Repository navigation
Audit report #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Audit report | |
| on: | |
| schedule: | |
| - cron: 17 5 * * 1 | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| report: | |
| name: Report | |
| runs-on: ubuntu-latest | |
| if: ${{ github.repository_owner == 'koobiq' }} | |
| permissions: | |
| contents: read | |
| issues: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: ./.github/workflows/actions/setup-node | |
| # The full audit, including development dependencies. Never fails the job: this is a | |
| # visibility mechanism, the blocking check lives in audit.yml. | |
| - name: Run audit | |
| id: audit | |
| env: | |
| FORCE_COLOR: '0' | |
| run: | | |
| set +e | |
| yarn npm audit --all --recursive --no-deprecations > audit.txt 2>&1 | |
| echo "exit_code=$?" >> "$GITHUB_OUTPUT" | |
| cat audit.txt | |
| - name: Publish report | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| TITLE: Dependency audit report | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| CLEAN: ${{ steps.audit.outputs.exit_code == '0' }} | |
| run: | | |
| { | |
| echo "Generated by [\`audit-report.yml\`]($RUN_URL) on $(date -u '+%Y-%m-%d')." | |
| echo | |
| if [ "$CLEAN" = 'true' ]; then | |
| echo 'No advisories.' | |
| else | |
| echo 'Run `yarn npm audit --all --recursive --no-deprecations` locally to reproduce.' | |
| echo | |
| echo '<details><summary>Report</summary>' | |
| echo | |
| echo '```' | |
| # Issue bodies are capped at 65536 characters; leave room for the wrapper. | |
| head -c 60000 audit.txt | |
| echo | |
| echo '```' | |
| echo | |
| echo '</details>' | |
| fi | |
| echo | |
| echo 'Advisories with no available fix are recorded in `.yarnrc.yml`' | |
| echo '(`npmAuditExcludePackages` / `npmAuditIgnoreAdvisories`), each with the' | |
| echo 'reasoning and the condition for removing it.' | |
| } > body.md | |
| number=$(gh issue list --state open --search "$TITLE in:title" --json number,title \ | |
| --jq "map(select(.title == \"$TITLE\")) | .[0].number // empty") | |
| if [ -n "$number" ]; then | |
| gh issue edit "$number" --body-file body.md | |
| echo "Updated issue #$number" | |
| elif [ "$CLEAN" = 'true' ]; then | |
| echo 'Nothing to report and no open issue to update.' | |
| else | |
| gh issue create --title "$TITLE" --body-file body.md | |
| fi |