| name: Third party deps scan |
| on: |
| # Only the default branch is supported. |
| branch_protection_rule: |
| push: |
| branches: [ main ] |
| |
| # Declare default permissions as read only. |
| permissions: read-all |
| |
| jobs: |
| vuln-scan: |
| name: Vulnerability scanning |
| runs-on: ubuntu-20.04 |
| if: ${{ github.repository == 'flutter/engine' }} |
| permissions: |
| # Needed to upload the SARIF results to code-scanning dashboard. |
| security-events: write |
| actions: read |
| contents: read |
| # Needed to access OIDC token. |
| id-token: write |
| steps: |
| - name: "Checkout code" |
| uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab |
| with: |
| persist-credentials: false |
| - name: "setup python" |
| uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b |
| with: |
| python-version: '3.7.7' # install the python version needed |
| - name: "extract and flatten deps" |
| run: python ci/deps_parser.py |
| - name: "scan deps for vulnerabilities" |
| run: python ci/scan_flattened_deps.py |
| # Upload the results as artifacts. |
| - name: "Upload artifact" |
| uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce |
| with: |
| name: SARIF file |
| path: osvReport.sarif |
| retention-days: 5 |
| # Upload the results to GitHub's code scanning dashboard. |
| - name: "Upload to security tab" |
| uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f |
| with: |
| sarif_file: osvReport.sarif |