From 7dd04ca78295a52ae2cf64a2408fbb96196883e2 Mon Sep 17 00:00:00 2001 From: Don Petry <36422719+don-petry@users.noreply.github.com> Date: Thu, 14 May 2026 15:32:35 +0000 Subject: [PATCH] fix: replace standalone dependency-audit.yml with org standard thin caller stub Replaces the standalone workflow (which contained the unpinned dtolnay/rust-toolchain@stable action) with the org-standard thin caller stub that delegates to the centrally-maintained reusable workflow. The reusable workflow uses rustup directly, removing the third-party action entirely. Closes #106 Rebased onto main by claude[bot] (auto-rebase). Co-authored-by: Don Petry --- .github/workflows/dependency-audit.yml | 223 +++---------------------- 1 file changed, 19 insertions(+), 204 deletions(-) diff --git a/.github/workflows/dependency-audit.yml b/.github/workflows/dependency-audit.yml index c332e2e4..f1173774 100644 --- a/.github/workflows/dependency-audit.yml +++ b/.github/workflows/dependency-audit.yml @@ -1,14 +1,22 @@ -# Dependency vulnerability audit. -# Detects ecosystems and runs appropriate audit tools (npm, pnpm, Go, Rust, Python). -# Standard: https://github.com/petry-projects/.github/blob/main/standards/dependabot-policy.md#vulnerability-audit-ci-check +# ───────────────────────────────────────────────────────────────────────────── +# SOURCE OF TRUTH: petry-projects/.github/standards/workflows/dependency-audit.yml +# Standard: petry-projects/.github/standards/ci-standards.md#5-dependency-audit-dependency-auditym +# Reusable: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml # -# Auto-detects ecosystems present in the repository and runs the appropriate -# audit tool. Fails the build if any dependency has a known security advisory. +# AGENTS — READ BEFORE EDITING: +# • This file is a THIN CALLER STUB. All ecosystem-detection and audit logic +# lives in the reusable workflow above. +# • You MAY change: nothing in this file in normal use. Adopt verbatim. +# • You MUST NOT change: trigger events, the `uses:` line, or job name +# (used as a required status check). +# • If you need different behaviour (new ecosystem, tool version bump), +# open a PR against the reusable in the central repo. +# ───────────────────────────────────────────────────────────────────────────── # -# Add "dependency-audit" as a required status check in branch protection. -# -# Pinned tool versions (update deliberately): -# govulncheck v1.1.4 | cargo-audit 0.22.1 | pip-audit 2.9.0 +# Dependency vulnerability audit — thin caller for the org-level reusable. +# To adopt: copy this file to .github/workflows/dependency-audit.yml in your repo. +# Add "dependency-audit / Detect ecosystems" as a required status check +# in branch protection. name: Dependency audit on: @@ -21,198 +29,5 @@ permissions: contents: read jobs: - detect: - name: Detect ecosystems - runs-on: ubuntu-latest - outputs: - npm: ${{ steps.check.outputs.npm }} - pnpm: ${{ steps.check.outputs.pnpm }} - gomod: ${{ steps.check.outputs.gomod }} - cargo: ${{ steps.check.outputs.cargo }} - pip: ${{ steps.check.outputs.pip }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - name: Detect package ecosystems - id: check - run: | - # npm — look for package-lock.json anywhere (excluding node_modules) - if find . -name 'package-lock.json' -not -path '*/node_modules/*' | grep -q .; then - echo "npm=true" >> "$GITHUB_OUTPUT" - else - echo "npm=false" >> "$GITHUB_OUTPUT" - fi - - # pnpm — look for pnpm-lock.yaml anywhere - if find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' | grep -q .; then - echo "pnpm=true" >> "$GITHUB_OUTPUT" - else - echo "pnpm=false" >> "$GITHUB_OUTPUT" - fi - - # Go modules — detect via go.mod (not go.sum, which may not exist) - if find . -name 'go.mod' -not -path '*/vendor/*' | grep -q .; then - echo "gomod=true" >> "$GITHUB_OUTPUT" - else - echo "gomod=false" >> "$GITHUB_OUTPUT" - fi - - # Cargo — detect via Cargo.toml anywhere (lockfile may not