dependabot[bot]
d2b5c1a81e
Closes https://github.com/dart-lang/sdk/pull/63297 GitOrigin-RevId: ad81d11f023ab9dd49b7a67f893631372c29e723 Change-Id: Ib6059e1bb9e73ba0b49d31306f66de8c1892a1a6 Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/499900 Reviewed-by: Alexander Thomas <athom@google.com> Commit-Queue: Alexander Thomas <athom@google.com>
57 lines
2.0 KiB
YAML
57 lines
2.0 KiB
YAML
name: Third party deps scan
|
|
|
|
on:
|
|
# Only the default branch is supported.
|
|
branch_protection_rule:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
types: [ labeled ]
|
|
|
|
# Declare default permissions as read only.
|
|
permissions: read-all
|
|
|
|
jobs:
|
|
extract-deps:
|
|
name: Extract dependencies
|
|
runs-on: 'ubuntu-24.04'
|
|
if: ${{ (github.repository == 'dart-lang/sdk' && github.event_name == 'push') || github.event.label.name == 'vulnerability scan' }}
|
|
permissions:
|
|
# Needed to upload the SARIF results to the code-scanning dashboard.
|
|
security-events: write
|
|
contents: read
|
|
steps:
|
|
- name: "Checkout code"
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
|
|
with:
|
|
persist-credentials: false
|
|
- name: "Set up python"
|
|
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
|
|
with:
|
|
python-version: '3.13.3' # Install the python version needed.
|
|
- name: "Extract deps, find commit hash, pass to osv-scanner"
|
|
run: python .github/extract_deps.py --output osv-lockfile-${{github.sha}}.json
|
|
- name: "Upload osv-scanner deps"
|
|
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
|
|
with:
|
|
# Use github.ref in name to avoid duplicated artifacts.
|
|
name: osv-lockfile-${{github.sha}}
|
|
path: osv-lockfile-${{github.sha}}.json
|
|
retention-days: 2
|
|
vuln-scan:
|
|
name: Vulnerability scanning
|
|
needs:
|
|
extract-deps
|
|
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main"
|
|
with:
|
|
# Download the artifact uploaded in the extract-deps step.
|
|
download-artifact: osv-lockfile-${{github.sha}}
|
|
scan-args: |-
|
|
--lockfile=osv-scanner:osv-lockfile-${{github.sha}}.json
|
|
fail-on-vuln: false
|
|
# Makes sure the osv-formatted vulns are uploaded.
|
|
permissions:
|
|
# Needed to upload the SARIF results to the code-scanning dashboard.
|
|
security-events: write
|
|
contents: read
|