diff --git a/README.md b/README.md index 3565aae..923e0e0 100644 --- a/README.md +++ b/README.md @@ -13,8 +13,8 @@ to perform an audit for crates with security vulnerabilities. ### Audit changes We can utilize the GitHub Actions ability to execute workflow -only if [specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths) -and execute this Action to check the changed dependencies only: +only if [the specific files were changed](https://help.github.com/en/articles/workflow-syntax-for-github-actions#onpushpull_requestpaths) +and execute this Action to check the changed dependencies: ```yaml name: Security audit @@ -33,7 +33,14 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} ``` -In that case this Action will create a Check with the advisories found: +It is recommended to add the `paths:` section into the workflow file, +as it would effectively speed up the CI pipeline, since the audit process +will not be performed if no dependencies were changed. + + +In case of any security advisories found, [status check](https://help.github.com/en/articles/about-status-checks) +created by this Action will be marked as "failed".\ +Note that informational advisories are not affecting the check status. ![Check screenshot](.github/check_screenshot.png) @@ -42,12 +49,13 @@ In that case this Action will create a Check with the advisories found: Due to [token permissions](https://help.github.com/en/articles/virtual-environments-for-github-actions#token-permissions), this Action **WILL NOT** be able to create Checks for Pull Requests from the forked repositories, see [actions-rs/clippy-check#2](https://github.com/actions-rs/clippy-check/issues/2) for details.\ -As a fallback this Action will output all advisories found to the stdout. +As a fallback this Action will output all found advisories to the stdout.\ +It is expected that this behavior will be fixed later by GitHub. ## Scheduled audit Another option is to use [`schedule`](https://help.github.com/en/articles/events-that-trigger-workflows#scheduled-events-schedule) event -and execute this Action periodically against the repository default branch `HEAD`. +and execute this Action periodically against the `HEAD` of repository default branch. ```yaml name: Security audit @@ -64,9 +72,9 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} ``` -With this workflow Action will be executed at midnight on each day +With this example Action will be executed periodically at midnight of each day and check if there any new advisories appear for crate dependencies.\ -For each such advisory an issue will be created: +For each new advisory (including informal) an issue will be created: ![Issue screenshot](.github/issue_screenshot.png) @@ -74,4 +82,4 @@ For each such advisory an issue will be created: | Name | Required | Description | Type | Default | | ------------| -------- | -------------------------------------------------------------------------| ------ | --------| -| `token` | ✓ | GitHub token, `${{ secrets.GITHUB_TOKEN }}` | string | | +| `token` | ✓ | GitHub token, usually a `${{ secrets.GITHUB_TOKEN }}` | string | |