openseries/.github/workflows/supply-chain.yml at master · CaptorAB/openseries · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
name: supply-chain.yml

permissions:
  contents: read
  actions: read  # Required for setup-uv and other actions to read action metadata
  pull-requests: read  # Required to list PR files for path filtering

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
  UV_VERSION: "0.12.10"
  UV_PROJECT_ENVIRONMENT: venv
  PIP_AUDIT_VERSION: "2.10.1"

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.ref }}
  cancel-in-progress: true

on:
  workflow_dispatch: {}
  pull_request:
    branches: [master]
  schedule:
    - cron: "15 6 * * 1"

jobs:
  lockfile:
    name: Verify lockfile
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Filter paths
        id: paths
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: bash scripts/ci-pr-paths.sh
          'uv.lock'
          'pyproject.toml'
          '.github/workflows/supply-chain.yml'
          'scripts/ci-pr-paths.sh'

      - name: Set up uv
        if: ${{ steps.paths.outputs.run == 'true' }}
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: ${{ env.UV_VERSION }}

      - name: Check uv.lock is up to date
        if: ${{ steps.paths.outputs.run == 'true' }}
        run: uv lock --check

  osv-scanner:
    name: OSV dependency scan
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Filter paths
        id: paths
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: bash scripts/ci-pr-paths.sh
          'uv.lock'
          'pyproject.toml'
          '.github/workflows/supply-chain.yml'
          'scripts/ci-pr-paths.sh'

      - name: Run OSV-Scanner
        if: ${{ steps.paths.outputs.run == 'true' }}
        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
        with:
          scan-args: --lockfile=uv.lock

  pip-audit:
    name: pip-audit dependency scan
    needs: lockfile
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Filter paths
        id: paths
        env:
          GH_TOKEN: ${{ github.token }}
          GITHUB_EVENT_NAME: ${{ github.event_name }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: bash scripts/ci-pr-paths.sh
          'uv.lock'
          'pyproject.toml'
          '.github/workflows/supply-chain.yml'
          'scripts/ci-pr-paths.sh'

      - name: Set up Python
        if: ${{ steps.paths.outputs.run == 'true' }}
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version-file: .python-version

      - name: Set up uv
        if: ${{ steps.paths.outputs.run == 'true' }}
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: ${{ env.UV_VERSION }}

      - name: Sync dependencies (locked)
        if: ${{ steps.paths.outputs.run == 'true' }}
        run: uv sync --locked --extra dev

      - name: Export requirements for pip-audit
        if: ${{ steps.paths.outputs.run == 'true' }}
        run: uv export --locked --extra dev --no-emit-project -o requirements-audit.txt

      - name: Run pip-audit
        if: ${{ steps.paths.outputs.run == 'true' }}
        env:
          PIP_AUDIT_VERSION: ${{ env.PIP_AUDIT_VERSION }}
        run: uvx pip-audit==${PIP_AUDIT_VERSION} -r requirements-audit.txt