Skip to content

Roll Skia from 0182585d38dd to 9d0039785ebd (4 revisions) (#54910) #67

Roll Skia from 0182585d38dd to 9d0039785ebd (4 revisions) (#54910)

Roll Skia from 0182585d38dd to 9d0039785ebd (4 revisions) (#54910) #67

name: Third party deps scan
on:
# Only the default branch is supported.
branch_protection_rule:
push:
branches: [ main ]
pull_request:
types: [ labeled ]
# Declare default permissions as read only.
permissions: read-all
jobs:
extract-deps:
name: Extract Dependencies
runs-on: ubuntu-20.04
if: ${{ (github.repository == 'flutter/engine' && github.event_name == 'push') || github.event.label.name == 'vulnerability scan' }}
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
security-events: write
contents: read
steps:
- name: "Checkout code"
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
with:
persist-credentials: false
- name: "setup python"
uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f
with:
python-version: '3.7.7' # install the python version needed
- name: "extract deps, find commit hash, pass to osv-scanner"
run: python ci/scan_deps.py --output osv-lockfile-${{github.sha}}.json
- name: "upload osv-scanner deps"
uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
with:
# use github.ref in name to avoid duplicated artifacts
name: osv-lockfile-${{github.sha}}
path: osv-lockfile-${{github.sha}}.json
retention-days: 2
vuln-scan:
name: Vulnerability scanning
needs:
extract-deps
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.8.4"
with:
# Download the artifact uploaded in extract-deps step
download-artifact: osv-lockfile-${{github.sha}}
scan-args: |-
--lockfile=osv-scanner:osv-lockfile-${{github.sha}}.json
fail-on-vuln: false
# makes sure the osv-formatted vulns are uploaded
permissions:
# Needed to upload the SARIF results to code-scanning dashboard.
security-events: write
actions: read
contents: read