sofie-core/.github/workflows/audit.yaml at main · bbc/sofie-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
name: Audit dependencies

on:
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate-prod-core-dependencies:
    name: Validate Core production dependencies
    runs-on: ubuntu-latest
    continue-on-error: true
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"
      - uses: ./.github/actions/setup-meteor
      - name: restore node_modules
        uses: actions/cache@v5
        with:
          path: |
            meteor/node_modules
          key: ${{ runner.os }}-${{ hashFiles('meteor/yarn.lock') }}-${{ hashFiles('meteor/.meteor/release') }}
      - name: Validate production dependencies for vulnerabilities and compatible licenses
        run: |
          corepack enable

          yarn
          cd meteor
          yarn validate:prod-dependencies
        env:
          CI: true

  validate-all-core-dependencies:
    name: Validate all Core dependencies
    runs-on: ubuntu-latest
    continue-on-error: true
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"
      - uses: ./.github/actions/setup-meteor
      - name: restore node_modules
        uses: actions/cache@v5
        with:
          path: |
            meteor/node_modules
          key: ${{ runner.os }}-${{ hashFiles('meteor/yarn.lock') }}-${{ hashFiles('meteor/.meteor/release') }}
      - name: Validate production dependencies for vulnerabilities and compatible licenses
        run: |
          corepack enable

          yarn
          cd meteor
          yarn run validate:all-dependencies
        env:
          CI: true

  validate-prod-packages-dependencies:
    name: Validate Package production dependencies
    runs-on: ubuntu-latest
    continue-on-error: true
    timeout-minutes: 15

    strategy:
      fail-fast: false
      matrix:
        package-name:
          - blueprints-integration
          - server-core-integration
          - shared-lib
          - live-status-gateway-api
          - playout-gateway
          - mos-gateway
          - live-status-gateway

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"
      - name: Prepare Environment
        run: |
          corepack enable

          cd packages
          yarn install
        env:
          CI: true
      - name: Validate production dependencies
        run: |
          cd packages/${{ matrix.package-name }}
          if ! git log --format=oneline -n 1 | grep -q "\[ignore-audit\]"; then
            yarn validate:dependencies
          else
            echo "Skipping audit"
          fi
        env:
          CI: true

  validate-all-package-dependencies:
    name: Validate all Package dependencies
    runs-on: ubuntu-latest
    continue-on-error: true
    timeout-minutes: 15

    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false
      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: ".node-version"
      - name: Prepare Environment
        run: |
          corepack enable

          cd packages
          yarn install
        env:
          CI: true
      - name: Validate production dependencies
        run: |
          cd packages
          yarn validate:dependencies
        env:
          CI: true