54 lines (49 loc) · 1.58 KB
/
audit.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
name: Audit for Security Vulnerabilities (main)
on:
schedule:
- cron: '00 08 * * mon-fri'
permissions:
contents: read
jobs:
audit:
name: Rust Audit
runs-on: ubuntu-20.04
steps:
- name: Checkout repository
uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
with:
ref: main
- name: Run cargo-audit
id: cargo-audit
continue-on-error: true
run: |
OUTCOME=0
echo 'CARGO_AUDIT<<EOF' >> $GITHUB_ENV
(((((cargo audit --deny warnings -q 2>&1; echo $? >&3) | sed 's/`/\\`/g' >&4) 3>&1) | (read xs; exit $xs)) 4>&1) >> $GITHUB_ENV || OUTCOME=1
echo 'EOF' >> $GITHUB_ENV
exit $OUTCOME
- name: Notify on Slack
uses: 8398a7/action-slack@a189acbf0b7ea434558662ae25a0de71df69a435 # v3.14.0
if: steps.cargo-audit.outcome != 'success'
with:
status: custom
fields: workflow, repo
custom_payload: |
{
"text": ":package::mag:cargo audit",
"blocks": [
{
"type": "section",
"text": {
"type": "mrkdwn",
"text": `Workflow: ${process.env.AS_WORKFLOW}\nRepository: ${process.env.AS_REPO}\nRef: \`main\``
}
},
],
"attachments": [{
"color": "danger",
"text": `\`\`\`${{ env.CARGO_AUDIT }}\`\`\``,
}]
}
env:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}