53 lines
2.1 KiB
YAML
53 lines
2.1 KiB
YAML
name: Dependency Audit
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches:
|
|
- main
|
|
schedule:
|
|
- cron: "23 3 * * 1"
|
|
|
|
jobs:
|
|
dependency-audit:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
|
|
with:
|
|
path: govoplan
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
|
|
with:
|
|
python-version: "3.12"
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
|
|
with:
|
|
node-version: "22"
|
|
- name: Configure SSH for release dependencies
|
|
env:
|
|
GOVOPLAN_RELEASE_SSH_KEY_B64: ${{ secrets.GOVOPLAN_RELEASE_SSH_KEY_B64 }}
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
if [ -z "${GOVOPLAN_RELEASE_SSH_KEY_B64:-}" ]; then
|
|
echo "GOVOPLAN_RELEASE_SSH_KEY_B64 secret is required for git+ssh release dependencies."
|
|
exit 1
|
|
fi
|
|
printf '%s' "$GOVOPLAN_RELEASE_SSH_KEY_B64" | base64 -d > ~/.ssh/id_ed25519
|
|
chmod 600 ~/.ssh/id_ed25519
|
|
echo 'git.add-ideas.de ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDe48IOof2fJS1dTbJtLWQnWnr+JorZXKIFdOAM9ct8G' > ~/.ssh/known_hosts
|
|
chmod 600 ~/.ssh/known_hosts
|
|
- name: Bootstrap GovOPlaN repositories
|
|
working-directory: govoplan
|
|
run: python tools/repo/bootstrap-repositories.py --parent ..
|
|
- name: Install backend dev audit dependencies
|
|
working-directory: govoplan
|
|
run: |
|
|
python -m venv .venv
|
|
.venv/bin/python tools/repo/sync-python-environment.py --requirements requirements-release.txt --python .venv/bin/python --upgrade-pip
|
|
.venv/bin/python -m pip install 'pip-audit>=2.9,<3'
|
|
- name: Install WebUI release dependencies
|
|
working-directory: govoplan
|
|
run: bash tools/release/install-webui-release-dependencies.sh ../govoplan-core/webui
|
|
- name: Run dependency audits
|
|
working-directory: govoplan
|
|
run: GOVOPLAN_CORE_ROOT="$PWD/../govoplan-core" PYTHON="$PWD/.venv/bin/python" bash tools/checks/check-dependency-audits.sh
|