From 5283918f37a4dcab08553b58d8aa8662bfaacf6c Mon Sep 17 00:00:00 2001 From: Stefan Negru Date: Mon, 19 Sep 2022 13:33:15 +0300 Subject: [PATCH 1/3] dependency auto-merge - add actions for dependency review security issues - add action to auto merge dependencies --- .github/workflows/dependency-auto-merge.yml | 29 +++++++++++++++++++++ .github/workflows/dependency-review.yml | 22 ++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 .github/workflows/dependency-auto-merge.yml create mode 100644 .github/workflows/dependency-review.yml diff --git a/.github/workflows/dependency-auto-merge.yml b/.github/workflows/dependency-auto-merge.yml new file mode 100644 index 000000000..9281aa230 --- /dev/null +++ b/.github/workflows/dependency-auto-merge.yml @@ -0,0 +1,29 @@ +name: Dependabot auto-merge +on: pull_request + +permissions: + contents: write + pull-requests: write + +jobs: + dependabot: + runs-on: ubuntu-latest + if: ${{ github.actor == 'dependabot[bot]' }} + steps: + - name: Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@v1.3.3 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Wait other jobs are passed or failed + if: ${{ contains(github.event.pull_request.labels.*.name, 'pip dependencies') || contains(github.event.pull_request.labels.*.name, 'github actions') || contains(github.event.pull_request.labels.*.name, 'npm dependencies') }} + uses: kachick/wait-other-jobs@v1 + timeout-minutes: 30 + with: + github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Enable auto-merge for Dependabot PRs + if: ${{ contains(github.event.pull_request.labels.*.name, 'pip dependencies') || contains(github.event.pull_request.labels.*.name, 'github actions') || contains(github.event.pull_request.labels.*.name, 'npm dependencies') }} + run: gh pr review --approve "$PR_URL" && gh pr merge --auto --merge "$PR_URL" + env: + PR_URL: ${{github.event.pull_request.html_url}} + GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}} diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 000000000..494e79bb2 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,22 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: 'Checkout Repository' + uses: actions/checkout@v3 + - name: 'Dependency Review' + uses: actions/dependency-review-action@v2 + with: + fail-on-severity: moderate From 5cbd54d3e1217cfa6b8ba8774ac5c862a33b1c6d Mon Sep 17 00:00:00 2001 From: Stefan Negru Date: Mon, 26 Sep 2022 15:46:58 +0300 Subject: [PATCH 2/3] refine conditions to package-ecosystem --- .github/workflows/dependency-auto-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-auto-merge.yml b/.github/workflows/dependency-auto-merge.yml index 9281aa230..b00ef3bf3 100644 --- a/.github/workflows/dependency-auto-merge.yml +++ b/.github/workflows/dependency-auto-merge.yml @@ -16,13 +16,13 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Wait other jobs are passed or failed - if: ${{ contains(github.event.pull_request.labels.*.name, 'pip dependencies') || contains(github.event.pull_request.labels.*.name, 'github actions') || contains(github.event.pull_request.labels.*.name, 'npm dependencies') }} + if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' || steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' }} uses: kachick/wait-other-jobs@v1 timeout-minutes: 30 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs - if: ${{ contains(github.event.pull_request.labels.*.name, 'pip dependencies') || contains(github.event.pull_request.labels.*.name, 'github actions') || contains(github.event.pull_request.labels.*.name, 'npm dependencies') }} + if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' || steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' }} run: gh pr review --approve "$PR_URL" && gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}} From e7a77fe05d141459db65e42f4577c9135b6f9bb4 Mon Sep 17 00:00:00 2001 From: Stefan Negru Date: Tue, 15 Nov 2022 14:01:37 +0200 Subject: [PATCH 3/3] remove automatic merging on npm till e2e restored --- .github/workflows/dependency-auto-merge.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dependency-auto-merge.yml b/.github/workflows/dependency-auto-merge.yml index b00ef3bf3..787ad39ec 100644 --- a/.github/workflows/dependency-auto-merge.yml +++ b/.github/workflows/dependency-auto-merge.yml @@ -16,13 +16,13 @@ jobs: with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Wait other jobs are passed or failed - if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' || steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' }} + if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' }} uses: kachick/wait-other-jobs@v1 timeout-minutes: 30 with: github-token: "${{ secrets.GITHUB_TOKEN }}" - name: Enable auto-merge for Dependabot PRs - if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' || steps.metadata.outputs.package-ecosystem == 'npm_and_yarn' }} + if: ${{ steps.metadata.outputs.package-ecosystem == 'pip' || steps.metadata.outputs.package-ecosystem == 'github_actions' }} run: gh pr review --approve "$PR_URL" && gh pr merge --auto --merge "$PR_URL" env: PR_URL: ${{github.event.pull_request.html_url}}