Security Audit #1373
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This is a security audit workflow that runs security audit checks and send an email in case any vulnerabilities are detected. | |
| name: Security Audit | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' #runs daily at 12:00 am UTC | |
| jobs: | |
| security_audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - name: Run security audit check | |
| id: cargo-audit | |
| if: github.repository == 'project-akri/akri' # only run on main repo and not forks | |
| continue-on-error: true | |
| uses: rustsec/audit-check@v1.4.1 | |
| with: | |
| # token is only used for creating the audit report and does not impact the | |
| # functionality or success/failure of the job in case the token is unavailable | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| # sends an email if security audit failed | |
| - name: Send mail | |
| if: steps.cargo-audit.outcome != 'success' && github.repository == 'project-akri/akri' # only run on main repo and not forks | |
| uses: dawidd6/action-send-mail@v3 | |
| with: | |
| server_address: smtp-mail.outlook.com | |
| server_port: 587 | |
| username: ${{secrets.AKRI_BOT_EMAIL}} | |
| password: ${{secrets.AKRI_BOT_PASSWORD}} | |
| subject: "Security vulnerability detected in ${{github.repository}}" | |
| body: |- | |
| A security vulnerability was detected in one or more of Akri's dependencies. For more details, check the output of the [security audit workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}}) | |
| Hint: In most cases, running the [auto-update dependencies](https://github.com/project-akri/akri/actions/workflows/auto-update-dependencies.yml) workflow will fix the issue. | |
| -Your friendly Akri bot 🤖 | |
| to: ${{secrets.AKRI_TEAM_EMAIL}} | |
| from: ${{secrets.AKRI_BOT_EMAIL}} | |
| content_type: text/html | |
| convert_markdown: true | |