fix: Docs repo

* chore: Dependency bumps

Co-authored-by: Dirk Stolle <striezel-dev@web.de>

* fix stuff

* fix more stuff

* patch lock

* Node 16

---------

Co-authored-by: Dirk Stolle <striezel-dev@web.de>

.eslintrc.json

@@ -6,14 +6,17 @@
     "parserOptions": {
         "project": "./tsconfig.json"
     },
-    "plugins": ["@typescript-eslint"],
+    "plugins": [
+        "@typescript-eslint"
+    ],
     "extends": [
         "eslint:recommended",
         "plugin:@typescript-eslint/eslint-recommended",
         "plugin:@typescript-eslint/recommended-requiring-type-checking",
         "plugin:@typescript-eslint/recommended",
         "plugin:prettier/recommended",
-        "prettier"
+        "prettier",
+        "prettier/@typescript-eslint"
     ],
     "rules": {
         "@typescript-eslint/explicit-function-return-type": 0

.github/workflows/ci.yml

@@ -6,16 +6,10 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - name: Create npm configuration
-        run: echo "//npm.pkg.github.com/:_authToken=${token}" >> ~/.npmrc
-        env:
-          token: ${{ secrets.GH_TOKEN }}
-
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
         with:
-          node-version-file: '.nvmrc'
-          cache: 'npm'
+          node-version: 16
       - run: npm ci
 # octokit types problem ?
 #      - run: npm run lint

.npmrc

@@ -1 +1 @@
-@clechasseur:registry=https://npm.pkg.github.com
+@actions-rs:registry=https://npm.pkg.github.com

.nvmrc

@@ -1 +1 @@
-v20
+v16

CHANGELOG.md

@@ -5,24 +5,6 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
-
-### Changed
-
-- Update the GitHub Action runtime and local Node tooling target to Node 24.
-
-## [1.4.1] - 2023-04-04
-
-### Fixed
-
-- Corrected reporting on `unsound` and `notice` informationals
-
-## [1.4.0] - 2023-04-04
-
-### Fixed
-
-- Reflect change to enable warning on `unsound` and `notice` informationals
-
 ## [1.3.2] - 2023-03-13
 
 ### Changed

README.md

@@ -1,6 +1,7 @@
 # Rust `audit-check` Action
 
 ![MIT licensed](https://img.shields.io/badge/license-MIT-blue.svg)
+[![Gitter](https://badges.gitter.im/actions-rs/community.svg)](https://gitter.im/actions-rs/community)
 
 > Security vulnerabilities audit
 
@@ -26,8 +27,8 @@ jobs:
   security_audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: actions/checkout@v3
+      - uses: rustsec/audit-check@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -36,33 +37,13 @@ It is recommended to add the `paths:` section into the workflow file,
 as it would effectively speed up the CI pipeline, since the audit process
 will not be performed if no dependencies were changed.
 
+
 In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks)
 created by this Action will be marked as "failed".\
 Note that informational advisories are not affecting the check status.
 
 ![Check screenshot](.github/check_screenshot.png)
 
-#### Granular Permissions
-
-These are the typically used permissions:
-
-```yaml
-name: 'rust-audit-check'
-github-token:
-  action-input:
-    input: token
-    is-default: false
-  permissions:
-    issues: write
-    issues-reason: to create issues
-    checks: write
-    checks-reason: to create check
-```
-
-This action only raises issues when it's triggered from a `cron` scheduled workflow or on manual `workflow_dispatch`
-
-When running the action as scheduled it will create issues but e.g. in PR / push fails the action.
-
 #### Limitations
 
 Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions),
@@ -85,8 +66,8 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: rustsec/audit-check@v2.0.0
+      - uses: actions/checkout@v3
+      - uses: actions-rs/audit-check@v1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -103,27 +84,5 @@ For each new advisory (including informal) an issue will be created:
 | ------------| -------- | ---------------------------------------------------------------------------| ------ | --------|
 | `token`     | ✓        | [GitHub token], usually a `${{ secrets.GITHUB_TOKEN }}`                    | string |         |
 | `ignore`    |          | Comma-separated list of advisory ids to ignore                             | string |         |
-| `working-directory`|   | The directory of the Cargo.toml / Cargo.lock files to scan.                | string | `.`     |
-| `new-issue-labels` |   | Comma-separated list of Labes to be added to new issues                    | string | `.`     |
 
 [GitHub token]: https://help.github.com/en/actions/configuring-and-managing-workflows/authenticating-with-the-github_token
-
-## Contribute
-
-### Setting up npm login
-
-This repo uses some npm packages hosted on github.
-To be able to pull these you need to:
-
-1. Under <https://github.com/settings/tokens> - create a `personal access token (classic)` with `read:packages` scope
-
-2. Authenticate to the github npm registry
-
-```sh
-npm login --scope=@clechasseur --auth-type=legacy --registry=https://npm.pkg.github.com
-```
-
-```txt
-Username = Github Username
-Password = Token
-```

action.yml

@@ -11,11 +11,7 @@ inputs:
   ignore:
     description: Comma-separated list of advisory ids to ignore
     required: false
-  working-directory:
-    description: The directory of the Cargo.toml / Cargo.lock files to scan.
-    required: false
-    default: .
 
 runs:
-  using: 'node24'
+  using: 'node16'
   main: 'dist/index.js'

package.json

@@ -1,6 +1,6 @@
 {
     "name": "rust-audit-check",
-    "version": "2.0.0",
+    "version": "1.3.2",
     "private": false,
     "description": "Security audit for security vulnerabilities",
     "main": "lib/main.js",
@@ -18,7 +18,7 @@
     },
     "repository": {
         "type": "git",
-        "url": "github:rustsec/audit-check"
+        "url": "git+https://github.com/actions-rs/audit.git"
     },
     "keywords": [
         "actions",
@@ -31,29 +31,29 @@
     "author": "actions-rs",
     "license": "MIT",
     "bugs": {
-        "url": "https://github.com/rustsec/audit-check/issues"
+        "url": "https://github.com/actions-rs/audit-check/issues"
     },
     "dependencies": {
-        "@actions/core": "^1.11.1",
-        "@actions/github": "^6.0.1",
-        "@clechasseur/rs-actions-core": "^3.0.5",
-        "gitea-js": "^1.23.0",
-        "nunjucks": "^3.2.4"
+        "@rinse-repeat/actions-rs-core": "0.1.8",
+        "@actions/core": "^1.2.6",
+        "@actions/github": "^5.1.0",
+        "npm-check-updates": "^16.8.0",
+        "nunjucks": "^3.2.3"
     },
     "devDependencies": {
-        "@types/jest": "^29.5.12",
-        "@types/node": "^24.0.0",
-        "@types/nunjucks": "^3.2.4",
-        "@typescript-eslint/eslint-plugin": "^6.21.0",
-        "@typescript-eslint/parser": "^6.21.0",
-        "@vercel/ncc": "0.38.1",
-        "eslint": "^8.56.0",
-        "eslint-config-prettier": "^9.1.0",
-        "eslint-plugin-prettier": "^5.1.3",
-        "jest": "^29.7.0",
-        "prettier": "^3.2.5",
-        "ts-jest": "^29.1.2",
-        "ts-node": "^10.9.2",
-        "typescript": "^5.3.3"
+        "@typescript-eslint/eslint-plugin": "^5.56.0",
+        "ts-node": "^10.9.1",
+        "@typescript-eslint/parser": "^5.56.0",
+        "eslint": "^8.36.0",
+        "eslint-config-prettier": "^6.11.0",
+        "eslint-plugin-prettier": "^3.1.3",
+        "@types/jest": "^26.0.1",
+        "@types/node": "^16.11.7",
+        "@vincentriemer/ncc": "^0.20.5",
+        "jest": "^26.0.1",
+        "jest-circus": "^26.0.1",
+        "ts-jest": "^26.0.1",
+        "typescript": "^3.8.3",
+        "prettier": "^2.0.5"
     }
 }

