diff --git a/.gitea/workflows/pip-audit.yaml b/.gitea/workflows/pip-audit.yaml index ae665f8..c1901c7 100644 --- a/.gitea/workflows/pip-audit.yaml +++ b/.gitea/workflows/pip-audit.yaml @@ -1,7 +1,7 @@ name: pip-audit on: schedule: - - cron: "0 1 * * *" + - cron: "0 5 * * *" push: branches: [main] paths: [requirements.txt, scripts/filter_requirements.py] @@ -9,7 +9,9 @@ on: jobs: audit: - runs-on: ubuntu-latest # Docker runner, no mail access needed + runs-on: ubuntu-latest + outputs: + report_b64: ${{ steps.audit.outputs.report_b64 }} steps: - uses: actions/checkout@v4 @@ -18,37 +20,59 @@ jobs: python-version: "3.12" - name: Audit dependencies + id: audit shell: bash run: | pip install pip-audit python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt - pip-audit -r requirements.audit.txt --no-deps --disable-pip + + # Don't let a non-zero exit abort the step, so the report is saved first + set +e + pip-audit -r requirements.audit.txt --no-deps --disable-pip > audit.txt 2>&1 + echo $? > audit.exit + set -e + + cat audit.txt + echo "report_b64=$(head -c 100000 audit.txt | base64 -w0)" >> "$GITHUB_OUTPUT" + + - name: Fail if the audit failed + shell: bash + run: exit "$(cat audit.exit)" notify: needs: audit if: ${{ always() && needs.audit.result == 'failure' }} - runs-on: host # runs directly on the server + runs-on: host steps: - name: Send mail via local postfix env: - MAIL_FROM: ${{ vars.MAIL_FROM }} - MAIL_TO: ${{ vars.MAIL_TO }} - REPO: ${{ gitea.repository }} - RUN_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }} + MAIL_FROM: ${{ vars.MAIL_FROM }} + MAIL_TO: ${{ vars.MAIL_TO }} + REPO: ${{ gitea.repository }} + RUN_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }} + REPORT_B64: ${{ needs.audit.outputs.report_b64 }} run: | python3 - <<'EOF' - import os, smtplib + import base64, os, smtplib from email.message import EmailMessage + b64 = os.environ.get("REPORT_B64", "") + report = ( + base64.b64decode(b64).decode("utf-8", errors="replace") + if b64 else + "(no audit output, the job failed before pip-audit finished)" + ) + msg = EmailMessage() msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}" msg["From"] = os.environ["MAIL_FROM"] msg["To"] = os.environ["MAIL_TO"] msg.set_content( - "The dependency audit failed (known vulnerability or job error).\n\n" - f"Details: {os.environ['RUN_URL']}\n" + f"pip-audit result for {os.environ['REPO']}:\n\n" + f"{report}\n\n" + f"Run: {os.environ['RUN_URL']}\n" ) with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s: s.send_message(msg) - EOFq \ No newline at end of file + EOF \ No newline at end of file