audit_dependencies.yml

name: "Audit dependencies"

on:
  # Runs audit every monday
  schedule:
    - cron:  '0 10 * * 1'
  # Enable manual run
  workflow_dispatch:

jobs:
  audit:
    # Do not run scheduled audit on tier repositories
    if: github.repository == 'glpi-project/glpi' || github.event_name != 'schedule'
    permissions:
      issues: "write"
    name: "Audit dependencies (${{ matrix.branch }})"
    runs-on: "ubuntu-latest"
    strategy:
      fail-fast: false
      matrix:
        include:
          - {branch: "9.5/bugfixes", php-version: "7.2"}
          - {branch: "10.0/bugfixes", php-version: "7.4"}
    env:
      COMPOSE_FILE: ".github/actions/docker-compose-app.yml"
      APPLICATION_ROOT: "${{ github.workspace }}"
      PHP_IMAGE: "githubactions-php:${{ matrix.php-version }}"
      UPDATE_FILES_ACL: true
    steps:
      - name: "Clean workspace"
        run: |
          echo "APP_CONTAINER_HOME=${{ runner.temp }}/app_home" >> $GITHUB_ENV
          rm -rf "${{ env.APPLICATION_ROOT }}/*"
          rm -rf "${{ env.APP_CONTAINER_HOME }}/*"
      - name: "Checkout"
        uses: "actions/checkout@v3"
        with:
          ref: ${{ matrix.branch }}
      - name: "Restore dependencies cache"
        uses: actions/cache@v3
        with:
          path: |
            ${{ env.APP_CONTAINER_HOME }}/.composer/cache/
            ${{ env.APP_CONTAINER_HOME }}/.npm/_cacache/
          key: "app_home_deps-${{ matrix.php-version }}-${{ hashFiles('composer.lock', 'package-lock.json') }}"
          restore-keys: |
            app_home_deps-${{ matrix.php-version }}-
            app_home_deps-
      - name: "Initialize containers"
        run: |
          .github/actions/init_containers-start.sh
      - name: "Show versions"
        run: |
          .github/actions/init_show-versions.sh
      - name: "Audit npm dependencies"
        continue-on-error: true
        id: "npmaudit"
        run: |
          set -o pipefail
          CODE=0
          LOG=$( npm audit package-lock-only 2>&1 | tee /dev/stderr ) || CODE=$?
          echo "CODE=$CODE" >> $GITHUB_OUTPUT
          printf "LOG<<EOF\n$LOG\nEOF" >> $GITHUB_OUTPUT
      - name: "Create issue if npm audit fails"
        if: "${{ steps.npmaudit.outputs.CODE != '0' }}"
        uses: "actions/github-script@v6"
        with:
          script: |
            const result = await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'npm audit failed (${{ matrix.branch }})',
              body: '```\n' + ${{ toJSON(steps.npmaudit.outputs.LOG) }} + '\n```',
            });
      - name: "Audit composer dependencies"
        continue-on-error: true
        id: "composeraudit"
        run: |
          set -o pipefail
          CODE=0
          LOG=$( composer audit --locked 2>&1 | tee /dev/stderr ) || CODE=$?
          echo "CODE=$CODE" >> $GITHUB_OUTPUT
          printf "LOG<<EOF\n$LOG\nEOF" >> $GITHUB_OUTPUT
      - name: "Create issue if composer audit fails"
        if: "${{ steps.composeraudit.outputs.CODE != '0' }}"
        uses: "actions/github-script@v6"
        with:
          script: |
            const result = await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: 'composer audit failed (${{ matrix.branch }})',
              body: '```\n# composer audit report\n\n' + ${{ toJSON(steps.composeraudit.outputs.LOG) }} + '\n```',
            });