dependabot[bot]
c07df6fec6
Bumps the actions group with 3 updates in the / directory: [actions/cache](https://github.com/actions/cache), [actions/checkout](https://github.com/actions/checkout) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action). Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) Updates `actions/checkout` from 6.0.3 to 7.0.0 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0) Updates `zizmorcore/zizmor-action` from 0.5.6 to 0.5.7 - [Release notes](https://github.com/zizmorcore/zizmor-action/releases) - [Commits](https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: actions/checkout dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions - dependency-name: zizmorcore/zizmor-action dependency-version: 0.5.7 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
80 lines
2.8 KiB
YAML
80 lines
2.8 KiB
YAML
name: Bump trivy
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
trivy_version:
|
|
required: true
|
|
type: string
|
|
description: 'The Trivy version in x.x.x format'
|
|
|
|
run-name: Bump trivy to v${{ inputs.trivy_version }}
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
bump:
|
|
runs-on: ubuntu-2404-2core
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Update Trivy versions
|
|
env:
|
|
NEW_VERSION: ${{ inputs.trivy_version }}
|
|
run: make bump-trivy
|
|
|
|
- name: Setup Bats and bats libs
|
|
id: setup-bats
|
|
uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
|
|
|
|
- name: Install Trivy
|
|
run: make ensure-trivy TRIVY_INSTALL_DIR=/usr/local/bin
|
|
|
|
- name: Update golden files
|
|
env:
|
|
BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
|
|
run: make update-golden
|
|
|
|
- name: Run tests
|
|
env:
|
|
BATS_LIB_PATH: ${{ steps.setup-bats.outputs.lib-path }}
|
|
run: make test
|
|
|
|
# Use a GitHub App token because GITHUB_TOKEN does not trigger CI on PRs created by workflows
|
|
- name: Generate token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
client-id: ${{ secrets.REPO_TRIVY_ACTION_WRITE_GH_APP_CLIENT_ID }}
|
|
private-key: ${{ secrets.REPO_TRIVY_ACTION_WRITE_GH_APP_PRIVATE_KEY }}
|
|
owner: ${{ github.repository_owner }}
|
|
repositories: ${{ github.event.repository.name }}
|
|
permission-contents: write
|
|
permission-pull-requests: write
|
|
|
|
- name: Create PR
|
|
env:
|
|
GH_TOKEN: ${{ steps.app-token.outputs.token }}
|
|
TRIVY_VERSION: ${{ inputs.trivy_version }}
|
|
REPO: ${{ github.repository }}
|
|
BASE_BRANCH: ${{ github.event.repository.default_branch }}
|
|
run: |
|
|
gh auth setup-git
|
|
git config user.name "GitHub Actions"
|
|
git config user.email "actions@github.com"
|
|
BRANCH="bump-trivy-${TRIVY_VERSION}"
|
|
git checkout -b "${BRANCH}"
|
|
git add action.yaml README.md test/
|
|
git commit -m "chore(deps): Update trivy to v${TRIVY_VERSION}"
|
|
git push origin "${BRANCH}"
|
|
PR_RESPONSE=$(gh api repos/${REPO}/pulls \
|
|
--method POST \
|
|
--field title="chore(deps): Update trivy to v${TRIVY_VERSION}" \
|
|
--field body="This PR was automatically generated by the bump-trivy workflow." \
|
|
--field base="${BASE_BRANCH}" \
|
|
--field head="${BRANCH}")
|
|
echo "Pull Request Number - $(echo "${PR_RESPONSE}" | jq -r '.number')"
|
|
echo "Pull Request URL - $(echo "${PR_RESPONSE}" | jq -r '.html_url')"
|