README fixes

This commit is contained in:
svartalf
2019-10-09 19:51:36 +03:00
parent c02905e0b5
commit 27edb9f4cc
+16 -8
View File
@@ -13,8 +13,8 @@ to perform an audit for crates with security vulnerabilities.
### Audit changes
We can utilize the GitHub Actions ability to execute workflow
only if [specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
and execute this Action to check the changed dependencies only:
only if [the specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
and execute this Action to check the changed dependencies:
```yaml
name: Security audit
@@ -33,7 +33,14 @@ jobs:
token: ${{ secrets.GITHUB_TOKEN }}
```
In that case this Action will create a Check with the advisories found:
It is recommended to add the `paths:` section into the workflow file,
as it would effectively speed up the CI pipeline, since the audit process
will not be performed if no dependencies were changed.
In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks)
created by this Action will be marked as "failed".\
Note that informational advisories are not affecting the check status.
![Check screenshot](.github/check_screenshot.png)
@@ -42,12 +49,13 @@ In that case this Action will create a Check with the advisories found:
Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),
this Action **WILL NOT** be able to create Checks for Pull Requests from the forked repositories,
see [actions-rs/clippy-check#2](https://github.com/actions-rs/clippy-check/issues/2) for details.\
As a fallback this Action will output all advisories found to the stdout.
As a fallback this Action will output all found advisories to the stdout.\
It is expected that this behavior will be fixed later by GitHub.
## Scheduled audit
Another option is to use [`schedule`](https://help.github.com/en/articles/events-that-trigger-workflows#scheduled-events-schedule) event
and execute this Action periodically against the repository default branch `HEAD`.
and execute this Action periodically against the `HEAD` of repository default branch.
```yaml
name: Security audit
@@ -64,9 +72,9 @@ jobs:
token: ${{ secrets.GITHUB_TOKEN }}
```
With this workflow Action will be executed at midnight on each day
With this example Action will be executed periodically at midnight of each day
and check if there any new advisories appear for crate dependencies.\
For each such advisory an issue will be created:
For each new advisory (including informal) an issue will be created:
![Issue screenshot](.github/issue_screenshot.png)
@@ -74,4 +82,4 @@ For each such advisory an issue will be created:
| Name | Required | Description | Type | Default |
| ------------| -------- | -------------------------------------------------------------------------| ------ | --------|
| `token` | ✓ | GitHub token, `${{ secrets.GITHUB_TOKEN }}` | string | |
| `token` | ✓ | GitHub token, usually a `${{ secrets.GITHUB_TOKEN }}` | string | |