Dependency Check #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependency Check | |
| on: | |
| schedule: | |
| - cron: "0 2 * * 0" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| dependency-check: | |
| name: Check Dependencies for Vulnerabilities | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.25" | |
| cache: true | |
| - name: Check for outdated dependencies | |
| id: outdated | |
| continue-on-error: true | |
| run: | | |
| echo "=== Checking for outdated dependencies ===" | |
| go list -m -u all > outdated.txt | |
| cat outdated.txt | |
| echo "outdated_deps=$(cat outdated.txt | grep -c '\[')" >> $GITHUB_OUTPUT | |
| - name: Run govulncheck | |
| id: vulncheck | |
| continue-on-error: true | |
| run: | | |
| go install github.com/golang/vuln/cmd/govulncheck@latest | |
| govulncheck ./... | tee vuln-report.txt | |
| - name: Check for vulnerable dependencies | |
| id: vuln_status | |
| run: | | |
| if [ $? -ne 0 ]; then | |
| echo "vulnerable=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "vulnerable=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create issue if vulnerabilities found | |
| if: failure() || steps.vuln_status.outputs.vulnerable == 'true' | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const fs = require('fs'); | |
| let body = '## Dependency Vulnerability Report\n\n'; | |
| body += 'Scheduled security check found vulnerabilities or outdated dependencies.\n\n'; | |
| if (fs.existsSync('vuln-report.txt')) { | |
| body += '### Vulnerability Report\n\n```\n'; | |
| body += fs.readFileSync('vuln-report.txt', 'utf8'); | |
| body += '\n```\n\n'; | |
| } | |
| if (fs.existsSync('outdated.txt')) { | |
| body += '### Outdated Dependencies\n\n```\n'; | |
| body += fs.readFileSync('outdated.txt', 'utf8'); | |
| body += '\n```\n\n'; | |
| } | |
| body += '**Action required:** Review and update dependencies as needed.\n'; | |
| body += 'Maintainers: Please assess impact and plan updates.\n'; | |
| github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: 'Security: Vulnerable or outdated dependencies detected', | |
| body: body, | |
| labels: ['security', 'dependencies'], | |
| assignees: [] | |
| }); |