exist for libraries) - if find . -name 'Cargo.toml' -not -path '*/target/*' | grep -q .; then - echo "cargo=true" >> "$GITHUB_OUTPUT" - else - echo "cargo=false" >> "$GITHUB_OUTPUT" - fi - - # Python — detect pyproject.toml or requirements.txt anywhere - if find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q . || \ - find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' | grep -q .; then - echo "pip=true" >> "$GITHUB_OUTPUT" - else - echo "pip=false" >> "$GITHUB_OUTPUT" - fi - - audit-npm: - name: npm audit - needs: detect - if: needs.detect.outputs.npm == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: "lts/*" - - - name: Audit npm dependencies - run: | - # Audit each package-lock.json found in the repo - status=0 - while IFS= read -r dir; do - echo "::group::npm audit $dir" - if ! (cd "$dir" && npm audit --audit-level=low); then - status=1 - fi - echo "::endgroup::" - done < <(find . -name 'package-lock.json' -not -path '*/node_modules/*' -exec dirname {} \;) - exit $status - - audit-pnpm: - name: pnpm audit - needs: detect - if: needs.detect.outputs.pnpm == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - uses: pnpm/action-setup@91ab88e2619ed1f46221f0ba42d1492c02baf788 # v4 - - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 - with: - node-version: "lts/*" - - - name: Audit pnpm dependencies - run: | - # Audit each pnpm-lock.yaml found in the repo - status=0 - while IFS= read -r dir; do - echo "::group::pnpm audit $dir" - if ! (cd "$dir" && pnpm audit --audit-level low); then - status=1 - fi - echo "::endgroup::" - done < <(find . -name 'pnpm-lock.yaml' -not -path '*/node_modules/*' -exec dirname {} \;) - exit $status - - audit-go: - name: govulncheck - needs: detect - if: needs.detect.outputs.gomod == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v5 - with: - go-version: "stable" - - - name: Install govulncheck - run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 - - - name: Audit Go dependencies - run: | - status=0 - while IFS= read -r dir; do - echo "::group::govulncheck $dir" - if ! (cd "$dir" && govulncheck ./...); then - status=1 - fi - echo "::endgroup::" - done < <(find . -name 'go.mod' -not -path '*/vendor/*' -exec dirname {} \;) - exit $status - - audit-cargo: - name: cargo audit - needs: detect - if: needs.detect.outputs.cargo == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable - - - name: Install cargo-audit - run: cargo install cargo-audit@0.22.1 --locked - - - name: Audit Cargo dependencies - run: | - # cargo audit operates on Cargo.lock at workspace root - # For workspaces, a single audit at root covers all crates - status=0 - while IFS= read -r dir; do - echo "::group::cargo audit $dir" - if ! (cd "$dir" && cargo generate-lockfile 2>/dev/null; cargo audit); then - status=1 - fi - echo "::endgroup::" - done < <(find . -name 'Cargo.toml' -not -path '*/target/*' -exec dirname {} \; | sort -u) - exit $status - - audit-pip: - name: pip-audit - needs: detect - if: needs.detect.outputs.pip == 'true' - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 - - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - with: - python-version: "3.x" - - - name: Install pip-audit - run: pip install pip-audit==2.9.0 - - - name: Audit Python dependencies - run: | - status=0 - # Audit each Python project found in the repo - while IFS= read -r dir; do - echo "::group::pip-audit $dir" - if [ -f "$dir/pyproject.toml" ]; then - if ! pip-audit "$dir"; then - status=1 - fi - elif [ -f "$dir/requirements.txt" ]; then - if ! pip-audit -r "$dir/requirements.txt"; then - status=1 - fi - fi - echo "::endgroup::" - done < <( - { - find . -name 'pyproject.toml' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; - find . -name 'requirements.txt' -not -path '*/.venv/*' -not -path '*/venv/*' -exec dirname {} \; - } | sort -u - ) - exit $status + dependency-audit: + uses: petry-projects/.github/.github/workflows/dependency-audit-reusable.yml@v1