of a Nsolid branch | |
| on: | |
| workflow_call: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| secrets: | |
| NVD_API_KEY: | |
| required: true | |
| workflow_dispatch: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| check-vulns: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set_matrix.outputs.matrix }} | |
| steps: | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| cache: 'npm' | |
| cache-dependency-path: '**/package-lock.json' | |
| - name: Checkout current repository | |
| uses: actions/checkout@v4 | |
| - name: Installing pre-reqs | |
| working-directory: ./dep_checker | |
| run: pip install -r requirements.txt | |
| - name: Checkout Nsolid repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: nodesource/nsolid | |
| path: nsolid | |
| ref: ${{ inputs.nsolidStream }} | |
| - name: Run the check | |
| working-directory: ./dep_checker | |
| run: | | |
| ( | |
| set -o pipefail | |
| python main.py --json-output --include-npm --npm-timeout 600 --gh-token ${{ secrets.GITHUB_TOKEN }} --nvd-key=${{ secrets.NVD_API_KEY }} ../nsolid ${{ inputs.nsolidStream }} 2>&1 | tee result.log | |
| ) | |
| cat result.log | |
| - name: build matrix | |
| id: set_matrix | |
| if: ${{ failure() }} | |
| working-directory: ./dep_checker | |
| run: | | |
| matrix=$(grep -o '{.*}' result.log | jq -c .) | |
| echo "matrix=$matrix" | |
| echo "matrix=$matrix" >> $GITHUB_OUTPUT | |
| create-issues: | |
| needs: check-vulns | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.check-vulns.outputs.matrix) }} | |
| max-parallel: 1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dblock/create-a-github-issue@v3 | |
| with: | |
| update_existing: false | |
| search_existing: open | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| VULN_ID: ${{ matrix.vulnerabilities.id }} | |
| VULN_URL: ${{ matrix.vulnerabilities.url }} | |
| VULN_DEP_NAME: ${{ matrix.vulnerabilities.dependency }} | |
| VULN_DEP_VERSION: ${{ matrix.vulnerabilities.version }} | |
| NODEJS_STREAM: ${{ inputs.nsolidStream }} | |
| ACTION_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" |