PR to update CPE dictionary index #128
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR to update CPE dictionary index | |
| on: | |
| schedule: | |
| - cron: "0 1 * * 1" # every monday at 1 AM | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| env: | |
| SLACK_NOTIFICATIONS: true | |
| jobs: | |
| upgrade-cpe-dictionary-index: | |
| # Runner definition: workflows/.github/runs-on.yml | |
| runs-on: runs-on=${{ github.run_id }}/runner=small-arm | |
| permissions: | |
| contents: read | |
| packages: write | |
| if: github.repository == 'anchore/syft' # only run for main repo | |
| steps: | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| id: bootstrap | |
| - name: Login to GitHub Container Registry | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | ${{ steps.bootstrap.outputs.oras }} login ghcr.io -u ${{ github.actor }} --password-stdin | |
| - name: Pull CPE cache from registry | |
| run: make generate:cpe-index:cache:pull | |
| - name: Update CPE cache from NVD API | |
| run: make generate:cpe-index:cache:update | |
| env: | |
| NVD_API_KEY: ${{ secrets.NVD_API_KEY }} | |
| - name: Generate CPE dictionary index | |
| run: make generate:cpe-index:build | |
| - name: Push updated CPE cache to registry | |
| run: make generate:cpe-index:cache:push | |
| - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 #v2.1.4 | |
| id: generate-token | |
| with: | |
| app-id: ${{ secrets.TOKEN_APP_ID }} | |
| private-key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }} | |
| - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e #v7.0.8 | |
| with: | |
| signoff: true | |
| delete-branch: true | |
| branch: auto/latest-cpe-dictionary-index | |
| labels: dependencies | |
| commit-message: "chore(deps): update CPE dictionary index" | |
| title: "chore(deps): update CPE dictionary index" | |
| body: | | |
| Update CPE dictionary index based on the latest available CPE dictionary | |
| token: ${{ steps.generate-token.outputs.token }} | |
| - uses: 8398a7/action-slack@77eaa4f1c608a7d68b38af4e3f739dcd8cba273e #v3.19.0 | |
| with: | |
| status: ${{ job.status }} | |
| fields: workflow,eventName,job | |
| text: Syft CPE dictionary index update failed | |
| env: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_TOOLBOX_WEBHOOK_URL }} | |
| if: ${{ failure() && env.SLACK_NOTIFICATIONS == 'true' }} |