Skip to content

workflows: add dependabump #1576

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
jmank88 wants to merge 1 commit into
base: main
Choose a base branch
from
+253 −0
Draft

workflows: add dependabump #1576

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
108 changes: 108 additions & 0 deletions .github/workflows/dependabump.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,108 @@
# GENERATED FILE - DO NOT EDIT DIRECTLY.
# Source: workflows/dependabump/dependabump.yml
# Edit the source under workflows/, then regenerate.

name: dependabump

on:
workflow_call:
secrets:
SLACK_TOKEN:
required: true
SLACK_CHANNEL_ID:
required: true
inputs:
severity:
required: false
type: string
default: 'critical,high'
post-bump-command:
required: false
type: string

permissions: { }

jobs:
dependabump:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
actions: read
security-events: read
vulnerability-alerts: read

Check failure on line 33 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
unknown permission scope "vulnerability-alerts". all available permission scopes are "actions", "artifact-metadata", "attestations", "checks", "contents", "deployments", "discussions", "id-token", "issues", "models", "packages", "pages", "pull-requests", "repository-projects", "security-events", "statuses" [permissions]

Raw Output:
e:.github/workflows/dependabump.yml:33:7: unknown permission scope "vulnerability-alerts". all available permission scopes are "actions", "artifact-metadata", "attestations", "checks", "contents", "deployments", "discussions", "id-token", "issues", "models", "packages", "pages", "pull-requests", "repository-projects", "security-events", "statuses" [permissions]
env:
GH_TOKEN: ${{ github.token }}
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up Go
uses: actions/setup-go@v6

- name: Install tools
run: |

Check warning on line 44 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
shellcheck reported issue in this script: SC2288:warning:1:82: This is interpreted as a command name ending with '#'. Double check syntax [shellcheck]

Raw Output:
w:.github/workflows/dependabump.yml:44:9: shellcheck reported issue in this script: SC2288:warning:1:82: This is interpreted as a command name ending with '#'. Double check syntax [shellcheck]
go install github.com/jmank88/gomods@ec230e90e89d4310b21fdeeba0d1290a3821a901 && \ # v0.1.7
go install github.com/smartcontractkit/chainlink-common/script/cmd/dependabot@70b55abaf6e19d887c219b497046838d6113f22c
continue-on-error: true

- name: Bump Dependencies
run: |
gh api --paginate -H "Accept: application/vnd.github+json" --method GET \
'/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=${{ inputs.severity }}' \

Check warning

Code scanning / CodeQL

Code injection Medium

Potential code injection in
${ inputs.severity }
Loading
, which may be controlled by an external user.
--jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \
dependabot && gomods tidy
continue-on-error: true

- name: Post-bump Command
if: ${ inputs.post-bump-command != '' }

Check failure on line 58 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
got unexpected character '$' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' ' [expression]

Raw Output:
e:.github/workflows/dependabump.yml:58:13: got unexpected character '$' while lexing expression, expecting 'a'..'z', 'A'..'Z', '_', '0'..'9', ''', '}', '(', ')', '[', ']', '.', '!', '<', '>', '=', '&', '|', '*', ',', ' ' [expression]
env:
POST_BUMP_COMMAND: ${{ inputs.post-bump-command }}
run: eval "${POST_BUMP_COMMAND}"

- name: Notify Failure
if: failure()
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |

Check failure on line 69 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
receiver of object dereference "name" must be type of object but got "string" [expression]

Raw Output:
e:.github/workflows/dependabump.yml:69:111: receiver of object dereference "name" must be type of object but got "string" [expression]
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Failed to check for vulnerabilities in `${{ github.repository.name }}`: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>"

- if: failure()
run: exit 1

- name: Create Pull Request
id: pr
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
branch: bot/dependabump
commit-message: "bump dependencies"
title: "dependabump"
body: "Upgrading vulnerable dependencies."
sign-commits: true
continue-on-error: true

- name: Notify PR Failure
if: failure()
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |

Check failure on line 93 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
receiver of object dereference "name" must be type of object but got "string" [expression]

Raw Output:
e:.github/workflows/dependabump.yml:93:100: receiver of object dereference "name" must be type of object but got "string" [expression]
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Vulnerabilities detected in `${{ github.repository.name }}`, but failed to create PR: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>"

- if: failure()
run: exit 1

- name: Notify PR Created
if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |

Check failure on line 106 in .github/workflows/dependabump.yml

View workflow job for this annotation

GitHub Actions / ci-lint-misc 

[actionlint] reported by reviewdog 🐶
receiver of object dereference "name" must be type of object but got "string" [expression]

Raw Output:
e:.github/workflows/dependabump.yml:106:100: receiver of object dereference "name" must be type of object but got "string" [expression]
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Vulnerabilities detected in `${{ github.repository.name }}` - upgrading dependencies: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run> - <${{ steps.pr.outputs.pull-request-url }}|PR> :review-time:"
30 changes: 30 additions & 0 deletions workflows/dependabump/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# Dependabump

This workflow inspects dependenabot vulnerabilities, and opens pull requests to update dependencies.

