Prove dependency CVE audit #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Prove dependency CVE audit | |
| on: | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| jobs: | |
| prove: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Check out delivery | |
| uses: actions/checkout@v4 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 24 | |
| - name: Run unit tests | |
| run: node --test skill/dependency-cve-audit/audit.test.mjs | |
| - name: Validate governed skill | |
| run: npx --yes @runxhq/cli@0.6.2 doctor skill/dependency-cve-audit --json | |
| - name: Check out named vulnerable target | |
| run: git clone --depth 1 --branch v1.2.5 https://github.com/minimistjs/minimist.git target/minimist-v1.2.5 | |
| - name: Run and seal audit | |
| env: | |
| RUNX_RECEIPT_SIGN_KID: ${{ vars.RUNX_RECEIPT_SIGN_KID }} | |
| RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64: ${{ secrets.RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64 }} | |
| RUNX_RECEIPT_SIGN_ISSUER_TYPE: ci | |
| run: | | |
| set -o pipefail | |
| test -n "$RUNX_RECEIPT_SIGN_KID" | |
| test -n "$RUNX_RECEIPT_SIGN_ED25519_SEED_BASE64" | |
| mkdir -p artifacts receipts | |
| npx --yes @runxhq/cli@0.6.2 skill ./skill/dependency-cve-audit \ | |
| --input "target_dir=$GITHUB_WORKSPACE/target/minimist-v1.2.5" \ | |
| --input "output_dir=$GITHUB_WORKSPACE/artifacts" \ | |
| --input "include_dev=false" \ | |
| --input "target_repository=https://github.com/minimistjs/minimist" \ | |
| --input "target_ref=v1.2.5" \ | |
| --receipt-dir "$GITHUB_WORKSPACE/receipts" \ | |
| --json | tee artifacts/run-result.json | |
| - name: Verify receipt and delivery | |
| run: | | |
| RECEIPT_ID="$(jq -r .receipt_id artifacts/run-result.json)" | |
| PUBLIC_KEY="$(jq -r .public_key_base64 artifacts/receipt-public-key.json)" | |
| KID="$(jq -r .kid artifacts/receipt-public-key.json)" | |
| test -f "receipts/$RECEIPT_ID.json" | |
| RUNX_RECEIPT_VERIFY_KID="$KID" \ | |
| RUNX_RECEIPT_VERIFY_ED25519_PUBLIC_KEY_BASE64="$PUBLIC_KEY" \ | |
| npx --yes @runxhq/cli@0.6.2 verify --receipt "receipts/$RECEIPT_ID.json" --json \ | |
| > artifacts/receipt-verification.json | |
| node scripts/verify-delivery.mjs . | |
| - name: Upload immutable workflow artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: dependency-cve-audit-proof | |
| path: | | |
| artifacts/ | |
| receipts/ | |
| if-no-files-found: error | |
| - name: Publish proof branch | |
| run: | | |
| git config user.name "Versy Proof Bot" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add -f artifacts receipts | |
| git commit -m "chore(proof): publish sealed CVE audit" | |
| git push --force origin HEAD:proof |