CodeStoryView/.github/workflows/dependency-audit.yml at 8d92c57ec671ad340b50a4d02d5a4b7f052b5216 · CodeStoryBuild/CodeStoryView · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
name: Dependency Audit

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]
  schedule:
    # Run weekly on Sundays at 2 AM UTC
    - cron: '0 2 * * 0'

jobs:
  audit:
    runs-on: ubuntu-latest

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'pnpm'

    - name: Install pnpm
      uses: pnpm/action-setup@v4
      with:
        version: latest

    - name: Install dependencies
      run: pnpm install --frozen-lockfile

    - name: Security Audit
      run: pnpm run audit:security
      continue-on-error: true

    - name: Check Unused Dependencies
      run: pnpm run audit:unused
      continue-on-error: true

    - name: License Compatibility Check
      run: pnpm run audit:licenses
      continue-on-error: true

    - name: Build Size Check
      run: |
        pnpm build
        node scripts/audit-deps.js
      continue-on-error: true

    - name: Upload Audit Results
      uses: actions/upload-artifact@v4
      if: always()
      with:
        name: audit-results
        path: |
          logs/
          .pnpm-audit-report.json
        retention-days: 30

  security-alerts:
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule' || github.event_name == 'push'

    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'pnpm'

    - name: Install pnpm
      uses: pnpm/action-setup@v4
      with:
        version: latest

    - name: Install dependencies
      run: pnpm install --frozen-lockfile

    - name: Generate Security Report
      run: |
        echo "# Dependency Security Report" > security-report.md
        echo "Generated: $(date)" >> security-report.md
        echo "" >> security-report.md

        echo "## Security Vulnerabilities" >> security-report.md
        pnpm audit --audit-level moderate --long || echo "Vulnerabilities found - see details above" >> security-report.md
        echo "" >> security-report.md

        echo "## License Issues" >> security-report.md
        node scripts/license-check.js >> security-report.md || true
        echo "" >> security-report.md

        echo "## Unused Dependencies" >> security-report.md
        pnpm run audit:unused >> security-report.md || true

    - name: Create Issue on Security Findings
      uses: actions/github-script@v7
      if: failure()
      with:
        script: |
          const fs = require('fs');

          try {
            const report = fs.readFileSync('security-report.md', 'utf8');

            await github.rest.issues.create({
              owner: context.repo.owner,
              repo: context.repo.repo,
              title: `🔒 Security Audit Alert - ${new Date().toISOString().split('T')[0]}`,
              body: `Automated security audit found issues requiring attention:\n\n${report}`,
              labels: ['security', 'dependencies', 'audit']
            });
          } catch (error) {
            console.log('No security report generated or issue creation failed:', error.message);
          }