42 lines
1.1 KiB
YAML
42 lines
1.1 KiB
YAML
name: vulnix
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 6 * * 1"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: nix
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: cachix/install-nix-action@v31
|
|
with:
|
|
extra_nix_config: |
|
|
experimental-features = nix-command flakes
|
|
|
|
- name: scan host closures
|
|
id: scan
|
|
run: echo "count=$(nix run .#ci -- vulnix . "$RUNNER_TEMP/issue.md")" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: file/update issue
|
|
if: steps.scan.outputs.count != '0'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
API: ${{ github.api_url }}
|
|
REPO: ${{ github.repository }}
|
|
run: nix run .#ci -- upsert-issue vulnix "vulnix: known vulnerabilities in system closure" "$RUNNER_TEMP/issue.md"
|
|
|
|
- name: close resolved issue
|
|
if: steps.scan.outputs.count == '0'
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
API: ${{ github.api_url }}
|
|
REPO: ${{ github.repository }}
|
|
run: nix run .#ci -- close-issue vulnix
|