Home

Steps to add to a project repository and scan production branch

Create file .github/workflows/ with following contents:

on:
  schedule:
    - cron:  '0 0 * * *' # UTC == 2 AM EET

name: Scan production for security updates

jobs:

  scan-production:

    runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v3
        with:
          ref: 'main' # Use production branch

      - uses: druidfi/security-checker-action@v1
        with:
          format: markdown
        id: security-updates

      - uses: dblock/create-a-github-issue@v3
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BODY: "${{ steps.security-updates.outputs.updates }}"
        with:
          update_existing: true
          filename: .github/ISSUE_TEMPLATE_SEC.md

Then create issue template file .github/ISSUE_TEMPLATE_SEC.md with contents:

---
title: Pending security updates in production!
assignees:
  - back-2-95
labels:
  - security
---
{{ env.BODY }}

Branch: `{{ ref }}`