Skip to content

Commit 8ee14b5

Browse files
nDriaDevnDriaDev
committed
chore: add github workflow security audit + fix release script
1 parent f4e5eca commit 8ee14b5

2 files changed

Lines changed: 240 additions & 14 deletions

File tree

‎.github/workflows/autofix-publish.yml‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
name: Dependency Audit & Publish
2+
3+
on:
4+
# schedule:
5+
# - cron: '0 23 * * *' # every day at 23:00 UTC (01:00 IT)
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: write
10+
id-token: write
11+
12+
jobs:
13+
audit:
14+
runs-on: ubuntu-latest
15+
env:
16+
CI: true
17+
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@v4
21+
with:
22+
token: ${{ secrets.GITHUB_TOKEN }}
23+
fetch-depth: 0
24+
25+
- name: Setup pnpm
26+
uses: pnpm/action-setup@v4
27+
with:
28+
version: latest
29+
30+
- name: Setup Node.js
31+
uses: actions/setup-node@v4
32+
with:
33+
node-version: '20'
34+
cache: 'pnpm'
35+
registry-url: 'https://registry.npmjs.org'
36+
37+
- name: Configure git
38+
run: |
39+
git config user.name "github-actions[bot]"
40+
git config user.email "github-actions[bot]@users.noreply.github.com"
41+
42+
- name: Install dependencies
43+
run: pnpm install
44+
45+
- name: Audit (1st pass)
46+
id: audit1
47+
run: |
48+
if pnpm audit 2>&1 | tee audit1.log | grep -q "found [^0]"; then
49+
echo "vulnerable=true" >> "$GITHUB_OUTPUT"
50+
else
51+
echo "vulnerable=false" >> "$GITHUB_OUTPUT"
52+
fi
53+
54+
- name: No vulnerabilities found — done
55+
if: steps.audit1.outputs.vulnerable == 'false'
56+
run: echo "✅ No vulnerabilities. Nothing to do."
57+
58+
- name: Update dependencies
59+
if: steps.audit1.outputs.vulnerable == 'true'
60+
run: pnpm update
61+
62+
- name: Audit (2nd pass — after update)
63+
if: steps.audit1.outputs.vulnerable == 'true'
64+
id: audit2
65+
run: |
66+
if pnpm audit 2>&1 | tee audit2.log | grep -q "found [^0]"; then
67+
echo "vulnerable=true" >> "$GITHUB_OUTPUT"
68+
else
69+
echo "vulnerable=false" >> "$GITHUB_OUTPUT"
70+
fi
71+
72+
- name: Commit + release after update
73+
if: >
74+
steps.audit1.outputs.vulnerable == 'true' &&
75+
steps.audit2.outputs.vulnerable == 'false'
76+
run: |
77+
git clean -fd
78+
git add pnpm-lock.yaml package.json
79+
[ -f pnpm-workspace.yaml ] && git add pnpm-workspace.yaml
80+
git diff --staged --quiet || git commit -m "chore: update dependencies"
81+
git push
82+
bash scripts/release.sh patch
83+
84+
- name: Audit fix
85+
if: >
86+
steps.audit1.outputs.vulnerable == 'true' &&
87+
steps.audit2.outputs.vulnerable == 'true'
88+
run: |
89+
pnpm audit --fix
90+
pnpm install
91+
92+
- name: Audit (3rd pass — after audit fix)
93+
if: >
94+
steps.audit1.outputs.vulnerable == 'true' &&
95+
steps.audit2.outputs.vulnerable == 'true'
96+
id: audit3
97+
run: |
98+
if pnpm audit 2>&1 | tee audit3.log | grep -q "found [^0]"; then
99+
echo "vulnerable=true" >> "$GITHUB_OUTPUT"
100+
else
101+
echo "vulnerable=false" >> "$GITHUB_OUTPUT"
102+
fi
103+
104+
- name: Commit + release after audit fix
105+
if: >
106+
steps.audit1.outputs.vulnerable == 'true' &&
107+
steps.audit2.outputs.vulnerable == 'true' &&
108+
steps.audit3.outputs.vulnerable == 'false'
109+
run: |
110+
git clean -fd
111+
git add pnpm-lock.yaml package.json
112+
[ -f pnpm-workspace.yaml ] && git add pnpm-workspace.yaml
113+
git diff --staged --quiet || git commit -m "chore: update dependencies"
