|
| 1 | +name: npm audit fix |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_dispatch: |
| 5 | + schedule: |
| 6 | + - cron: "23 4 * * 1" |
| 7 | + |
| 8 | +env: |
| 9 | + BASE_BRANCH: dev |
| 10 | + BRANCH_PREFIX: npm-audit-fix |
| 11 | + |
| 12 | +permissions: {} |
| 13 | + |
| 14 | +concurrency: |
| 15 | + group: npm-audit-fix |
| 16 | + cancel-in-progress: false |
| 17 | + |
| 18 | +jobs: |
| 19 | + audit-fix: |
| 20 | + name: npm audit fix |
| 21 | + runs-on: ubuntu-latest |
| 22 | + timeout-minutes: 15 |
| 23 | + if: github.repository == 'opf/openproject' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) |
| 24 | + |
| 25 | + permissions: |
| 26 | + contents: write # for git push |
| 27 | + pull-requests: write # for creating pull requests |
| 28 | + |
| 29 | + steps: |
| 30 | + - name: Checkout repository |
| 31 | + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 |
| 32 | + with: |
| 33 | + ref: ${{ env.BASE_BRANCH }} |
| 34 | + token: ${{ secrets.OPENPROJECTCI_GH_CORE_PAT }} |
| 35 | + persist-credentials: false |
| 36 | + |
| 37 | + - name: Set up Node.js |
| 38 | + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 |
| 39 | + with: |
| 40 | + node-version: '22.21' |
| 41 | + package-manager-cache: false |
| 42 | + |
| 43 | + - name: Required git config |
| 44 | + run: | |
| 45 | + git config user.name "OpenProject Actions CI" |
| 46 | + git config user.email "operations+ci@openproject.com" |
| 47 | +
|
| 48 | + - name: Run npm audit fix |
| 49 | + id: audit_fix |
| 50 | + run: | |
| 51 | + set -euo pipefail |
| 52 | +
|
| 53 | + mkdir -p reports |
| 54 | +
|
| 55 | + print_audit_report() { |
| 56 | + local report="$1" |
| 57 | + local label="$2" |
| 58 | +
|
| 59 | + node - "$report" "$label" <<'NODE' |
| 60 | + const fs = require('fs'); |
| 61 | +
|
| 62 | + const reportPath = process.argv[2]; |
| 63 | + const label = process.argv[3]; |
| 64 | + const report = JSON.parse(fs.readFileSync(reportPath, 'utf8')); |
| 65 | + const vulnerabilities = Object.entries(report.vulnerabilities || {}); |
| 66 | + const counts = report.metadata?.vulnerabilities || {}; |
| 67 | +
|
| 68 | + console.log(`${label}: ${vulnerabilities.length} vulnerable package(s)`); |
| 69 | + console.log(`severity counts: ${JSON.stringify(counts)}`); |
| 70 | +
|
| 71 | + for (const [name, details] of vulnerabilities) { |
| 72 | + const via = (details.via || []) |
| 73 | + .map((finding) => typeof finding === 'string' ? finding : finding.title) |
| 74 | + .filter(Boolean) |
| 75 | + .join('; '); |
| 76 | +
|
| 77 | + console.log([ |
| 78 | + `- ${name}`, |
| 79 | + `severity: ${details.severity}`, |
| 80 | + `range: ${details.range || 'n/a'}`, |
| 81 | + `fixAvailable: ${JSON.stringify(details.fixAvailable)}`, |
| 82 | + via ? `via: ${via}` : null |
| 83 | + ].filter(Boolean).join(' | ')); |
| 84 | + } |
| 85 | + NODE |
| 86 | + } |
| 87 | +
|
| 88 | + run_for_package() { |
| 89 | + local name="$1" |
| 90 | + local directory="$2" |
| 91 | + local before_report="$GITHUB_WORKSPACE/reports/npm-audit-${name}-before.json" |
| 92 | + local after_report="$GITHUB_WORKSPACE/reports/npm-audit-${name}-after.json" |
| 93 | +
|
| 94 | + echo "::group::npm audit before fix (${name})" |
| 95 | + set +e |
| 96 | + npm --prefix "$directory" audit --audit-level=high --json > "$before_report" |
| 97 | + audit_before_exit=$? |
| 98 | + set -e |
| 99 | + print_audit_report "$before_report" "${name} before fix" |
| 100 | + echo "npm audit before fix exited with ${audit_before_exit}" |
| 101 | + echo "::endgroup::" |
| 102 | +
|
| 103 | + echo "::group::npm audit fix (${name})" |
| 104 | + set +e |
| 105 | + npm --prefix "$directory" audit fix --package-lock-only --ignore-scripts --audit-level=high |
| 106 | + audit_fix_exit=$? |
| 107 | + set -e |
| 108 | + echo "npm audit fix exited with ${audit_fix_exit}" |
| 109 | + echo "::endgroup::" |
| 110 | +
|
| 111 | + echo "::group::npm audit after fix (${name})" |
| 112 | + set +e |
| 113 | + npm --prefix "$directory" audit --audit-level=high --json > "$after_report" |
