drupal-advisory-database/.github/workflows/ci.yml at 73b3dfd81e39f63566a1cd0dc89bcd90b93ad963 · DrupalSecurityTeam/drupal-advisory-database · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
name: CI
on:
  pull_request:
  push:
    branches:
      - main
concurrency:
  # Pushing new changes to a branch will cancel any in-progress CI runs of this workflow
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}

jobs:
  audit:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - name: Audit dependencies for security vulnerabilities
        uses: g-rath/check-with-osv-detector@0e8c0f954d8618a3a4671eca1918b30b2d085af3 # v0.2.0
  lint:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      # build the osv-linter from source
      - run: git clone https://github.com/ossf/osv-schema
      - name: Set up Go
        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          cache-dependency-path: 'osv-schema/tools/osv-linter/go.sum'
          go-version: stable
          check-latest: true
      - run: go build -o osv-linter ./cmd/osv
        working-directory: osv-schema/tools/osv-linter
      - run: osv-schema/tools/osv-linter/osv-linter

      - run: go install github.com/ossf/osv-schema/tools/osv-linter/cmd/osv@latest

      # run the linter against our advisories
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          path: drupal-advisory-database
          persist-credentials: false
      - run: |
          osv-schema/tools/osv-linter/osv-linter record lint --parallel 2 \
            drupal-advisory-database/advisories/

  ruff:
    permissions:
      contents: read # to fetch code (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
        with:
          version-file: 'pyproject.toml'
          args: 'check'
      - uses: astral-sh/ruff-action@57714a7c8a2e59f32539362ba31877a1957dded1 # v3.5.1
        with:
          version-file: 'pyproject.toml'
          args: 'format --check --diff'
  mypy:
    permissions:
      contents: read # to fetch (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version-file: '.python-version'
      - run: pipx install poetry~=2.0
      - run: poetry install
      - run: poetry run mypy .
  pytest:
    permissions:
      contents: read # to fetch (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version-file: '.python-version'
      - run: pipx install poetry~=2.0
      - run: poetry install
      - run: poetry run pytest
  validate:
    permissions:
      contents: read # to fetch (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version-file: '.python-version'
      - run: pipx install poetry~=2.0
      - run: poetry install
      - run: poetry run scripts/validate_advisories.py
  prettier:
    permissions:
      contents: read # to fetch (actions/checkout)
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false
      - uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
      - run: npx prettier --check .