54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
name: pip-audit
|
|
on:
|
|
schedule:
|
|
- cron: "0 1 * * *"
|
|
push:
|
|
branches: [main]
|
|
paths: [requirements.txt, scripts/filter_requirements.py]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest # Docker runner, no mail access needed
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Audit dependencies
|
|
shell: bash
|
|
run: |
|
|
pip install pip-audit
|
|
python3 scripts/filter_requirements.py requirements.txt requirements.audit.txt
|
|
pip-audit -r requirements.audit.txt --no-deps --disable-pip
|
|
|
|
notify:
|
|
needs: audit
|
|
if: ${{ always() && needs.audit.result == 'failure' }}
|
|
runs-on: host # runs directly on the server
|
|
steps:
|
|
- name: Send mail via local postfix
|
|
env:
|
|
MAIL_FROM: ${{ vars.MAIL_FROM }}
|
|
MAIL_TO: ${{ vars.MAIL_TO }}
|
|
REPO: ${{ gitea.repository }}
|
|
RUN_URL: ${{ gitea.server_url }}/${{ gitea.repository }}/actions/runs/${{ gitea.run_number }}
|
|
run: |
|
|
python3 - <<'EOF'
|
|
import os, smtplib
|
|
from email.message import EmailMessage
|
|
|
|
msg = EmailMessage()
|
|
msg["Subject"] = f"[pip-audit] Problem in {os.environ['REPO']}"
|
|
msg["From"] = os.environ["MAIL_FROM"]
|
|
msg["To"] = os.environ["MAIL_TO"]
|
|
msg.set_content(
|
|
"The dependency audit failed (known vulnerability or job error).\n\n"
|
|
f"Details: {os.environ['RUN_URL']}\n"
|
|
)
|
|
|
|
with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
|
|
s.send_message(msg)
|
|
EOFq |