| 114 | + audit_after_exit=$? |
| 115 | + set -e |
| 116 | + print_audit_report "$after_report" "${name} after fix" |
| 117 | + echo "npm audit after fix exited with ${audit_after_exit}" |
| 118 | + echo "::endgroup::" |
| 119 | + } |
| 120 | +
|
| 121 | + run_for_package root . |
| 122 | + run_for_package frontend frontend |
| 123 | +
|
| 124 | + if git diff --quiet -- package.json package-lock.json frontend/package.json frontend/package-lock.json; then |
| 125 | + echo "has_changes=false" >> "$GITHUB_OUTPUT" |
| 126 | + echo "npm audit fix produced no package or lockfile changes." |
| 127 | + else |
| 128 | + echo "has_changes=true" >> "$GITHUB_OUTPUT" |
| 129 | + echo "npm audit fix produced package or lockfile changes." |
| 130 | + fi |
| 131 | +
|
| 132 | + - name: Show diff |
| 133 | + if: steps.audit_fix.outputs.has_changes == 'true' |
| 134 | + run: git diff -- package.json package-lock.json frontend/package.json frontend/package-lock.json |
| 135 | + |
| 136 | + - name: Create pull request |
| 137 | + if: steps.audit_fix.outputs.has_changes == 'true' |
| 138 | + env: |
| 139 | + GITHUB_TOKEN: ${{ secrets.OPENPROJECTCI_GH_CORE_PAT }} |
| 140 | + run: | |
| 141 | + set -euo pipefail |
| 142 | +
|
| 143 | + pr_numbers=$(gh pr list \ |
| 144 | + --base "$BASE_BRANCH" \ |
| 145 | + --state open \ |
| 146 | + --limit 100 \ |
| 147 | + --json number,headRefName \ |
| 148 | + --jq '.[] | select(.headRefName | startswith("'"$BRANCH_PREFIX"'-")) | .number') |
| 149 | +
|
| 150 | + for pr_number in $pr_numbers; do |
| 151 | + gh pr close "$pr_number" --delete-branch |
| 152 | + done |
| 153 | +
|
| 154 | + pr_body_file=$(mktemp) |
| 155 | +
|
| 156 | + { |
| 157 | + echo 'Created by GitHub action.' |
| 158 | + echo |
| 159 | + echo '## Impacted packages' |
| 160 | + } > "$pr_body_file" |
| 161 | +
|
| 162 | + node <<'NODE' >> "$pr_body_file" |
| 163 | + const fs = require('fs'); |
| 164 | +
|
| 165 | + const reports = [ |
| 166 | + ['root', 'reports/npm-audit-root-before.json'], |
| 167 | + ['frontend', 'reports/npm-audit-frontend-before.json'] |
| 168 | + ]; |
| 169 | + let foundPackages = false; |
| 170 | +
|
| 171 | + for (const [label, reportPath] of reports) { |
| 172 | + if (!fs.existsSync(reportPath)) { |
| 173 | + continue; |
| 174 | + } |
| 175 | +
|
| 176 | + const report = JSON.parse(fs.readFileSync(reportPath, 'utf8')); |
| 177 | + const vulnerabilities = Object.entries(report.vulnerabilities || {}) |
| 178 | + .sort(([left], [right]) => left.localeCompare(right)); |
| 179 | +
|
| 180 | + if (vulnerabilities.length === 0) { |
| 181 | + continue; |
| 182 | + } |
| 183 | +
|
| 184 | + foundPackages = true; |
| 185 | + console.log(''); |
| 186 | + console.log(`### ${label}`); |
| 187 | +
|
| 188 | + for (const [name, details] of vulnerabilities) { |
| 189 | + console.log(`- \`${name}\` (${details.severity})`); |
| 190 | + } |
| 191 | + } |
| 192 | +
|
| 193 | + if (!foundPackages) { |
| 194 | + console.log(''); |
| 195 | + console.log('No vulnerable packages were reported before the fix.'); |
| 196 | + } |
| 197 | + NODE |
| 198 | +
|
| 199 | + { |
| 200 | + for pr_number in $pr_numbers; do |
| 201 | + if [ "$pr_number" = "$(echo "$pr_numbers" | head -1)" ]; then |
| 202 | + echo |
| 203 | + echo '## Replaced PRs' |
| 204 | + echo |
| 205 | + fi |
| 206 | + echo "Replaces #$pr_number" |
| 207 | + done |
| 208 | + } >> "$pr_body_file" |
| 209 | +
|
| 210 | + temp_branch="$BRANCH_PREFIX-$(date "+%Y%m%d%H%M%S")" |
| 211 | +
|
| 212 | + git switch -c "$temp_branch" |
| 213 | + git add package.json package-lock.json frontend/package.json frontend/package-lock.json |
| 214 | + git commit -m "Run npm audit fix" |
| 215 | + gh auth setup-git |
| 216 | + git push origin "$temp_branch" |
| 217 | +
|
| 218 | + gh pr create \ |
| 219 | + --base "$BASE_BRANCH" \ |
| 220 | + --head "$temp_branch" \ |
| 221 | + --title "Run npm audit fix" \ |
| 222 | + --body-file "$pr_body_file" |
| 223 | +
|
| 224 | + echo "Created a PR with npm audit fixes (${temp_branch}) against ${BASE_BRANCH}" |
0 commit comments