| name: Third party deps scan |
| |
| on: |
| # Only the default branch is supported. |
| branch_protection_rule: |
| push: |
| branches: [ main ] |
| pull_request: |
| types: [ labeled ] |
| |
| # Declare default permissions as read only. |
| permissions: read-all |
| |
| jobs: |
| extract-deps: |
| name: Extract Dependencies |
| runs-on: ubuntu-20.04 |
| if: ${{ (github.repository == 'dart-lang/sdk' && github.event_name == 'push') || github.event.label.name == 'vulnerability scan' }} |
| permissions: |
| # Needed to upload the SARIF results to code-scanning dashboard. |
| security-events: write |
| contents: read |
| steps: |
| - name: "Checkout code" |
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 |
| with: |
| persist-credentials: false |
| - name: "setup python" |
| uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f |
| with: |
| python-version: '3.7.7' # install the python version needed |
| - name: "extract deps, find commit hash, pass to osv-scanner" |
| run: python .github/extract_deps.py --output osv-lockfile-${{github.sha}}.json |
| - name: "upload osv-scanner deps" |
| uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b |
| with: |
| # use github.ref in name to avoid duplicated artifacts |
| name: osv-lockfile-${{github.sha}} |
| path: osv-lockfile-${{github.sha}}.json |
| retention-days: 2 |
| vuln-scan: |
| name: Vulnerability scanning |
| needs: |
| extract-deps |
| uses: "google/osv-scanner/.github/workflows/osv-scanner-reusable.yml@main" |
| with: |
| # Download the artifact uploaded in extract-deps step |
| download-artifact: osv-lockfile-${{github.sha}} |
| scan-args: |- |
| --lockfile=osv-scanner:osv-lockfile-${{github.sha}}.json |
| fail-on-vuln: false |
| # makes sure the osv-formatted vulns are uploaded |
| permissions: |
| # Needed to upload the SARIF results to code-scanning dashboard. |
| security-events: write |
| contents: read |