114+
git push
115+
bash scripts/release.sh patch
116+
117+
- name: Clean reinstall
118+
if: >
119+
steps.audit1.outputs.vulnerable == 'true' &&
120+
steps.audit2.outputs.vulnerable == 'true' &&
121+
steps.audit3.outputs.vulnerable == 'true'
122+
run: |
123+
rm -rf node_modules
124+
[ -f pnpm-lock.yaml ] && rm pnpm-lock.yaml
125+
[ -f pnpm-workspace.yaml ] && rm pnpm-workspace.yaml
126+
pnpm install
127+
128+
- name: Audit (4th pass — after clean reinstall)
129+
if: >
130+
steps.audit1.outputs.vulnerable == 'true' &&
131+
steps.audit2.outputs.vulnerable == 'true' &&
132+
steps.audit3.outputs.vulnerable == 'true'
133+
id: audit4
134+
run: |
135+
if pnpm audit 2>&1 | tee audit4.log | grep -q "found [^0]"; then
136+
echo "vulnerable=true" >> "$GITHUB_OUTPUT"
137+
else
138+
echo "vulnerable=false" >> "$GITHUB_OUTPUT"
139+
fi
140+
141+
- name: Commit + release after clean reinstall
142+
if: >
143+
steps.audit1.outputs.vulnerable == 'true' &&
144+
steps.audit2.outputs.vulnerable == 'true' &&
145+
steps.audit3.outputs.vulnerable == 'true' &&
146+
steps.audit4.outputs.vulnerable == 'false'
147+
run: |
148+
git clean -fd
149+
git add pnpm-lock.yaml package.json
150+
[ -f pnpm-workspace.yaml ] && git add pnpm-workspace.yaml
151+
git diff --staged --quiet || git commit -m "chore: update dependencies"
152+
git push
153+
bash scripts/release.sh patch
154+
155+
# -- Vulnerabilites not resolved: email notification ----------
156+
# - name: Upload audit logs as artifact
157+
# if: >
158+
# steps.audit1.outputs.vulnerable == 'true' &&
159+
# steps.audit2.outputs.vulnerable == 'true' &&
160+
# steps.audit3.outputs.vulnerable == 'true' &&
161+
# steps.audit4.outputs.vulnerable == 'true'
162+
# uses: actions/upload-artifact@v4
163+
# with:
164+
# name: audit-logs
165+
# path: audit*.log
166+
# retention-days: 7
167+
168+
# - name: Send failure email
169+
# if: >
170+
# steps.audit1.outputs.vulnerable == 'true' &&
171+
# steps.audit2.outputs.vulnerable == 'true' &&
172+
# steps.audit3.outputs.vulnerable == 'true' &&
173+
# steps.audit4.outputs.vulnerable == 'true'
174+
# uses: dawidd6/action-send-mail@v3
175+
# with:
176+
# server_address: ${{ secrets.MAIL_SERVER }}
177+
# server_port: ${{ secrets.MAIL_PORT }}
178+
# username: ${{ secrets.MAIL_USERNAME }}
179+
# password: ${{ secrets.MAIL_PASSWORD }}
180+
# subject: "⚠️ vite-plugin-monitor: vulnerabilità non risolvibili automaticamente"
181+
# to: ${{ secrets.MAIL_TO }}
182+
# from: ${{ secrets.MAIL_USERNAME }}
183+
# body: |
184+
# Il workflow di audit giornaliero ha trovato vulnerabilità che non è riuscito
185+
# a risolvere automaticamente dopo tutti i tentativi (update, audit --fix, clean reinstall).
186+
187+
# Repo: ${{ github.repository }}
188+
# Branch: ${{ github.ref_name }}
189+
# Run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
190+
191+
# I log completi sono disponibili come artefatto nella run linkata sopra.
192+
193+
# Intervento manuale richiesto.
194+
# attachments: audit4.log
195+
196+
- name: Fail job if vulnerabilities are unresolved
197+
if: >
198+
steps.audit1.outputs.vulnerable == 'true' &&
199+
steps.audit2.outputs.vulnerable == 'true' &&
200+
steps.audit3.outputs.vulnerable == 'true' &&
201+
steps.audit4.outputs.vulnerable == 'true'
202+
run: |
203+
echo "❌ Vulnerabilities could not be resolved automatically."
204+
cat audit4.log
205+
exit 1

