slsa-github-generator/.github/workflows/audit_package.yml at main · step-security/slsa-github-generator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
name: NPM Audit Fix Run

on:
  workflow_dispatch:
    inputs:
      force:
        description: "Use --force flag for npm audit fix?"
        required: true
        type: boolean
      base_branch:
        description: "Specify a base branch"
        required: false
        default: "main"
      node_version:
        description: "Node.js version to use"
        required: false
        default: "24"
      working_directories:
        description: "Comma-separated list of working directories to run audit fix in"
        required: false
        default: ".github/actions/compute-sha256,.github/actions/create-container_based-predicate,.github/actions/detect-workflow-js,.github/actions/generate-attestations,.github/actions/privacy-check,.github/actions/sign-attestations,.github/actions/verify-token"
      script:
        description: "Build script to run after audit fix"
        required: false
        default: "npm run all"
  schedule:
    - cron: "0 0 * * 1"

permissions:
  contents: write
  pull-requests: write
  packages: read
  issues: write

jobs:
  prepare:
    runs-on: ubuntu-latest
    outputs:
      directories: ${{ steps.set-matrix.outputs.directories }}
    steps:
      - name: Build directory matrix
        id: set-matrix
        run: |
          INPUT="${{ inputs.working_directories || '.github/actions/compute-sha256,.github/actions/create-container_based-predicate,.github/actions/detect-workflow-js,.github/actions/generate-attestations,.github/actions/privacy-check,.github/actions/sign-attestations,.github/actions/verify-token' }}"
          DIRS=$(echo "$INPUT" | tr ',' '\n' | sed 's/^ *//;s/ *$//' | jq -R -s -c 'split("\n") | map(select(length > 0))')
          echo "directories=$DIRS" >> "$GITHUB_OUTPUT"

  audit-fix:
    needs: prepare
    strategy:
      matrix:
        directory: ${{ fromJson(needs.prepare.outputs.directories) }}
    uses: step-security/reusable-workflows/.github/workflows/audit_fix.yml@v1
    with:
      force: ${{ inputs.force || false }}
      base_branch: ${{ inputs.base_branch || 'main' }}
      node_version: ${{ inputs.node_version || '24' }}
      working_directory: ${{ matrix.directory }}
      script: ${{ inputs.script || 'npm run all' }}