Skip to content

Roll Dart SDK from f773d45634ed to a9651de827d8 (1 revision) (#52861) #88

Roll Dart SDK from f773d45634ed to a9651de827d8 (1 revision) (#52861)

Roll Dart SDK from f773d45634ed to a9651de827d8 (1 revision) (#52861) #88

name: Third party deps scan
on:
# Only the default branch is supported.
branch_protection_rule:
push:
branches: [ main ]
pull_request:
types: [ labeled ]
# Declare default permissions as read only.
permissions: read-all
jobs:
extract-deps:
name: Extract Dependencies
runs-on: ubuntu-20.04
if: ${{ (github.repository == 'flutter/engine' && github.event_name == 'push') || github.event.label.name == 'vulnerability scan' }}
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
security-events: write
contents: read
steps:
- name: "Checkout code"
uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b
with:
persist-credentials: false
- name: "setup python"
uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d
with:
python-version: '3.7.7' # install the python version needed
- name: "extract deps, find commit hash, pass to osv-scanner"
run: python ci/scan_deps.py --output osv-lockfile-${{github.sha}}.json
- name: "upload osv-scanner deps"
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
with:
# use github.ref in name to avoid duplicated artifacts
name: osv-lockfile-${{github.sha}}
path: osv-lockfile-${{github.sha}}.json
retention-days: 2
vuln-scan:
name: Vulnerability scanning
needs:
extract-deps
uses: "google/osv-scanner-action/.github/workflows/[email protected]"
with:
# Download the artifact uploaded in extract-deps step
download-artifact: osv-lockfile-${{github.sha}}
scan-args: |-
--lockfile=osv-scanner:osv-lockfile-${{github.sha}}.json
fail-on-vuln: false
# makes sure the osv-formatted vulns are uploaded
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
security-events: write
contents: read