OpenSAMPL/.github/workflows/dependency-security.yml at main · ORNL/OpenSAMPL · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
name: Dependency security

on:
  push:
    branches: [main]
  pull_request:
    branches: [bugfix/dependabot]
  schedule:
    - cron: "17 9 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:

  ensure-branch:
    runs-on: ubuntu-latest
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Create bugfix branch if missing
        run: |
          if git ls-remote --exit-code --heads origin bugfix/dependabot > /dev/null; then
            echo "bugfix/dependabot already exists"
          else
            git push origin origin/main:refs/heads/bugfix/dependabot
          fi

  audit:
    needs: ensure-branch
    name: Audit locked dependencies
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - name: Install uv with audit support
        uses: astral-sh/setup-uv@v7
        with:
          version: "0.12.21"

      - name: Verify lockfile consistency
        run: uv lock --check

      - name: Audit comprehensive dependency graph
        run: uv audit --locked --preview-features audit-command

      - name: Audit installable dependency subsets
        run: |
          uv audit --locked --preview-features audit-command --no-default-groups --no-extra backend --no-extra migrations --no-extra collect
          uv audit --locked --preview-features audit-command --no-default-groups --no-extra migrations --no-extra collect
          uv audit --locked --preview-features audit-command --no-default-groups --no-extra backend --no-extra collect
          uv audit --locked --preview-features audit-command --only-group dev

      - name: Verify patched security minimums
        run: |
          uv sync --locked --all-extras --all-groups
          uv run python - <<'PY'
          from importlib.metadata import version
          from packaging.version import Version

          minimums = {
              "anyio": "4.14.2",
              "urllib3": "2.8.0",
              "pymdown-extensions": "11.0.1",
              "Mako": "1.4.2",
              "mkdocs-material": "9.7.7",
          }
          for package, minimum in minimums.items():
              installed = version(package)
              assert Version(installed) >= Version(minimum), f"{package} {installed} is below {minimum}"
          PY

      - name: Generate dependency SBOM
        run: uv export --locked --all-extras --all-groups --format cyclonedx1.5 --output-file dependency-sbom.cdx.json

      - name: Upload dependency SBOM
        uses: actions/upload-artifact@v7
        with:
          name: dependency-sbom
          path: dependency-sbom.cdx.json
          if-no-files-found: error