Repository navigation
chore(release): 3.4.1 #134
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: core-tool-watch | |
| # Watches pinned core tools for version drift and supply-chain findings. | |
| on: | |
| schedule: | |
| - cron: "0 7 * * 1" | |
| workflow_dispatch: | |
| pull_request: | |
| paths: | |
| - "Dockerfile" | |
| - "Dockerfile.heavy" | |
| - "app_tests/Dockerfile" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "scripts/check_core_tools.py" | |
| - ".github/workflows/core-tool-watch.yml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "Dockerfile" | |
| - "Dockerfile.heavy" | |
| - "app_tests/Dockerfile" | |
| - "pyproject.toml" | |
| - "uv.lock" | |
| - "scripts/check_core_tools.py" | |
| - ".github/workflows/core-tool-watch.yml" | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: core-tool-watch-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| analyze: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: socket-firewall | |
| permissions: | |
| contents: read | |
| issues: write | |
| packages: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Checkout scan environment | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: main | |
| path: .scan-env | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: 🐍 Setup Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: 🛠️ Sync scan environment | |
| run: | | |
| python -m pip install --upgrade pip uv | |
| uv sync --locked --project .scan-env --no-install-project | |
| - name: Select mode | |
| id: mode | |
| env: | |
| EVENT: ${{ github.event_name }} | |
| run: | | |
| if [ "$EVENT" = "pull_request" ]; then | |
| echo "mode=build" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "mode=watch" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run core-tool supply-chain analysis | |
| id: scan | |
| env: | |
| SOCKET_API_TOKEN: ${{ secrets.SOCKET_SFW_API_TOKEN }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| MODE: ${{ steps.mode.outputs.mode }} | |
| run: | | |
| uv run --project .scan-env --no-sync python scripts/check_core_tools.py \ | |
| --mode "$MODE" \ | |
| --summary-file core-tools-report.md \ | |
| --json-out core-tools-report.json \ | |
| --github-output "$GITHUB_OUTPUT" \ | |
| --fail-on-malware | |
| - name: Render report to job summary | |
| if: always() | |
| run: | | |
| if [ -f core-tools-report.md ]; then | |
| cat core-tools-report.md >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| - name: Upload core-tool report | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | |
| with: | |
| name: core-tools-report | |
| path: | | |
| core-tools-report.md | |
| core-tools-report.json | |
| if-no-files-found: warn | |
| retention-days: 30 | |
| - name: Reconcile drift tracking issue | |
| if: ${{ always() && steps.mode.outputs.mode == 'watch' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| DRIFT: ${{ steps.scan.outputs.drift }} | |
| DISCOVERY_COMPLETE: ${{ steps.scan.outputs.discovery_complete }} | |
| run: | | |
| if [ ! -s core-tools-report.md ] \ | |
| || { [ "$DRIFT" != "true" ] && [ "$DRIFT" != "false" ]; } \ | |
| || { [ "$DISCOVERY_COMPLETE" != "true" ] && [ "$DISCOVERY_COMPLETE" != "false" ]; }; then | |
| echo "::warning::Skipping issue reconciliation because the scan did not produce a complete report." | |
| exit 0 | |
| fi | |
| gh label create core-tool-drift \ | |
| --color FBCA04 \ | |
| --description "A core OSS tool has a newer upstream release" 2>/dev/null || true | |
| title="Core tool version drift detected" | |
| run_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" | |
| existing="$(gh issue list --label core-tool-drift --state open --limit 1 \ | |
| --json number --jq '.[0].number // empty')" | |
| if [ -z "$existing" ]; then | |
| existing="$(gh issue list --label core-tool-drift --state closed --limit 1 \ | |
| --json number --jq '.[0].number // empty')" | |
| fi | |
| if [ "$DRIFT" = "true" ] && [ -n "$existing" ]; then | |
| state="$(gh issue view "$existing" --json state --jq '.state')" | |
| gh issue edit "$existing" --body-file core-tools-report.md | |
| if [ "$state" = "CLOSED" ]; then | |
| gh issue reopen "$existing" \ | |
| --comment "Drift re-detected by [run #${GITHUB_RUN_ID}](${run_url}); body updated." | |
| else | |
| gh issue comment "$existing" \ | |
| --body "Drift re-detected by [run #${GITHUB_RUN_ID}](${run_url}); body updated." | |
| fi | |
| elif [ "$DRIFT" = "true" ]; then | |
| gh issue create \ | |
| --title "$title" \ | |
| --label core-tool-drift \ | |
| --body-file core-tools-report.md | |
| elif [ "$DISCOVERY_COMPLETE" = "true" ] && [ -n "$existing" ]; then | |
| state="$(gh issue view "$existing" --json state --jq '.state')" | |
| gh issue edit "$existing" --body-file core-tools-report.md | |
| if [ "$state" = "OPEN" ]; then | |
| gh issue close "$existing" \ | |
| --comment "No core tool version drift remains as of [run #${GITHUB_RUN_ID}](${run_url}); body updated with the reconciled pins." | |
| fi | |
| elif [ -n "$existing" ]; then | |
| gh issue edit "$existing" --body-file core-tools-report.md | |
| gh issue comment "$existing" \ | |
| --body "[Run #${GITHUB_RUN_ID}](${run_url}) refreshed the report, but latest-version discovery was incomplete; issue state was left unchanged." | |
| fi |