[#3009] Cut CI build time with concurrent image pulls, a rebalanced export runner and a smaller codebase export. #464
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # GitHub Actions configuration file. | |
| # | |
| # Security checks run in their own workflow so that a failing audit is | |
| # distinguishable from a failing linter and can be re-run on its own. | |
| #; | |
| #; Comments starting with '#;<' and '#;>' are internal Vortex comments | |
| #; and will be removed during installation or update of Vortex. | |
| name: Security audit | |
| on: | |
| push: | |
| # Pushes to the following branches will trigger the workflow. | |
| branches: | |
| - production | |
| - main | |
| - master | |
| - develop | |
| - release/** | |
| - hotfix/** | |
| - project/** | |
| #;< VORTEX_DEV | |
| - '*.x' | |
| #;> VORTEX_DEV | |
| # Pushes of tags will also trigger the workflow. | |
| tags: | |
| - '*' | |
| # Pull requests to the following branches will trigger the workflow. | |
| pull_request: | |
| types: | |
| - opened | |
| - synchronize | |
| - reopened | |
| branches: | |
| - production | |
| - main | |
| - master | |
| - develop | |
| - release/** | |
| - hotfix/** | |
| - feature/** | |
| - bugfix/** | |
| - project/** | |
| #;< VORTEX_DEV | |
| - '*.x' | |
| #;> VORTEX_DEV | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash | |
| # Workaround for the Actions runner creating /root/.docker/config.json | |
| # with permissions that prevent the container from reading it. | |
| # https://github.com/actions/runner/issues/863 | |
| env: | |
| DOCKER_CONFIG: /tmp/.docker | |
| permissions: | |
| contents: read | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # The code scanning upload reads the workflow run in a private repository. | |
| actions: read | |
| contents: read | |
| security-events: write | |
| container: | |
| # https://hub.docker.com/r/drevops/ci-runner | |
| image: drevops/ci-runner:26.8.0@sha256:80be478cfff66d81fa804ccc707dbeae478655d8b850f1ae06824c194bd6528e | |
| env: | |
| TZ: ${{ vars.TZ || 'UTC' }} | |
| TERM: xterm-256color | |
| VORTEX_DEBUG: ${{ vars.VORTEX_DEBUG }} | |
| steps: | |
| - name: Preserve $HOME set in the container | |
| run: echo HOME=/root >> "$GITHUB_ENV" # https://github.com/actions/runner/issues/863 | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Fix Git ownership permissions | |
| run: git config --global --add safe.directory "$GITHUB_WORKSPACE" | |
| - name: Load environment variables from .env | |
| run: t=$(mktemp) && export -p >"${t}" && set -a && . ./.env && set +a && . "${t}" && env >> "$GITHUB_ENV" | |
| #;< VORTEX_DEV | |
| #; Vortex does not track 'composer.lock', so resolve dependencies to give | |
| #; the audit below something to read. Nothing is installed, so the runner | |
| #; does not need to provide the platform extensions Drupal requires. | |
| - name: Create Composer lock file | |
| run: composer update --no-install --no-audit --ignore-platform-reqs | |
| #;> VORTEX_DEV | |
| - name: Create the directory for the audit reports | |
| if: ${{ !cancelled() }} | |
| run: mkdir -p .logs/audit | |
| #; Each audit runs once and its machine-readable report is teed to a file, | |
| #; so the log still carries the output that the conversion below reads. | |
| - name: Audit Composer packages | |
| if: ${{ !cancelled() }} | |
| run: composer audit --locked --format=json | tee .logs/audit/composer-audit.json | |
| continue-on-error: ${{ vars.VORTEX_CI_COMPOSER_AUDIT_IGNORE_FAILURE == '1' }} | |
| #;< TOOL_NPM | |
