auto-suppress-CVEs.yml

name: Auto-suppress CVEs

on:
  schedule:
    # At 12 midnight and every 3rd hour from 10am through 11pm
    - cron: "0 0,10-23/3 * * *"
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: tibdex/github-app-token@v1
        id: generate-token
        with:
          app_id: ${{ secrets.HMCTS_GITHUB_CCD_APP_ID }}
          private_key: ${{ secrets.HMCTS_GITHUB_CCD_PRIVATE_KEY }}

      - uses: actions/checkout@v3
        with:
          token: ${{ steps.generate-token.outputs.token }}
          ref: master

      - name: Run yarn audit
        run: yarn npm audit --recursive --environment production --json > yarn-audit-known-issues

      - name: Commit updated CVE suppressions
        uses: stefanzweifel/git-auto-commit-action@v4
        with:
          skip_dirty_check: true
          commit_message: "Auto-suppress CVEs"
          branch: master