src/input.ts

@@ -2,24 +2,18 @@
  * Parse action input into a some proper thing.
  */
 
-import { input } from '@clechasseur/rs-actions-core';
+import { input } from '@rinse-repeat/actions-rs-core';
+import { getInputList } from '@rinse-repeat/actions-rs-core/dist/input';
 
 // Parsed action input
 export interface Input {
     token: string;
     ignore: string[];
-    new_issue_labels: string[];
-    workingDirectory: string;
 }
 
 export function get(): Input {
     return {
         token: input.getInput('token', { required: true }),
-        ignore: input.getInputList('ignore', { required: false }),
-        new_issue_labels: input.getInputList('new-issue-labels', {
-            required: false,
-        }),
-        workingDirectory:
-            input.getInput('working-directory', { required: false }) ?? '.',
+        ignore: getInputList('ignore', { required: false }),
     };
 }

src/main.ts

@@ -1,10 +1,10 @@
-import * as os from 'os';
 import * as process from 'process';
+import * as os from 'os';
 
 import * as core from '@actions/core';
 import * as github from '@actions/github';
 
-import { Cargo } from '@clechasseur/rs-actions-core';
+import { Cargo } from '@rinse-repeat/actions-rs-core';
 
 import * as input from './input';
 import * as interfaces from './interfaces';
@@ -12,11 +12,12 @@ import * as reporter from './reporter';
 
 async function getData(
     ignore: string[] | undefined,
-    workingDirectory: string,
 ): Promise<interfaces.Report> {
     const cargo = await Cargo.get();
     await cargo.findOrInstall('cargo-audit');
 
+    await cargo.call(['generate-lockfile']);
+
     let stdout = '';
     try {
         core.startGroup('Calling cargo-audit (JSON output)');
@@ -25,7 +26,6 @@ async function getData(
             commandArray.push('--ignore', item);
         }
         commandArray.push('--json');
-        commandArray.push('--file', `${workingDirectory}/Cargo.lock`);
         await cargo.call(commandArray, {
             ignoreReturnCode: true,
             listeners: {
@@ -46,18 +46,9 @@ async function getData(
     return JSON.parse(stdout);
 }
 
-function removeTrailingSlash(str) {
-    if (str[str.length - 1] === '/') {
-        return str.substr(0, str.length - 1);
-    }
-    return str;
-}
-
 export async function run(actionInput: input.Input): Promise<void> {
-    const labels = actionInput.new_issue_labels;
     const ignore = actionInput.ignore;
-    const workingDirectory = removeTrailingSlash(actionInput.workingDirectory);
-    const report = await getData(ignore, workingDirectory);
+    const report = await getData(ignore);
     let shouldReport = false;
     if (!report.vulnerabilities.found) {
         core.info('No vulnerabilities were found');
@@ -91,19 +82,11 @@ export async function run(actionInput: input.Input): Promise<void> {
 
     // const octokit = github.getOctokit(actionInput.token, {userAgent: USER_AGENT});
     const advisories = report.vulnerabilities.list;
-    if (
-        github.context.eventName == 'schedule' ||
-        github.context.eventName == 'workflow_dispatch'
-    ) {
+    if (github.context.eventName == 'schedule') {
         core.debug(
             'Action was triggered on a schedule event, creating an Issues report',
         );
-        await reporter.reportIssues(
-            actionInput.token,
-            advisories,
-            warnings,
-            labels,
-        );
+        await reporter.reportIssues(actionInput.token, advisories, warnings);
     } else {
         core.debug(
             `Action was triggered on a ${github.context.eventName} event, creating a Check report`,
@@ -117,7 +100,7 @@ async function main(): Promise<void> {
         const actionInput = input.get();
         await run(actionInput);
     } catch (error) {
-        core.setFailed((error as Error).message);
+        core.setFailed(error.message);
     }
 
     return;

src/reporter.ts

@@ -4,15 +4,17 @@ import * as core from '@actions/core';
 import * as github from '@actions/github';
 import * as nunjucks from 'nunjucks';
 
+import { checks } from '@rinse-repeat/actions-rs-core';
 import * as interfaces from './interfaces';
 import * as templates from './templates';
-import { giteaApi } from 'gitea-js';
+
+const pkg = require('../package.json'); // eslint-disable-line @typescript-eslint/no-var-requires
+const USER_AGENT = `${pkg.name}/${pkg.version} (${pkg.bugs.url})`;
 
 interface Stats {
     critical: number;
     notices: number;
     unmaintained: number;
-    unsound: number;
     other: number;
 }
 
@@ -35,20 +37,6 @@ function makeReport(
                 });
                 break;
 
-            case 'unsound':
-                preparedWarnings.push({
-                    advisory: warning.advisory,
-                    package: warning.package,
-                });
-                break;
-
-            case 'notice':
-                preparedWarnings.push({
-                    advisory: warning.advisory,
-                    package: warning.package,
-                });
-                break;
-
             case 'informational':
                 preparedWarnings.push({
                     advisory: warning.advisory,
@@ -87,7 +75,6 @@ function getStats(
     let critical = 0;
     let notices = 0;
     let unmaintained = 0;
-    let unsound = 0;
     let other = 0;
     for (const vulnerability of vulnerabilities) {
         switch (vulnerability.advisory.informational) {
@@ -97,9 +84,6 @@ function getStats(
             case 'unmaintained':
                 unmaintained += 1;
                 break;
-            case 'unsound':
-                unsound += 1;
-                break;
             case null:
                 critical += 1;
                 break;
@@ -115,10 +99,6 @@ function getStats(
                 unmaintained += 1;
                 break;
 
-            case 'unsound':
-                unsound += 1;
-                break;
-
             default:
                 // Both yanked and informational types of kind
                 other += 1;
@@ -130,7 +110,6 @@ function getStats(
         critical: critical,
         notices: notices,
         unmaintained: unmaintained,
-        unsound: unsound,
         other: other,
     };
 }
@@ -139,7 +118,8 @@ function getSummary(stats: Stats): string {
     const blocks: string[] = [];
 
     if (stats.critical > 0) {
-        blocks.push(`${stats.critical} advisories`);
+        // TODO: Plural
+        blocks.push(`${stats.critical} advisory(ies)`);
     }
     if (stats.notices > 0) {
         blocks.push(`${stats.notices} notice${plural(stats.notices)}`);
@@ -147,9 +127,6 @@ function getSummary(stats: Stats): string {
     if (stats.unmaintained > 0) {
         blocks.push(`${stats.unmaintained} unmaintained`);
     }
-    if (stats.unsound > 0) {
-        blocks.push(`${stats.unsound} unsound`);
-    }
     if (stats.other > 0) {
         blocks.push(`${stats.other} other`);
     }
@@ -163,22 +140,15 @@ export async function reportCheck(
     vulnerabilities: Array<interfaces.Vulnerability>,
     warnings: Array<interfaces.Warning>,
 ): Promise<void> {
-    const { owner, repo } = github.context.repo;
-    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
+    const client = github.getOctokit(token, {userAgent: USER_AGENT});
+    const reporter = new checks.CheckReporter(client.rest, 'Security audit');
     const stats = getStats(vulnerabilities, warnings);
     const summary = getSummary(stats);
-    const body = {
-        description: 'Security Audit',
-        context: 'security-audit',
-    };
 
     core.info(`Found ${summary}`);
 
