|
| 1 | +name: Bump vulnerable dependencies |
| 2 | + |
| 3 | +on: |
| 4 | + schedule: |
| 5 | + # Run daily at 05:30 UTC, just after the Go toolchain bumper. |
| 6 | + - cron: "30 5 * * *" |
| 7 | + workflow_dispatch: |
| 8 | + |
| 9 | +permissions: |
| 10 | + contents: write |
| 11 | + pull-requests: write |
| 12 | + |
| 13 | + # Required by setup-jfrog (GOPROXY exchange). |
| 14 | + id-token: write |
| 15 | + |
| 16 | +jobs: |
| 17 | + bump-vuln-deps: |
| 18 | + runs-on: |
| 19 | + group: databricks-protected-runner-group-large |
| 20 | + labels: linux-ubuntu-latest-large |
| 21 | + |
| 22 | + steps: |
| 23 | + - name: Checkout |
| 24 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 25 | + |
| 26 | + - name: Setup JFrog |
| 27 | + uses: ./.github/actions/setup-jfrog |
| 28 | + |
| 29 | + - name: Setup Go |
| 30 | + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0 |
| 31 | + with: |
| 32 | + # vulnbump lives in the tools module, which is what this job compiles. |
| 33 | + go-version-file: tools/go.mod |
| 34 | + |
| 35 | + - name: Build vulnbump |
| 36 | + run: go -C tools/vulnbump build -o "$RUNNER_TEMP/vulnbump" . |
| 37 | + |
| 38 | + - name: Bump vulnerable dependencies |
| 39 | + id: bump |
| 40 | + run: | |
| 41 | + set -euo pipefail |
| 42 | +
|
| 43 | + # govulncheck is pinned as a tool dependency in tools/go.mod; -modfile |
| 44 | + # resolves it from there while it scans the root module (the working |
| 45 | + # directory). Only the root module ships; tools/ and |
| 46 | + # bundle/internal/tf/codegen are build- and CI-only, so they are not |
| 47 | + # scanned. Its vulnerability database is fetched from vuln.go.dev at |
| 48 | + # runtime, so the pinned binary still uses the latest advisories. |
| 49 | + # |
| 50 | + # -scan module reports every advisory affecting a required module, |
| 51 | + # regardless of whether the vulnerable symbol is reachable. In JSON |
| 52 | + # mode govulncheck exits 0 on success whether or not it finds anything, |
| 53 | + # and non-zero only on a real error; a failure must abort the job |
| 54 | + # rather than be silently mistaken for "no vulnerabilities". |
| 55 | + scan="$(mktemp)" |
| 56 | + go tool -modfile=tools/go.mod govulncheck -scan module -format json > "$scan" |
| 57 | +
|
| 58 | + summary_file="$(mktemp)" |
| 59 | + "$RUNNER_TEMP/vulnbump" . < "$scan" > "$summary_file" |
| 60 | +
|
| 61 | + if git diff --quiet; then |
| 62 | + echo "No vulnerable dependencies to bump." |
| 63 | + echo "needed=false" >> "$GITHUB_OUTPUT" |
| 64 | + else |
| 65 | + echo "needed=true" >> "$GITHUB_OUTPUT" |
| 66 | + { |
| 67 | + echo "summary<<SUMMARY_EOF" |
| 68 | + cat "$summary_file" |
| 69 | + echo "SUMMARY_EOF" |
| 70 | + } >> "$GITHUB_OUTPUT" |
| 71 | + fi |
| 72 | +
|
| 73 | + - name: Show diff |
| 74 | + if: steps.bump.outputs.needed == 'true' |
| 75 | + run: git diff |
| 76 | + |
| 77 | + - name: Create pull request |
| 78 | + if: steps.bump.outputs.needed == 'true' |
| 79 | + uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 |
| 80 | + with: |
| 81 | + # A fixed branch means a daily run updates the existing open PR in |
| 82 | + # place rather than opening a new one; no branch-suffix is needed. |
| 83 | + branch: auto/bump-vuln-deps |
| 84 | + commit-message: "Bump dependencies with known vulnerabilities" |
| 85 | + title: "Bump dependencies with known vulnerabilities" |
| 86 | + body: | |
| 87 | + Bump dependencies flagged by `govulncheck -scan module` to their fixed versions. |
| 88 | +
|
| 89 | + Each CVE links to its Go advisory page. |
| 90 | +
|
| 91 | + ${{ steps.bump.outputs.summary }} |
| 92 | +
|
| 93 | + Vulnerabilities in the Go standard library are left to the `Bump Go toolchain` workflow. |
| 94 | +
|
| 95 | + If a bump promotes a new direct dependency, double-check its license annotation in `go.mod` and `NOTICE`. |
| 96 | + reviewers: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka |
| 97 | + labels: dependencies |
0 commit comments