distroless-buildpack-builder-java-tiny/.github/workflows/dependency-policy-review.yml at main · patbaumgartner/distroless-buildpack-builder-java-tiny · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: Dependency Policy Review

on:
  schedule:
    - cron: "0 8 1 */3 *"
  workflow_dispatch:

permissions:
  issues: write

jobs:
  dependency-review:
    name: Dependency Policy Review
    runs-on: ubuntu-latest
    steps:
      - name: Check for existing open issue
        id: check
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const issues = await github.rest.issues.listForRepo({
              owner: context.repo.owner,
              repo: context.repo.repo,
              state: 'open',
              labels: 'governance',
              per_page: 1,
            });
            core.setOutput('exists', issues.data.length > 0 ? 'true' : 'false');

      - name: Create audit checklist issue
        if: steps.check.outputs.exists == 'false'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            const today = new Date().toISOString().slice(0, 10);
            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `Quarterly Dependency & Governance Review – ${today}`,
              labels: ['governance', 'dependencies'],
              body: [
                '## Quarterly Dependency & Governance Audit',
                '',
                '### Base Images',
                '- [ ] Verify `ubuntu:24.04` build stack is on latest patch',
                '- [ ] Verify `gcr.io/distroless/cc:nonroot` run stack digest',
                '- [ ] Check for upstream distroless CVE advisories',
                '',
                '### Buildpacks & Lifecycle',
                '- [ ] Review Paketo Java buildpack release notes',
                '- [ ] Review CNB lifecycle release notes',
                '- [ ] Validate `builder.toml` versions are current',
                '',
                '### GitHub Actions',
                '- [ ] Audit all pinned action SHAs against latest releases',
                '- [ ] Review Dependabot / Renovate PR backlog',
                '',
                '### Supply Chain',
                '- [ ] Review OSSF Scorecard results',
                '- [ ] Check Trivy scan history for recurring findings',
                '- [ ] Verify SBOM generation is operational',
                '',
                '### Samples',
                '- [ ] Confirm Spring Boot version is current',
                '- [ ] Confirm JDK version aligns with project policy',
                '',
                '---',
                `_Auto-generated by Dependency Policy Review workflow on ${today}_`,
              ].join('\n'),
            });