     try {
-        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
-            ...body,
-            state: 'pending',
-        });
+        await reporter.startCheck('queued');
     } catch (error) {
         // `GITHUB_HEAD_REF` is set only for forked repos,
         // so we can check if it is a fork and not a base repo.
@@ -209,22 +179,16 @@ See https://github.com/actions-rs/clippy-check/issues/2 for details.`);
     }
 
     try {
-        // const body = makeReport(vulnerabilities, warnings);
-        // const output = {
-        //     title: 'Security advisories found',
-        //     summary: summary,
-        //     text: body,
-        // };
-        const state = stats.critical > 0 ? 'failure' : 'success';
-        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
-            ...body,
-            state,
-        });
+        const body = makeReport(vulnerabilities, warnings);
+        const output = {
+            title: 'Security advisories found',
+            summary: summary,
+            text: body,
+        };
+        const status = stats.critical > 0 ? 'failure' : 'success';
+        await reporter.finishCheck(status, output);
     } catch (error) {
-        await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
-            ...body,
-            state: 'error',
-        });
+        await reporter.cancelCheck();
         throw error;
     }
 
@@ -245,13 +209,13 @@ async function alreadyReported(
     advisoryId: string,
 ): Promise<boolean> {
     const { owner, repo } = github.context.repo;
-    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
-    const results = await api.repos.issueListIssues(owner, repo, {
-        q: advisoryId,
-        limit: 1,
+    const client = github.getOctokit(token, {userAgent: USER_AGENT});
+    const results = await client.rest.search.issuesAndPullRequests({
+        q: `${advisoryId} in:title repo:${owner}/${repo}`,
+        per_page: 1, // eslint-disable-line @typescript-eslint/camelcase
     });
 
-    if (results.data.length > 0) {
+    if (results.data.total_count > 0) {
         core.info(
             `Seems like ${advisoryId} is mentioned already in the issues/PRs, \
 will not report an issue against it`,
@@ -266,11 +230,10 @@ export async function reportIssues(
     token: string,
     vulnerabilities: Array<interfaces.Vulnerability>,
     warnings: Array<interfaces.Warning>,
-    labels: string[],
 ): Promise<void> {
     const { owner, repo } = github.context.repo;
 
-    const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
+    const client = github.getOctokit(token, {userAgent: USER_AGENT});
 
     for (const vulnerability of vulnerabilities) {
         const reported = await alreadyReported(
@@ -284,13 +247,12 @@ export async function reportIssues(
         const body = nunjucks.renderString(templates.VULNERABILITY_ISSUE, {
             vulnerability: vulnerability,
         });
-        const issue = await api.repos.issueCreateIssue(owner, repo, {
+        const issue = await client.rest.issues.create({
+            owner: owner,
+            repo: repo,
             title: `${vulnerability.advisory.id}: ${vulnerability.advisory.title}`,
-            body,
+            body: body,
         });
-        for (const label of labels) {
-            core.warning(`Unable to add label ${label}`);
-        }
         core.info(
             `Created an issue for ${vulnerability.advisory.id}: ${issue.data.html_url}`,
         );
@@ -299,8 +261,6 @@ export async function reportIssues(
     for (const warning of warnings) {
         let advisory: interfaces.Advisory;
         switch (warning.kind) {
-            case 'unsound':
-            case 'notice':
             case 'unmaintained':
             case 'informational':
                 advisory = warning.advisory;
@@ -326,13 +286,12 @@ export async function reportIssues(
             warning: warning,
             advisory: advisory,
         });
-        const issue = await api.repos.issueCreateIssue(owner, repo, {
+        const issue = await client.rest.issues.create({
+            owner: owner,
+            repo: repo,
             title: `${advisory.id}: ${advisory.title}`,
-            body,
+            body: body,
         });
-        for (const label of labels) {
-            core.warning(`Unable to add label ${label}`);
-        }
         core.info(
             `Created an issue for ${advisory.id}: ${issue.data.html_url}`,
         );