## Recommended usage
Example workflow:
```yaml
name: dependabump

on:
workflow_dispatch:
schedule:
- cron: '0 0 * * 1-5' # every week-day at midnight

permissions: { }

jobs:
dependabump:
permissions:
contents: write
pull-requests: write
actions: read
security-events: read
vulnerability-alerts: read
uses: smartcontractkit/.github/workflows/dependabump.yml@main
secrets:
SLACK_TOKEN: ${{ secrets.DEPENDABUMP_SLACK_API_KEY }}
SLACK_CHANNEL_ID: ${{ secrets.DEPENDABUMP_SLACK_CHANNEL_ID }}

```
104 changes: 104 additions & 0 deletions workflows/dependabump/dependabump.yml
View file
Open in desktop
Comment thread
jmank88 marked this conversation as resolved.
Original file line number Diff line number Diff line change
@@ -0,0 +1,104 @@
name: dependabump

on:
workflow_call:
secrets:
SLACK_TOKEN:
required: true
SLACK_CHANNEL_ID:
required: true
inputs:
severity:
required: false
type: string
default: 'critical,high'
post-bump-command:
required: false
type: string

permissions: { }

jobs:
dependabump:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
actions: read
security-events: read
vulnerability-alerts: read
env:
GH_TOKEN: ${{ github.token }}
steps:
- name: Checkout
uses: actions/checkout@v6

- name: Set up Go
uses: actions/setup-go@v6

- name: Install tools
run: |
go install github.com/jmank88/gomods@ec230e90e89d4310b21fdeeba0d1290a3821a901 && \ # v0.1.7
go install github.com/smartcontractkit/chainlink-common/script/cmd/dependabot@70b55abaf6e19d887c219b497046838d6113f22c
continue-on-error: true

- name: Bump Dependencies
run: |
gh api --paginate -H "Accept: application/vnd.github+json" --method GET \
'/repos/smartcontractkit/chainlink-common/dependabot/alerts?state=open&ecosystem=Go&severity=${{ inputs.severity }}' \
--jq '.[] | select(.security_vulnerability.first_patched_version != null) | .dependency.manifest_path |= rtrimstr("go.mod") | "./\(.dependency.manifest_path) \(.security_vulnerability.package.name) \(.security_vulnerability.first_patched_version.identifier)"' | \
dependabot && gomods tidy
continue-on-error: true

- name: Post-bump Command
if: ${ inputs.post-bump-command != '' }
env:
POST_BUMP_COMMAND: ${{ inputs.post-bump-command }}
run: eval "${POST_BUMP_COMMAND}"

- name: Notify Failure
if: failure()
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Failed to check for vulnerabilities in `${{ github.repository.name }}`: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>"

- if: failure()
run: exit 1

- name: Create Pull Request
id: pr
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
with:
branch: bot/dependabump
commit-message: "bump dependencies"
title: "dependabump"
body: "Upgrading vulnerable dependencies."
sign-commits: true
continue-on-error: true

- name: Notify PR Failure
if: failure()
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Vulnerabilities detected in `${{ github.repository.name }}`, but failed to create PR: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run>"

- if: failure()
run: exit 1

- name: Notify PR Created
if: steps.pr.outputs.pull-request-operation == 'created' || steps.pr.outputs.pull-request-operation == 'updated'
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
with:
method: chat.postMessage
token: ${{ secrets.SLACK_TOKEN }}
payload: |
channel: ${{ secrets.SLACK_CHANNEL_ID}}
text: "Vulnerabilities detected in `${{ github.repository.name }}` - upgrading dependencies: <${{ format('https://github.com/{0}/actions/runs/{1}', github.repository, github.run_id) }}|Run> - <${{ steps.pr.outputs.pull-request-url }}|PR> :review-time:"
11 changes: 11 additions & 0 deletions workflows/dependabump/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
{
"name": "dependabump",
"version": "0.0.0",
"description": "",
"private": true,
"scripts": {},
"keywords": [],
"author": "@smartcontractkit",
"license": "MIT",
"packageManager": "pnpm@10.29.3"
}
Loading