Scan for Vulnerabilities + make PRs automatically #675
Conversation
| make update-dependencies; | ||
| exit 1 | ||
| - name: Create Pull Request | ||
| if: ${{ failure() }} |
There was a problem hiding this comment.
Shouldn't we want to do this on success, not failure?
There was a problem hiding this comment.
The previous command succeeds if there are no vulnerabilities and fails if there are vulnerabilities.
| scan.json | sed 'N;s/\n/>=/'); | ||
|
|
||
| make update-dependencies; | ||
| exit 1 |
There was a problem hiding this comment.
Why are we exiting 1 here?
There was a problem hiding this comment.
Exiting 1 to fail and ensure that the PR is created. Otherwise, everything would return 0 and no PR would be created.
| sed -i "/${package}.*/d" ckan/requirements.in | ||
| sed -i "/${package}.*/d" ckan/requirements.txt | ||
| echo $fix >> ckan/requirements.in | ||
| done <<< $(jq -r '.vulnerabilities[] | .moduleName,.fixedIn[]' |
There was a problem hiding this comment.
What if there's no fix, does this for loop run?
There was a problem hiding this comment.
If there's no fix, we are testing what will happen, most likely a bad PR will be created.. But in that case, we'd have to make a PR to ignore it, we can add the functionality in the future. But I feel like that doesn't happen often.
|
Superseded by |
Related to
References: