Dependencies #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Dependencies | |
| on: | |
| schedule: | |
| # Run every Monday at 8 AM UTC | |
| - cron: '0 8 * * 1' | |
| workflow_dispatch: | |
| jobs: | |
| update-dependencies: | |
| name: Update Dependencies | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install protoc | |
| uses: arduino/setup-protoc@v3 | |
| with: | |
| version: '25.x' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cargo-edit | |
| run: cargo install cargo-edit | |
| - name: Update dependencies - Main workspace | |
| run: | | |
| cargo update | |
| cargo upgrade --dry-run > upgrade-main.txt || true | |
| - name: Update dependencies - Proxy workspace | |
| run: | | |
| cd mqtt_grpc_duality | |
| cargo update | |
| cargo upgrade --dry-run > upgrade-proxy.txt || true | |
| - name: Update dependencies - Fuzz workspace | |
| run: | | |
| cd fuzz | |
| cargo update | |
| cargo upgrade --dry-run > upgrade-fuzz.txt || true | |
| - name: Test with updated dependencies | |
| run: | | |
| cargo test --workspace | |
| cd fuzz && cargo build | |
| - name: Create Pull Request | |
| uses: peter-evans/create-pull-request@v5 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| commit-message: 'chore: update dependencies' | |
| title: 'chore: update dependencies' | |
| body: | | |
| Automated dependency updates. | |
| ## Main Workspace Changes | |
| ``` | |
| $(cat upgrade-main.txt || echo "No changes") | |
| ``` | |
| ## Proxy Workspace Changes | |
| ``` | |
| $(cat mqtt_grpc_duality/upgrade-proxy.txt || echo "No changes") | |
| ``` | |
| ## Fuzz Workspace Changes | |
| ``` | |
| $(cat fuzz/upgrade-fuzz.txt || echo "No changes") | |
| ``` | |
| Please review and test before merging. | |
| branch: automated/dependency-updates | |
| delete-branch: true | |
| security-audit: | |
| name: Security Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Install Rust | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Install protoc | |
| uses: arduino/setup-protoc@v3 | |
| with: | |
| version: '25.x' | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit | |
| - name: Run security audit - Main workspace | |
| id: audit-main | |
| run: | | |
| cargo audit --json > audit-main.json || true | |
| echo "main_vulnerabilities=$(cat audit-main.json | jq '.vulnerabilities.count // 0')" >> $GITHUB_OUTPUT | |
| - name: Run security audit - Proxy workspace | |
| id: audit-proxy | |
| run: | | |
| cd mqtt_grpc_duality | |
| cargo audit --json > audit-proxy.json || true | |
| echo "proxy_vulnerabilities=$(cat audit-proxy.json | jq '.vulnerabilities.count // 0')" >> $GITHUB_OUTPUT | |
| - name: Run security audit - Fuzz workspace | |
| id: audit-fuzz | |
| run: | | |
| cd fuzz | |
| cargo audit --json > audit-fuzz.json || true | |
| echo "fuzz_vulnerabilities=$(cat audit-fuzz.json | jq '.vulnerabilities.count // 0')" >> $GITHUB_OUTPUT | |
| - name: Create security issue | |
| if: steps.audit-main.outputs.main_vulnerabilities > 0 || steps.audit-proxy.outputs.proxy_vulnerabilities > 0 || steps.audit-fuzz.outputs.fuzz_vulnerabilities > 0 | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| const mainVulns = ${{ steps.audit-main.outputs.main_vulnerabilities }}; | |
| const proxyVulns = ${{ steps.audit-proxy.outputs.proxy_vulnerabilities }}; | |
| const fuzzVulns = ${{ steps.audit-fuzz.outputs.fuzz_vulnerabilities }}; | |
| const title = `Security vulnerabilities detected (${mainVulns + proxyVulns + fuzzVulns} total)`; | |
| const body = `Security audit found vulnerabilities in dependencies: | |
| - Main workspace: ${mainVulns} vulnerabilities | |
| - Proxy workspace: ${proxyVulns} vulnerabilities | |
| - Fuzz workspace: ${fuzzVulns} vulnerabilities | |
| Please review the audit reports and update dependencies as needed. | |
| Run \`cargo audit\` in each workspace for detailed information.`; | |
| github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: title, | |
| body: body, | |
| labels: ['security', 'dependencies'] | |
| }); |