Public Access
README fixes
This commit is contained in:
@@ -13,8 +13,8 @@ to perform an audit for crates with security vulnerabilities.
|
|||||||
### Audit changes
|
### Audit changes
|
||||||
|
|
||||||
We can utilize the GitHub Actions ability to execute workflow
|
We can utilize the GitHub Actions ability to execute workflow
|
||||||
only if [specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
|
only if [the specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
|
||||||
and execute this Action to check the changed dependencies only:
|
and execute this Action to check the changed dependencies:
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
name: Security audit
|
name: Security audit
|
||||||
@@ -33,7 +33,14 @@ jobs:
|
|||||||
token: ${{ secrets.GITHUB_TOKEN }}
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
```
|
```
|
||||||
|
|
||||||
In that case this Action will create a Check with the advisories found:
|
It is recommended to add the `paths:` section into the workflow file,
|
||||||
|
as it would effectively speed up the CI pipeline, since the audit process
|
||||||
|
will not be performed if no dependencies were changed.
|
||||||
|
|
||||||
|
|
||||||
|
In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks)
|
||||||
|
created by this Action will be marked as "failed".\
|
||||||
|
Note that informational advisories are not affecting the check status.
|
||||||
|
|
||||||

|

|
||||||
|
|
||||||
@@ -42,12 +49,13 @@ In that case this Action will create a Check with the advisories found:
|
|||||||
Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),
|
Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),
|
||||||
this Action **WILL NOT** be able to create Checks for Pull Requests from the forked repositories,
|
this Action **WILL NOT** be able to create Checks for Pull Requests from the forked repositories,
|
||||||
see [actions-rs/clippy-check#2](https://github.com/actions-rs/clippy-check/issues/2) for details.\
|
see [actions-rs/clippy-check#2](https://github.com/actions-rs/clippy-check/issues/2) for details.\
|
||||||
As a fallback this Action will output all advisories found to the stdout.
|
As a fallback this Action will output all found advisories to the stdout.\
|
||||||
|
It is expected that this behavior will be fixed later by GitHub.
|
||||||
|
|
||||||
## Scheduled audit
|
## Scheduled audit
|
||||||
|
|
||||||
Another option is to use [`schedule`](https://help.github.com/en/articles/events-that-trigger-workflows#scheduled-events-schedule) event
|
Another option is to use [`schedule`](https://help.github.com/en/articles/events-that-trigger-workflows#scheduled-events-schedule) event
|
||||||
and execute this Action periodically against the repository default branch `HEAD`.
|
and execute this Action periodically against the `HEAD` of repository default branch.
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
name: Security audit
|
name: Security audit
|
||||||
@@ -64,9 +72,9 @@ jobs:
|
|||||||
token: ${{ secrets.GITHUB_TOKEN }}
|
token: ${{ secrets.GITHUB_TOKEN }}
|
||||||
```
|
```
|
||||||
|
|
||||||
With this workflow Action will be executed at midnight on each day
|
With this example Action will be executed periodically at midnight of each day
|
||||||
and check if there any new advisories appear for crate dependencies.\
|
and check if there any new advisories appear for crate dependencies.\
|
||||||
For each such advisory an issue will be created:
|
For each new advisory (including informal) an issue will be created:
|
||||||
|
|
||||||

|

|
||||||
|
|
||||||
@@ -74,4 +82,4 @@ For each such advisory an issue will be created:
|
|||||||
|
|
||||||
| Name | Required | Description | Type | Default |
|
| Name | Required | Description | Type | Default |
|
||||||
| ------------| -------- | -------------------------------------------------------------------------| ------ | --------|
|
| ------------| -------- | -------------------------------------------------------------------------| ------ | --------|
|
||||||
| `token` | ✓ | GitHub token, `${{ secrets.GITHUB_TOKEN }}` | string | |
|
| `token` | ✓ | GitHub token, usually a `${{ secrets.GITHUB_TOKEN }}` | string | |
|
||||||
|
|||||||
Reference in New Issue
Block a user