Skip to content

feat: Comment Audit result on PR (only on errors) #384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 10 commits into
base: staging
Choose a base branch
from
Open

feat: Comment Audit result on PR (only on errors) #384

Show file tree
Hide file tree
Changes from 9 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
4ba7d84
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
90ecc00
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
77b6104
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
d2679f0
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
3f6eff9
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
563de01
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
67b6ad3
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
caa6e31
feat: rebased the main branch
eduardo-getpassport Nov 15, 2022
486ac05
feat: pretty format YAML file
eduardo-getpassport Nov 15, 2022
0ad2fd3
feat: changed name on vulnerabilities file
eduardo-getpassport Nov 16, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,20 @@ jobs:

# Audit all currently installed packages for security vulnerabilities.
- name: Audit installed packages
run: make audit
id: audit-packages
continue-on-error: true
run: make --silent audit > vulnerabilities.txt

# Upload the vulnerabilities file output.
- name: Upload Artifact
id: upload-audit-artifact
uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb #v3.1.1
with:
name: vulnerabilities.txt
path: .
if-no-files-found: error
retention-days: 1
if: steps.audit-packages.outputs.exit_code == 1
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if steps.audit-packages.conclusion == 'failure' is more reliable because any non-zero exit code is considered a failure (and we check only for 1*)?

—————
* At first glance, 1 seems to be the only exit code that pip-audit returns.


# Build the sdist and wheel distribution of the package and docs as a zip file.
# We don't need to check and test the package separately because `make dist` runs
Expand Down
20 changes: 20 additions & 0 deletions .github/workflows/pr-change-set.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,3 +18,23 @@ jobs:
uses: ./.github/workflows/build.yaml
permissions:
contents: read

comment-audit:
runs-on: ubuntu-latest
permissions:
pull-requests: write
needs: build
steps:

- name: Download artifact from Build
uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 #v3
if: steps.audit-packages.outputs.exit_code == 1
with:
name: vulnerabilities.txt

- name: comment PR
id: comment-pr
run: gh pr comment ${{ github.event.number }} --body-file vulnerabilities.txt
if: steps.audit-packages.outputs.exit_code == 1
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}