Reusable flow to check for vulns in dependencies of a Nsolid branch #90
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable flow to check for vulns in dependencies of a Nsolid branch | |
| on: | |
| workflow_call: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| description: 'N|Solid branch or ref to scan' | |
| secrets: | |
| NVD_API_KEY: | |
| required: true | |
| workflow_dispatch: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| description: 'N|Solid branch or ref to scan' | |
| permissions: | |
| contents: read | |
| issues: write | |
| # Serialize reconciliation per stream so two runs for the same stream can never | |
| # race and double-create issues. | |
| concurrency: | |
| group: reconcile-${{ inputs.nsolidStream }} | |
| cancel-in-progress: false | |
| jobs: | |
| check-vulns: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Verify Node.js and npm installation | |
| run: | | |
| echo "Node.js version:" | |
| node --version | |
| echo "npm version:" | |
| npm --version | |
| echo "Python version:" | |
| python3 --version | |
| - name: Checkout current repository | |
| uses: actions/checkout@v4 | |
| - name: Installing pre-reqs | |
| working-directory: ./dep_checker | |
| run: pip install -r requirements.txt | |
| - name: Checkout Nsolid repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: nodesource/nsolid | |
| path: nsolid | |
| ref: ${{ inputs.nsolidStream }} | |
| - name: Run the check | |
| working-directory: ./dep_checker | |
| # Write clean JSON to result.json (diagnostics go to stderr). A non-zero exit | |
| # just means "vulnerabilities were found" — it must not skip reconciliation. | |
| # nsolidStream is passed via env (never interpolated into the shell) to avoid | |
| # script injection from the workflow_dispatch input. | |
| env: | |
| NSOLID_STREAM: ${{ inputs.nsolidStream }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| run: | | |
| python3 main.py --scan-file result.json --include-npm --npm-timeout 600 \ | |
| --gh-token "$GITHUB_TOKEN" --nvd-key="$NVD_API_KEY" \ | |
| ../nsolid "$NSOLID_STREAM" || true | |
| echo "Scan result:" | |
| cat result.json | |
| - name: Reconcile issues | |
| if: ${{ always() }} | |
| working-directory: ./dep_checker | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_REPO: ${{ github.repository }} | |
| NSOLID_STREAM: ${{ inputs.nsolidStream }} | |
| ACTION_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| run: | | |
| python3 reconcile_issues.py \ | |
| --stream "$NSOLID_STREAM" \ | |
| --scan-file result.json \ | |
| --action-url "$ACTION_URL" |