CVE Scanning Schedule #32
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CVE Scanning Schedule | |
| # Lives only on main. `schedule` always runs the workflow file as it exists on | |
| # the default branch, so a schedule trigger inside cve-scanning.yml itself | |
| # could never scan other maintained branches (e.g. 11.x.x) using their own | |
| # version of that file. Instead this dispatches cve-scanning.yml via | |
| # workflow_dispatch against each ref, which runs the file as it exists there. | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| # Run daily to catch newly published CVEs even without repo changes. | |
| # Staggered across repos (rune-dsl 01:00, rune-common 01:30, rune-testing | |
| # 02:00) to avoid all three hitting the NVD API / shared runners at once. | |
| - cron: '0 2 * * *' | |
| # Neither step below uses the default GITHUB_TOKEN, so it's granted no | |
| # permissions at all. | |
| permissions: {} | |
| jobs: | |
| dispatch: | |
| # `schedule` fires independently on every repo that has this file on its | |
| # default branch - including REGnosys/rune-testing, a fork of this repo. | |
| # The CVE Scan Dispatcher App is only installed on finos/rune-testing, so | |
| # skip here rather than failing daily on the fork. | |
| if: github.repository == 'finos/rune-testing' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| ref: [main, 11.x.x] | |
| steps: | |
| # The default GITHUB_TOKEN can't trigger another workflow run (GitHub's | |
| # anti-recursion guard silently no-ops workflow_dispatch calls made with | |
| # it), so this mints a short-lived token from the shared REGnosys CVE | |
| # Scan Dispatcher GitHub App instead. | |
| - name: Generate dispatch token | |
| id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ secrets.CVE_SCAN_DISPATCH_APP_ID }} | |
| private-key: ${{ secrets.CVE_SCAN_DISPATCH_APP_PRIVATE_KEY }} | |
| - name: Trigger CVE scanning on ${{ matrix.ref }} | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| run: | | |
| gh workflow run cve-scanning.yml \ | |
| --ref ${{ matrix.ref }} \ | |
| --repo ${{ github.repository }} \ | |
| -f scheduled=true |