Bump vulnerable dependencies #89
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Bump vulnerable dependencies | |
| on: | |
| schedule: | |
| # Run daily at 05:30 UTC, just after the Go toolchain bumper. | |
| - cron: "30 5 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| # Required by setup-jfrog (GOPROXY exchange). | |
| id-token: write | |
| jobs: | |
| bump-vuln-deps: | |
| runs-on: | |
| group: databricks-protected-runner-group-large | |
| labels: linux-ubuntu-latest-large | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup JFrog | |
| uses: ./.github/actions/setup-jfrog | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| # vulnbump lives in the tools module, which is what this job compiles. | |
| go-version-file: tools/go.mod | |
| - name: Build vulnbump | |
| run: go -C tools/vulnbump build -o "$RUNNER_TEMP/vulnbump" . | |
| - name: Bump vulnerable dependencies | |
| id: bump | |
| run: | | |
| set -euo pipefail | |
| # govulncheck is pinned as a tool dependency in tools/go.mod; -modfile | |
| # resolves it from there while it scans the root module (the working | |
| # directory). Only the root module ships; tools/ and | |
| # bundle/internal/tf/codegen are build- and CI-only, so they are not | |
| # scanned. Its vulnerability database is fetched from vuln.go.dev at | |
| # runtime, so the pinned binary still uses the latest advisories. | |
| # | |
| # -scan module reports every advisory affecting a required module, | |
| # regardless of whether the vulnerable symbol is reachable. In JSON | |
| # mode govulncheck exits 0 on success whether or not it finds anything, | |
| # and non-zero only on a real error; a failure must abort the job | |
| # rather than be silently mistaken for "no vulnerabilities". | |
| scan="$(mktemp)" | |
| go tool -modfile=tools/go.mod govulncheck -scan module -format json > "$scan" | |
| summary_file="$(mktemp)" | |
| "$RUNNER_TEMP/vulnbump" . < "$scan" > "$summary_file" | |
| if git diff --quiet; then | |
| echo "No vulnerable dependencies to bump." | |
| echo "needed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "needed=true" >> "$GITHUB_OUTPUT" | |
| { | |
| echo "summary<<SUMMARY_EOF" | |
| cat "$summary_file" | |
| echo "SUMMARY_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Show diff | |
| if: steps.bump.outputs.needed == 'true' | |
| run: git diff | |
| - name: Create pull request | |
| if: steps.bump.outputs.needed == 'true' | |
| uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1 | |
| with: | |
| # A fixed branch means a daily run updates the existing open PR in | |
| # place rather than opening a new one; no branch-suffix is needed. | |
| branch: auto/bump-vuln-deps | |
| commit-message: "Bump dependencies with known vulnerabilities" | |
| title: "Bump dependencies with known vulnerabilities" | |
| body: | | |
| Bump dependencies flagged by `govulncheck -scan module` to their fixed versions. | |
| Each CVE links to its Go advisory page. | |
| ${{ steps.bump.outputs.summary }} | |
| Vulnerabilities in the Go standard library are left to the `Bump Go toolchain` workflow. | |
| If a bump promotes a new direct dependency, double-check its license annotation in `go.mod` and `NOTICE`. | |
| reviewers: simonfaltum,andrewnester,anton-107,denik,janniklasrose,pietern,shreyas-goenka | |
| labels: dependencies |