Merge pull request #153 from convenient/poc-composer-audit-handling

POC for composer audit handling

Author: sprankhub

magento-integration-tests/7.0/action.yml

@@ -36,6 +36,10 @@ inputs:
   magento_post_install_script:
     description: 'Relative path to an optional script after Magento installation is run. Leave empty to use the default.'
     required: false
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:7.0-latest'

magento-integration-tests/7.1/action.yml

@@ -36,6 +36,10 @@ inputs:
   magento_post_install_script:
     description: 'Relative path to an optional script after Magento installation is run. Leave empty to use the default.'
     required: false
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:7.1-latest'

magento-integration-tests/7.2/action.yml

@@ -36,6 +36,10 @@ inputs:
   magento_post_install_script:
     description: 'Relative path to an optional script after Magento installation is run. Leave empty to use the default.'
     required: false
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:7.2-latest'

magento-integration-tests/7.3/action.yml

@@ -36,6 +36,10 @@ inputs:
   magento_post_install_script:
     description: 'Relative path to an optional script after Magento installation is run. Leave empty to use the default.'
     required: false
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:7.3-latest'

magento-integration-tests/7.4/action.yml

@@ -40,6 +40,10 @@ inputs:
     description: 'DEPREACATED. Composer v2 is now always used.'
     required: false
     default: '1'
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:7.4-latest'

magento-integration-tests/8.1/action.yml

@@ -40,6 +40,10 @@ inputs:
     description: 'DEPREACATED. Composer v2 is now always used.'
     required: false
     default: '1'
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:8.1-latest'

magento-integration-tests/8.2/action.yml

@@ -40,6 +40,10 @@ inputs:
     description: 'DEPREACATED. Composer v2 is now always used.'
     required: false
     default: '2'
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:8.2-latest'

magento-integration-tests/8.3/action.yml

@@ -40,6 +40,10 @@ inputs:
     description: 'DEPREACATED. Composer v2 is now always used.'
     required: false
     default: '2'
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:8.3-latest'

magento-integration-tests/8.4/action.yml

@@ -40,6 +40,10 @@ inputs:
     description: 'DEPREACATED. Composer v2 is now always used.'
     required: false
     default: '2'
+  block_insecure:
+    description: 'Whether Composer should block insecure packages during audit. Set to false to allow insecure packages.'
+    required: false
+    default: 'true'
 runs:
   using: 'docker'
   image: 'docker://extdn/magento-integration-tests-action:8.4-latest'

magento-integration-tests/entrypoint.sh

@@ -10,6 +10,7 @@ test -z "${PROJECT_NAME}" && PROJECT_NAME=$INPUT_PROJECT_NAME
 test -z "${ELASTICSEARCH}" && ELASTICSEARCH=$INPUT_ELASTICSEARCH
 test -z "${PHPUNIT_FILE}" && PHPUNIT_FILE=$INPUT_PHPUNIT_FILE
 test -z "${REPOSITORY_URL}" && REPOSITORY_URL=$INPUT_REPOSITORY_URL
+test -z "${BLOCK_INSECURE}" && BLOCK_INSECURE=$INPUT_BLOCK_INSECURE
 
 # Maintain backwards-compatibility with old 'ce_version' input.
 test -z "${MAGENTO_VERSION}" && MAGENTO_VERSION=$INPUT_CE_VERSION
@@ -19,6 +20,7 @@ test -z "$MAGENTO_VERSION" && MAGENTO_VERSION="2.4.3-p1"
 test -z "$PROJECT_NAME" && PROJECT_NAME="magento/project-community-edition"
 test -z "${REPOSITORY_URL}" && REPOSITORY_URL="https://repo-magento-mirror.fooman.co.nz/"
 test -z "$DISABLE_DATABASE_DUMP" && DISABLE_DATABASE_DUMP="1"
+test -z "${BLOCK_INSECURE}" && BLOCK_INSECURE="true"
 
 if [[ "$MAGENTO_VERSION" == "2.4."* ]]; then
     ELASTICSEARCH=1
@@ -85,8 +87,11 @@ if [[ "$MAGENTO_VERSION" == "2.4.4" ]]; then
     composer require monolog/monolog:2.6.0 --no-update
 fi
 
+echo "Configure Composer audit.block-insecure"
+composer config audit.block-insecure "$BLOCK_INSECURE"
+
 echo "Ignore known security advisories"
-composer config --json audit.ignore '{"PKSA-z3gr-8qht-p93v": "Ignored for CI", "PKSA-rkkf-636k-qjb3": "Ignored for CI", "PKSA-wws7-mr54-jsny": "Ignored for CI"}'
+composer config --json audit.ignore '{"PKSA-z3gr-8qht-p93v": "Ignored for CI", "PKSA-rkkf-636k-qjb3": "Ignored for CI", "PKSA-wws7-mr54-jsny": "Ignored for CI", "PKSA-db8d-773v-rd1n": "Ignored for CI"}'
 
 echo "Run installation"
 COMPOSER_MEMORY_LIMIT=-1 composer install --no-interaction --no-progress