dart-lang/sdk
1
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

Migrate third-party-deps-scan to new workflow location

Browse Source 
Closes https://github.com/dart-lang/sdk/pull/61357

GitOrigin-RevId: 97bf145be9f4bc24c69b614ff058c3e610157eec
Change-Id: I9beb6b43e73bd9425d607f3cc555f5fdcbc9b6ce
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/445900
Reviewed-by: Alexander Thomas <athom@google.com>
This commit is contained in:
Parker Lougheed
2025-08-19 02:25:20 -07:00
committed by Alexander Thomas
parent 1f9ce95fdc
commit a571ba78f7
1 changed files with 11 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/third-party-deps-scan.yml
+11 -11
View File
@@ -13,11 +13,11 @@ permissions: read-all
jobs:
extract-deps:
name: Extract Dependencies
name: Extract dependencies
runs-on: 'ubuntu-24.04'
if: ${{ (github.repository == 'dart-lang/sdk' && github.event_name == 'push') || github.event.label.name == 'vulnerability scan' }}
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
# Needed to upload the SARIF results to the code-scanning dashboard.
security-events: write
contents: read
steps:
@@ -25,16 +25,16 @@ jobs:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
with:
persist-credentials: false
- name: "setup python"
- name: "Set up python"
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
with:
python-version: '3.13.3' # install the python version needed
- name: "extract deps, find commit hash, pass to osv-scanner"
python-version: '3.13.3' # Install the python version needed.
- name: "Extract deps, find commit hash, pass to osv-scanner"
run: python .github/extract_deps.py --output osv-lockfile-${{github.sha}}.json
- name: "upload osv-scanner deps"
- name: "Upload osv-scanner deps"
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
with:
# use github.ref in name to avoid duplicated artifacts
# Use github.ref in name to avoid duplicated artifacts.
name: osv-lockfile-${{github.sha}}
path: osv-lockfile-${{github.sha}}.json
retention-days: 2
@@ -42,15 +42,15 @@ jobs:
name: Vulnerability scanning
needs:
extract-deps
uses: "google/osv-scanner/.github/workflows/osv-scanner-reusable.yml@main"
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@main"
with:
# Download the artifact uploaded in extract-deps step
# Download the artifact uploaded in the extract-deps step.
download-artifact: osv-lockfile-${{github.sha}}
scan-args: |-
--lockfile=osv-scanner:osv-lockfile-${{github.sha}}.json
fail-on-vuln: false
# makes sure the osv-formatted vulns are uploaded
# Makes sure the osv-formatted vulns are uploaded.
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
# Needed to upload the SARIF results to the code-scanning dashboard.
security-events: write
contents: read