Daily security check #59
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Daily security check | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' | |
| workflow_dispatch: | |
| jobs: | |
| security: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repo | |
| uses: actions/checkout@v2 | |
| # PHP checks | |
| - name: Check for php composer project | |
| id: check_composer | |
| uses: andstor/file-existence-action@v2 | |
| with: | |
| files: "composer.lock" | |
| - name: Run php local security checker | |
| if: steps.check_composer.outputs.files_exists == 'true' | |
| run: composer audit | |
| # node-yarn checks | |
| - name: Check for node-yarn project | |
| id: check_node_yarn | |
| uses: andstor/file-existence-action@v2 | |
| with: | |
| files: "yarn.lock" | |
| - name: Setup node | |
| if: steps.check_node_yarn.outputs.files_exists == 'true' | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 14 | |
| - name: Yarn Audit | |
| if: steps.check_node_yarn.outputs.files_exists == 'true' | |
| run: yarn audit --level high --groups dependencies optionalDependencies | |
| # node-npm checks | |
| - name: Check for node-npm project | |
| id: check_node_npm | |
| uses: andstor/file-existence-action@v2 | |
| with: | |
| files: "package.lock" | |
| - name: Setup node | |
| if: steps.check_node_npm.outputs.files_exists == 'true' | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: 14 | |
| - name: npm audit | |
| if: steps.check_node_npm.outputs.files_exists == 'true' | |
| run: npm audit --audit-level=high | |
| # python checks | |
| - name: Check for python project | |
| id: check_python | |
| uses: andstor/file-existence-action@v2 | |
| with: | |
| files: "requirements.txt" | |
| - name: Safety checks Python dependencies | |
| if: steps.check_python.outputs.files_exists == 'true' | |
| uses: pyupio/safety@2.3.5 | |
| # java checks | |
| - name: Check for java maven project | |
| id: check_maven | |
| uses: andstor/file-existence-action@v2 | |
| with: | |
| files: "pom.xml" | |
| - name: Setup java if needed | |
| if: steps.check_maven.outputs.files_exists == 'true' | |
| uses: actions/setup-java@v3 | |
| with: | |
| java-version: 11 | |
| distribution: 'temurin' | |
| cache: 'maven' | |
| - name: Set up maven cache if needed | |
| if: steps.check_maven.outputs.files_exists == 'true' | |
| uses: actions/cache@v1 | |
| with: | |
| path: ~/.m2/repository | |
| key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-maven- | |
| - name: Check java | |
| if: steps.check_maven.outputs.files_exists == 'true' | |
| run: mvn org.owasp:dependency-check-maven:check | |
| # Send results | |
| - name: Send to Slack if something failed | |
| if: failure() | |
| uses: rtCamp/action-slack-notify@v2 | |
| env: | |
| SLACK_CHANNEL: surfconext-nightly-check | |
| SLACK_COLOR: ${{ job.status }} | |
| SLACK_ICON: https://static.surfconext.nl/logos/idp/surfnet.png | |
| SLACK_MESSAGE: 'Dependency check failed :crying_cat_face:' | |
| SLACK_TITLE: ${{ github.repository }} wants attention | |
| SLACK_USERNAME: NightlySecurityCheck | |
| SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} |