chore(deps): bump actions/checkout from 4.2.2 to 7.0.1 (#22) #58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ────────────────────────────────────────────────────────────── | |
| # Exe ERP — Vulnerability scan (Python · Node · container) | |
| # | |
| # Feature 2a9c53a5-b7b6-4917-b421-10b57c490a88 | |
| # | |
| # ADDITIVE — does NOT modify ci-checks.yml or pr-checks.yml. | |
| # The existing blocking CI already covers: | |
| # • pip-audit on root pyproject.toml | |
| # • yarn audit --level high | |
| # | |
| # This workflow extends that coverage with: | |
| # 1. python-vuln-scan — pip-audit on apps/erpnext/pyproject.toml | |
| # (upstream ERPNext app deps, not in existing scan) | |
| # 2. node-vuln-scan — npm audit on root + apps/erpnext | |
| # (complementary to yarn audit; different advisory DB) | |
| # 3. container-vuln-scan — Trivy filesystem vuln scan + Dockerfile | |
| # misconfiguration scan (entirely new capability) | |
| # | |
| # NON-BLOCKING (continue-on-error: true) — pre-existing vulnerabilities in | |
| # upstream ERPNext/Frappe dependencies would red these jobs immediately if | |
| # they blocked. Results are reported as annotations; fix-up PRs can harden | |
| # severity thresholds over time. | |
| # | |
| # Least-privilege: read-only, no packages/contents write. | |
| # All third-party actions pinned to a full commit SHA. | |
| # ────────────────────────────────────────────────────────────── | |
| name: Vulnerability Scan | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| schedule: | |
| - cron: '0 3 * * 1' # Weekly Monday 03:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # Cancel superseded runs (bug 03faf797): rapid PR pushes piled up redundant | |
| # scans on the shared self-hosted slots — only the latest commit matters. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # ── 1. Python — apps/erpnext dependency audit ───────────────── | |
| python-vuln-scan: | |
| name: Python vulnerability scan (pip-audit) | |
| runs-on: [self-hosted, linux, x64] | |
| continue-on-error: true # non-blocking: upstream deps may carry known CVEs | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Python (with pip cache) | |
| uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0 | |
| with: | |
| python-version: '3.12' | |
| cache: pip | |
| cache-dependency-path: apps/erpnext/pyproject.toml | |
| - name: Install pip-audit | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python3 -m venv .venv-ci | |
| . .venv-ci/bin/activate | |
| python -m pip install --quiet --upgrade pip "pip-audit~=2.7" | |
| echo "$PWD/.venv-ci/bin" >> "$GITHUB_PATH" | |
| - name: pip-audit — apps/erpnext/pyproject.toml | |
| shell: bash | |
| run: | | |
| # Extract resolvable (non-VCS) deps from the ERPNext app pyproject. | |
| # The root pyproject.toml is already audited in ci-checks.yml (blocking); | |
| # this scan covers the upstream ERPNext app dependency tree. | |
| python3 - <<'PY' > /tmp/erpnext_reqs.txt | |
| import tomllib, pathlib, sys | |
| p = pathlib.Path('apps/erpnext/pyproject.toml') | |
| if not p.exists(): | |
| sys.exit(0) | |
| data = tomllib.load(p.open('rb')) | |
| deps = data.get('project', {}).get('dependencies', []) | |
| for d in deps: | |
| if 'git+' not in d: | |
| print(d) | |
| PY | |
| if [ ! -s /tmp/erpnext_reqs.txt ]; then | |
| echo "No resolvable deps found in apps/erpnext/pyproject.toml — skipping" | |
| exit 0 | |
| fi | |
| python -m pip_audit --requirement /tmp/erpnext_reqs.txt --strict \ | |
| || echo "::warning::pip-audit found vulnerabilities in apps/erpnext/pyproject.toml — see job output" | |
| # ── 2. Node — npm audit (complements existing yarn audit) ───── | |
| node-vuln-scan: | |
| name: Node vulnerability scan (npm audit) | |
| runs-on: [self-hosted, linux, x64] | |
| continue-on-error: true # non-blocking: upstream Frappe JS deps may carry known CVEs | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: npm audit — root package.json | |
| shell: bash | |
| run: | | |
| # npm audit requires package-lock.json; generate a lock-only manifest | |
| # without installing packages (--ignore-scripts = no postinstall hooks). | |
| if [ ! -f package-lock.json ]; then | |
| npm install --package-lock-only --ignore-scripts --legacy-peer-deps 2>/dev/null || true | |
| fi | |
| npm audit --audit-level=high \ | |
| || echo "::warning::npm audit (root) found high/critical vulnerabilities — see job output" | |
| - name: npm audit — apps/erpnext/package.json | |
| shell: bash | |
| run: | | |
| cd apps/erpnext | |
| if [ ! -f package.json ]; then | |
| echo "No package.json in apps/erpnext — skipping" | |
| exit 0 | |
| fi | |
| if [ ! -f package-lock.json ]; then | |
| npm install --package-lock-only --ignore-scripts --legacy-peer-deps 2>/dev/null || true | |
| fi | |
| npm audit --audit-level=high \ | |
| || echo "::warning::npm audit (apps/erpnext) found high/critical vulnerabilities — see job output" | |
| # ── 3. Container — Trivy filesystem + Dockerfile config ─────── | |
| container-vuln-scan: | |
| name: Container vulnerability scan (Trivy) | |
| runs-on: [self-hosted, linux, x64] | |
| continue-on-error: true # non-blocking: upstream image layers likely carry known CVEs | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install Trivy | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p "$HOME/.local/bin" | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \ | |
| | sh -s -- -b "$HOME/.local/bin" v0.72.0 | |
| echo "$HOME/.local/bin" >> "$GITHUB_PATH" | |
| "$HOME/.local/bin/trivy" --version | |
| - name: Trivy filesystem scan (Python + Node package manifests) | |
| run: | | |
| # Scans pyproject.toml / requirements*.txt / package.json / yarn.lock | |
| # for known CVEs. Skips large vendored dirs to keep runtime short. | |
| # --exit-code 0 keeps step green regardless of findings; the | |
| # continue-on-error job gate is the safety net. | |
| trivy fs . \ | |
| --exit-code 0 \ | |
| --severity HIGH,CRITICAL \ | |
| --scanners vuln \ | |
| --format table \ | |
| --skip-dirs ".git,node_modules,apps/frappe,apps/erpnext/node_modules" \ | |
| || echo "::warning::Trivy fs scan reported vulnerabilities — see job output" | |
| - name: Trivy Dockerfile misconfiguration scan | |
| run: | | |
| # Scans Dockerfile and docker-compose.yml for security misconfigurations | |
| # (e.g. running as root, ADD vs COPY, HEALTHCHECK missing). | |
| trivy config . \ | |
| --exit-code 0 \ | |
| --severity HIGH,CRITICAL \ | |
| --format table \ | |
| || echo "::warning::Trivy config scan reported Dockerfile issues — see job output" |