Public Access
README fixes
This commit is contained in:
@@ -13,8 +13,8 @@ to perform an audit for crates with security vulnerabilities.
|
||||
### Audit changes
|
||||
|
||||
We can utilize the GitHub Actions ability to execute workflow
|
||||
only if [specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
|
||||
and execute this Action to check the changed dependencies only:
|
||||
only if [the specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths)
|
||||
and execute this Action to check the changed dependencies:
|
||||
|
||||
```yaml
|
||||
name: Security audit
|
||||
@@ -33,7 +33,14 @@ jobs:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
```
|
||||
|
||||
In that case this Action will create a Check with the advisories found:
|
||||
It is recommended to add the `paths:` section into the workflow file,
|
||||
as it would effectively speed up the CI pipeline, since the audit process
|
||||
will not be performed if no dependencies were changed.
|
||||
|
||||
|
||||
In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks)
|
||||
created by this Action will be marked as "failed".\
|
||||
Note that informational advisories are not affecting the check status.
|
||||
|
||||

|
||||
|
||||
@@ -42,12 +49,13 @@ In that case this Action will create a Check with the advisories found:
|
||||
Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),
|
||||
this Action **WILL NOT** be able to create Checks for Pull Requests from the forked repositories,
|
||||
see [actions-rs/clippy-check#2](https://github.com/actions-rs/clippy-check/issues/2) for details.\
|
||||
As a fallback this Action will output all advisories found to the stdout.
|
||||
As a fallback this Action will output all found advisories to the stdout.\
|
||||
It is expected that this behavior will be fixed later by GitHub.
|
||||
|
||||
## Scheduled audit
|
||||
|
||||
Another option is to use [`schedule`](https://help.github.com/en/articles/events-that-trigger-workflows#scheduled-events-schedule) event
|
||||
and execute this Action periodically against the repository default branch `HEAD`.
|
||||
and execute this Action periodically against the `HEAD` of repository default branch.
|
||||
|
||||
```yaml
|
||||
name: Security audit
|
||||
@@ -64,9 +72,9 @@ jobs:
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
```
|
||||
|
||||
With this workflow Action will be executed at midnight on each day
|
||||
With this example Action will be executed periodically at midnight of each day
|
||||
and check if there any new advisories appear for crate dependencies.\
|
||||
For each such advisory an issue will be created:
|
||||
For each new advisory (including informal) an issue will be created:
|
||||
|
||||

|
||||
|
||||
@@ -74,4 +82,4 @@ For each such advisory an issue will be created:
|
||||
|
||||
| Name | Required | Description | Type | Default |
|
||||
| ------------| -------- | -------------------------------------------------------------------------| ------ | --------|
|
||||
| `token` | ✓ | GitHub token, `${{ secrets.GITHUB_TOKEN }}` | string | |
|
||||
| `token` | ✓ | GitHub token, usually a `${{ secrets.GITHUB_TOKEN }}` | string | |
|
||||
|
||||
Reference in New Issue
Block a user