Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: avoid creating issues on vulnerabilities found (by default) #414

Merged
merged 2 commits into from
Feb 26, 2024
Merged

feat: avoid creating issues on vulnerabilities found (by default) #414

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a996663
feat: avoid creating issues on vulnerabilities found (by default)
RobPasMue Feb 26, 2024
80d1ab3
feat: add migration steps docs
RobPasMue Feb 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
23 changes: 19 additions & 4 deletions check-vulnerabilities/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,14 @@ inputs:
required: false
type: boolean

create-issues:
description: >
Whether to create issues for new advisories detected.
By default, issues are NOT created for new advisories detected.
default: false
required: false
type: boolean

checkout:
description: >
Whether to clone the repository in the CI/CD machine. Default value is
Expand Down Expand Up @@ -142,6 +150,10 @@ runs:
echo "DEPENDENCY_CHECK_DRY_RUN=1" >> $GITHUB_ENV
echo "DEPENDENCY_CHECK_ERROR_EXIT=1" >> $GITHUB_ENV
fi
if [[ ${{ inputs.create-issues }} == 'true' ]];
then
echo "DEPENDENCY_CHECK_CREATE_ISSUES=1" >> $GITHUB_ENV
fi

- name: "Install Git and clone project"
uses: actions/checkout@v4
Expand Down Expand Up @@ -212,6 +224,7 @@ runs:
REPOSITORY = os.environ.get("DEPENDENCY_CHECK_REPOSITORY", None)
DRY_RUN = True if os.environ.get("DEPENDENCY_CHECK_DRY_RUN", None) else False
ERROR_IF_NEW_ADVISORY = True if os.environ.get("DEPENDENCY_CHECK_ERROR_EXIT", None) else False
CREATE_ISSUES = True if os.environ.get("DEPENDENCY_CHECK_CREATE_ISSUES", None) else False


def dict_hash(dictionary: Dict[str, Any]) -> str:
Expand Down Expand Up @@ -315,7 +328,8 @@ runs:
)

# Create an issue
issue_body = f"""
if CREATE_ISSUES:
issue_body = f"""
A new security advisory was open in this repository. See {advisory.html_url}.

---
Expand All @@ -330,7 +344,7 @@ runs:

{desc}
"""
repo.create_issue(title=summary, body=issue_body, labels=["security"])
repo.create_issue(title=summary, body=issue_body, labels=["security"])
else:
# New safety advisory detected
safety_results_reported += 1
Expand Down Expand Up @@ -412,7 +426,8 @@ runs:
)

# Create an issue
issue_body = f"""
if CREATE_ISSUES:
issue_body = f"""
A new security advisory was open in this repository. See {advisory.html_url}.

---
Expand All @@ -426,7 +441,7 @@ runs:
#### Description
{desc}
"""
repo.create_issue(title=summary, body=issue_body, labels=["security"])
repo.create_issue(title=summary, body=issue_body, labels=["security"])
else:
# New bandit advisory detected
bandit_results_reported += 1
Expand Down
6 changes: 6 additions & 0 deletions doc/source/migration_guide.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,15 @@
from one version of the actions to another, and other upstream dependencies that
have been updated.

Development version

Check warning on line 10 in doc/source/migration_guide.rst

View workflow job for this annotation

GitHub Actions / vale

[vale] doc/source/migration_guide.rst#L10 

[Google.Headings] 'Development version' should use sentence-style capitalization.
Raw output 
{"message": "[Google.Headings] 'Development version' should use sentence-style capitalization.", "location": {"path": "doc/source/migration_guide.rst", "range": {"start": {"line": 10, "column": 1}}}, "severity": "WARNING"}
-------------------

**New features:**

- Obscuring vulnerabilities results in ``ansys/action/check-vulnerabilities``. This is useful when you want to hide the
vulnerabilities from the logs, but still want to fail the action if vulnerabilities are found.
- Avoid creating issues by default if vulnerabilities are found in ``ansys/action/check-vulnerabilities``.

**Breaking Changes:**

- N/A
Expand All @@ -24,7 +30,7 @@
**New features:**

- Added ``ansys/action/check-vulnerabilities`` to check for third party and first party vulnerabilities.
This action uses ``bandit`` and ``safety`` to check for vulnerabilities in the code and dependencies, respectively.

Check warning on line 33 in doc/source/migration_guide.rst

View workflow job for this annotation

GitHub Actions / vale

[vale] doc/source/migration_guide.rst#L33 

[Google.WordList] Use 'select' instead of 'check'.
Raw output 
{"message": "[Google.WordList] Use 'select' instead of 'check'.", "location": {"path": "doc/source/migration_guide.rst", "range": {"start": {"line": 33, "column": 49}}}, "severity": "WARNING"}
- Added ``ansys/actions/docker-style`` to check for Dockerfile style issues using ``hadolint``.
- Allow ``vale`` version input in ``ansys/actions/doc-style`` action. By default, ``2.29.6`` is used.
- Allow using the twine ``--skip-existing`` flag in the ``ansys/actions/release-pypi-*`` actions.
Expand Down