Security Intake #183
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Security Intake | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '20 6 * * *' | |
| permissions: | |
| contents: read | |
| issues: write | |
| security-events: read | |
| jobs: | |
| security-intake: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v5 | |
| - name: Run security intake gate | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| node tools/priority/security-intake.mjs \ | |
| --route-on-breach \ | |
| --fail-on-breach \ | |
| --fail-on-skip \ | |
| --output tests/results/_agent/security/security-intake-report.json | |
| - name: Append summary | |
| if: always() | |
| run: | | |
| node <<'NODE' | |
| const fs = require('fs'); | |
| const reportPath = 'tests/results/_agent/security/security-intake-report.json'; | |
| if (!fs.existsSync(reportPath)) { | |
| console.log('security intake report missing'); | |
| process.exit(0); | |
| } | |
| const report = JSON.parse(fs.readFileSync(reportPath, 'utf8')); | |
| const lines = [ | |
| '## Security Intake', | |
| `- status: \`${report.status}\``, | |
| `- breaches: \`${Array.isArray(report.breaches) ? report.breaches.length : 0}\``, | |
| `- source open alerts: \`${report.source?.dependabot?.openCount ?? 0}\``, | |
| `- gated open alerts: \`${report.summary?.open?.total ?? 0}\``, | |
| `- platform stale: \`${report.verification?.platformStale ?? false}\``, | |
| `- route action: \`${report.route?.action ?? 'none'}\`` | |
| ]; | |
| if (process.env.GITHUB_STEP_SUMMARY) { | |
| fs.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${lines.join('\n')}\n`); | |
| } | |
| console.log(lines.join('\n')); | |
| NODE | |
| - name: Upload security intake artifact | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: security-intake-report | |
| path: tests/results/_agent/security/security-intake-report.json | |
| if-no-files-found: warn |