update-insecure-dependencies.yaml

name: "Update insecure dependencies"
on:
  workflow_dispatch: {}
  schedule:
    - cron: 0 3 * * *
permissions: read-all
jobs:
  build-matrix:
    timeout-minutes: 10
    runs-on: ubuntu-latest
    outputs:
      branches: ${{ steps.generate-matrix.outputs.branches }}
    steps:
      - id: generate-matrix
        run: |
          # The head -1 is because GITHUB_OUTPUT is easier to work with single line output and this file is created with automation in `lifecycle.yaml`
          ACTIVE_BRANCHES=`gh api /repos/${{ github.repository }}/contents/active-branches.json --jq '.content | @base64d' | head -1`
          echo "branches=${ACTIVE_BRANCHES}" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ github.token }}
  update-insecure-dependencies:
    env:
      OSV_SCANNER_ADDITIONAL_OPTS: ""
    timeout-minutes: 20
    needs:
      - build-matrix
    strategy:
      fail-fast: false
      matrix:
        branch: ${{ fromJSON(needs.build-matrix.outputs.branches) }}
    runs-on: ubuntu-latest
    steps:
      - name: Set Swap Space
        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c
        with:
          swap-size-gb: 10
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ matrix.branch }}
      - uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
        with:
          go-version-file: go.mod
      - name: "Install tools"
        run: |
          go install github.com/google/osv-scanner/cmd/osv-scanner@037c3543ac60359190459b10fbb5331568b4c8f5 # v1.7.0
      - name: "Prepare commit body - before"
        id: prepare_commit_body_before
        run: |
          SCAN_OUTPUT_BEFORE=$(osv-scanner $OSV_SCANNER_ADDITIONAL_OPTS --lockfile=go.mod | tr "+" "|" | awk 'NR>3 {print last} {last=$0}' || true)
          echo "SCAN_OUTPUT_BEFORE<<EOF" >> $GITHUB_ENV
          echo "$SCAN_OUTPUT_BEFORE" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV
      - name: "Update dependencies"
        id: update
        run: |
          make update-vulnerable-dependencies
      - name: "Prepare commit body - after"
        id: prepare_commit_body_after
        run: |
          SCAN_OUTPUT_AFTER=$(osv-scanner $OSV_SCANNER_ADDITIONAL_OPTS --lockfile=go.mod | tr "+" "|" | awk 'NR>3 {print last} {last=$0}' || true)
          echo "SCAN_OUTPUT_AFTER<<EOF" >> $GITHUB_ENV
          echo "$SCAN_OUTPUT_AFTER" >> $GITHUB_ENV
          echo "EOF" >> $GITHUB_ENV
      - name: Generate GitHub app token
        id: github-app-token
        uses: actions/create-github-app-token@3378cda945da322a8db4b193e19d46352ebe2de5 # v1.10.4
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
      - name: "Create Pull Request"
        uses: peter-evans/create-pull-request@8867c4aba1b742c39f8d0ba35429c2dfa4b6cb20 # v7.0.1
        with:
          commit-message: "chore(deps): security update"
          signoff: true
          branch: chore/security-updates-${{ matrix.branch }}
          body: |
            Scan output:

            Before update:
            ${{ env.SCAN_OUTPUT_BEFORE }}

            After update:
            ${{ env.SCAN_OUTPUT_AFTER }}

            If a package is showing up in the scan but the script is not trying to update it then it might be because there is no fixed version yet.
          delete-branch: true
          title: "chore(deps): security update"
          draft: false
          labels: dependencies,${{ matrix.branch }}
          token: ${{ steps.github-app-token.outputs.token }}
          committer: kumahq[bot] <110050114+kumahq[bot]@users.noreply.github.com>
          author: kumahq[bot] <110050114+kumahq[bot]@users.noreply.github.com>