‎scripts/release.sh‎

Lines changed: 35 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,14 @@ fi
4040
CURRENT_BRANCH=$(git branch --show-current)
4141
if [ "$CURRENT_BRANCH" != "main" ] && [ "$CURRENT_BRANCH" != "master" ]; then
4242
echo -e "${YELLOW}⚠️ Warning: Not on main/master branch (current: $CURRENT_BRANCH)${NC}"
43-
read -p "Continue anyway? (y/N) " -n 1 -r
44-
echo
45-
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
46-
exit 1
43+
if [ "$CI" = "true" ]; then
44+
echo -e "${YELLOW}CI mode: continuing without confirmation${NC}"
45+
else
46+
read -p "Continue anyway? (y/N) " -n 1 -r
47+
echo
48+
if [[ ! $REPLY =~ ^[Yy]$ ]]; then
49+
exit 1
50+
fi
4751
fi
4852
fi
4953

@@ -121,18 +125,13 @@ echo -e "${GREEN}✅ Git tag created and pushed${NC}"
121125

122126
# Publish to npm
123127
echo -e "\n${BLUE}📦 Publishing to npm...${NC}"
124-
echo -e "${YELLOW}⚠️ This will publish version $NEW_VERSION to npm${NC}"
125-
read -p "Continue with npm publish? (y/N) " -n 1 -r
126-
echo
127128

128-
if [[ $REPLY =~ ^[Yy]$ ]]; then
129+
if [ "$CI" = "true" ]; then
130+
echo -e "${YELLOW}CI mode: publishing v$NEW_VERSION via trusted publishing (no prompt)${NC}"
129131
pnpm publish --access public --no-git-checks || {
130132
echo -e "${RED}❌ npm publish failed${NC}"
131-
echo -e "${YELLOW}Don't worry, the version bump and git tag are already pushed.${NC}"
132-
echo -e "${YELLOW}You can manually publish later with: pnpm publish --access public${NC}"
133133
exit 1
134134
}
135-
136135
echo -e "\n${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
137136
echo -e "${GREEN}🎉 Release v$NEW_VERSION completed successfully!${NC}"
138137
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
@@ -143,9 +142,31 @@ if [[ $REPLY =~ ^[Yy]$ ]]; then
143142
echo -e "${BLUE}📦 npm: ${YELLOW}https://www.npmjs.com/package/@ndriadev/react-tools${NC}"
144143
echo -e "${BLUE}🏷️ Tag: ${YELLOW}https://github.com/nDriaDev/react-tools/releases/tag/v$NEW_VERSION${NC}"
145144
else
146-
echo -e "\n${YELLOW}⚠️ Skipped npm publish${NC}"
147-
echo -e "${BLUE}Version bump and git tag have been pushed to remote.${NC}"
148-
echo -e "${BLUE}To publish manually later, run: ${YELLOW}pnpm publish --access public${NC}"
145+
echo -e "${YELLOW}⚠️ This will publish version $NEW_VERSION to npm${NC}"
146+
read -p "Continue with npm publish? (y/N) " -n 1 -r
147+
echo
148+
149+
if [[ $REPLY =~ ^[Yy]$ ]]; then
150+
pnpm publish --access public --no-git-checks || {
151+
echo -e "${RED}❌ npm publish failed${NC}"
152+
echo -e "${YELLOW}Don't worry, the version bump and git tag are already pushed.${NC}"
153+
echo -e "${YELLOW}You can manually publish later with: pnpm publish --access public${NC}"
154+
exit 1
155+
}
156+
echo -e "\n${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
157+
echo -e "${GREEN}🎉 Release v$NEW_VERSION completed successfully!${NC}"
158+
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
159+
echo -e "${GREEN}✅ Package published to npm${NC}"
160+
echo -e "${GREEN}✅ Git tag pushed to remote${NC}"
161+
echo -e "${GREEN}✅ Changelog updated${NC}"
162+
echo -e ""
163+
echo -e "${BLUE}📦 npm: ${YELLOW}https://www.npmjs.com/package/@ndriadev/react-tools${NC}"
164+
echo -e "${BLUE}🏷️ Tag: ${YELLOW}https://github.com/nDriaDev/react-tools/releases/tag/v$NEW_VERSION${NC}"
165+
else
166+
echo -e "\n${YELLOW}⚠️ Skipped npm publish${NC}"
167+
echo -e "${BLUE}Version bump and git tag have been pushed to remote.${NC}"
168+
echo -e "${BLUE}To publish manually later, run: ${YELLOW}pnpm publish --access public${NC}"
169+
fi
149170
fi
150171

151172
echo ""

0 commit comments

Comments
 (0)