Raphaël Walther
53 lines
1.9 KiB
YAML
53 lines
1.9 KiB
YAML
name: Daily security audit
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '5 9 * * *'
|
|
jobs:
|
|
cargo-deny:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository code
|
|
uses: actions/checkout@v2
|
|
- name: Install rust toolchain
|
|
uses: actions-rs/toolchain@v1
|
|
with:
|
|
toolchain: stable
|
|
- name: Install cargo deny
|
|
run: cargo install --locked cargo-deny
|
|
- name: Run cargo deny
|
|
run: |
|
|
find . -name Cargo.toml -exec cargo deny --manifest-path {} check \
|
|
advisories -A advisory-not-detected --hide-inclusion-graph \; &> \
|
|
>(uniq &> .github/workflows/support-files/notifications/deny.message )
|
|
- uses: actions/upload-artifact@v3
|
|
with:
|
|
name: report
|
|
path: .github/workflows/support-files/notifications/deny.message
|
|
notification:
|
|
needs: cargo-deny
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Check out repository code
|
|
uses: actions/checkout@v2
|
|
- name: Download report from previous job
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: report
|
|
path: .github/workflows/support-files/notifications
|
|
- name: Keybase - Node Install
|
|
run: npm install
|
|
working-directory: .github/workflows/support-files
|
|
- name: Keybase - Send Notification
|
|
env:
|
|
NYM_NOTIFICATION_KIND: security
|
|
NYM_PROJECT_NAME: "Daily security report"
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
KEYBASE_NYMBOT_USERNAME: "${{ secrets.KEYBASE_NYMBOT_USERNAME }}"
|
|
KEYBASE_NYMBOT_PAPERKEY: "${{ secrets.KEYBASE_NYMBOT_PAPERKEY }}"
|
|
KEYBASE_NYMBOT_TEAM: "${{ secrets.KEYBASE_NYMBOT_TEAM }}"
|
|
KEYBASE_NYM_CHANNEL: "security"
|
|
uses: docker://keybaseio/client:stable-node
|
|
with:
|
|
args: .github/workflows/support-files/notifications/entry_point.sh
|