| - name: Audit npm packages | |
| if: ${{ !cancelled() }} | |
| run: npm audit --package-lock-only --json | tee .logs/audit/npm-audit.json | |
| continue-on-error: ${{ vars.VORTEX_CI_NPM_AUDIT_IGNORE_FAILURE == '1' }} | |
| #;> TOOL_NPM | |
| #;< DRUPAL_THEME | |
| - name: Audit npm packages of the theme | |
| if: ${{ !cancelled() }} | |
| run: npm audit --package-lock-only --prefix="${WEBROOT}/themes/custom/${DRUPAL_THEME}" --json | tee .logs/audit/npm-audit-theme.json | |
| continue-on-error: ${{ vars.VORTEX_CI_NPM_AUDIT_IGNORE_FAILURE == '1' }} | |
| #;> DRUPAL_THEME | |
| - name: Install Vortex tooling | |
| if: ${{ !cancelled() }} | |
| run: ./scripts/vortex-tooling.sh | |
| - name: Convert Composer audit findings to SARIF | |
| if: ${{ !cancelled() }} | |
| # Reporting must not decide the workflow result; the audit steps above | |
| # are what fail on findings. | |
| continue-on-error: true | |
| run: ./vendor/bin/vortex-convert-audit-sarif .logs/audit/composer-audit.json composer | |
| - name: Upload Composer audit findings to code scanning | |
| if: ${{ !cancelled() && hashFiles('.logs/audit/composer-audit.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 | |
| # The upload fails without a code scanning entitlement, and on fork | |
| # pull requests where the token is read-only. The audit steps above are | |
| # what report the findings and fail the workflow. | |
| continue-on-error: true | |
| with: | |
| sarif_file: .logs/audit/composer-audit.sarif | |
| category: composer-audit | |
| #;< TOOL_NPM | |
| - name: Convert npm audit findings to SARIF | |
| if: ${{ !cancelled() }} | |
| continue-on-error: true | |
| run: ./vendor/bin/vortex-convert-audit-sarif .logs/audit/npm-audit.json npm | |
| - name: Upload npm audit findings to code scanning | |
| if: ${{ !cancelled() && hashFiles('.logs/audit/npm-audit.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 | |
| continue-on-error: true | |
| with: | |
| sarif_file: .logs/audit/npm-audit.sarif | |
| category: npm-audit | |
| #;> TOOL_NPM | |
| #;< DRUPAL_THEME | |
| - name: Convert theme npm audit findings to SARIF | |
| if: ${{ !cancelled() }} | |
| continue-on-error: true | |
| run: ./vendor/bin/vortex-convert-audit-sarif .logs/audit/npm-audit-theme.json npm "${WEBROOT}/themes/custom/${DRUPAL_THEME}/package-lock.json" | |
| - name: Upload theme npm audit findings to code scanning | |
| if: ${{ !cancelled() && hashFiles('.logs/audit/npm-audit-theme.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 | |
| continue-on-error: true | |
| with: | |
| sarif_file: .logs/audit/npm-audit-theme.sarif | |
| category: npm-audit-theme | |
| #;> DRUPAL_THEME | |
| #;< CI_GITLEAKS | |
| - name: Scan for committed secrets with Gitleaks | |
| if: ${{ !cancelled() }} | |
| run: docker run --rm --volumes-from "${HOSTNAME}" -w "${PWD}" ghcr.io/gitleaks/gitleaks:v8.30.1 dir . --no-banner --report-format sarif --report-path .logs/audit/gitleaks.sarif | |
| continue-on-error: ${{ vars.VORTEX_CI_GITLEAKS_IGNORE_FAILURE == '1' }} | |
| - name: Upload Gitleaks findings to code scanning | |
| if: ${{ !cancelled() && hashFiles('.logs/audit/gitleaks.sarif') != '' }} | |
| uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4 | |
| continue-on-error: true | |
| with: | |
| sarif_file: .logs/audit/gitleaks.sarif | |
| category: gitleaks | |
| #;> CI_GITLEAKS | |
| - name: Upload security findings as an artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: security-findings | |
| path: .logs/audit | |
| include-hidden-files: true | |
| if-no-files-found: ignore |