Nightly audit #1003
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Nightly audit | |
| on: | |
| schedule: | |
| - cron: '30 4 * * *' | |
| workflow_dispatch: | |
| push: | |
| tags: | |
| - audit* | |
| jobs: | |
| vci-directory-audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| with: | |
| ref: main | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: actions/setup-node@v2 | |
| with: | |
| node-version: '14' | |
| - name: npm setup | |
| run: | | |
| cd scripts/vci-directory-auditor | |
| npm install | |
| npm run build --if-present | |
| - name: run audit scripts | |
| run: | | |
| cd scripts/vci-directory-auditor | |
| npm run audit -- -o ../../logs/new_log.json -p ../../logs/daily_log.json -s ../../logs/daily_log_snapshot.json -a ../../logs/daily_audit.json -d ../../vci-issuers.json | |
| mv ../../logs/new_log.json ../../logs/daily_log.json | |
| npm run assemble -- -s ../../logs/vci_snapshot.json -c ../../logs/daily_log_snapshot.json | |
| - name: sign snapshot | |
| env: | |
| PRIVATE_SIG_KEY_PWD: ${{ secrets.PRIVATE_SIG_KEY_PWD }} | |
| PRIVATE_SIG_KEY: ${{ secrets.PRIVATE_SIG_KEY }} | |
| run: | | |
| echo "$PRIVATE_SIG_KEY" > private.pem | |
| openssl dgst -sha512 -sign private.pem -out logs/vci_snapshot.sig -passin env:PRIVATE_SIG_KEY_PWD logs/vci_snapshot.json | |
| rm private.pem | |
| test-scripts-job: | |
| needs: vci-directory-audit | |
| uses: the-commons-project/vci-directory/.github/workflows/test-scripts-pass.yaml@main | |
| with: | |
| ref: main | |
| secrets: inherit | |
| validate-issuers-job: | |
| needs: test-scripts-job | |
| uses: the-commons-project/vci-directory/.github/workflows/validate-issuers-on-push-pass.yaml@main | |
| with: | |
| ref: main | |
| secrets: inherit | |
| git-push-job: | |
| needs: [vci-directory-audit, test-scripts-job, validate-issuers-job] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout the repository | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: main | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: git check in | |
| env: | |
| GIT_OWNER_EMAIL: ${{ secrets.GIT_OWNER_EMAIL }} | |
| GIT_OWNER_NAME: ${{ secrets.GIT_OWNER_NAME }} | |
| GIT_REPO_PATH: ${{ secrets.GIT_REPO_PATH }} | |
| GIT_PUSH_TOKEN: ${{ secrets.GIT_PUSH_TOKEN }} | |
| run: | | |
| git config user.email "$GIT_OWNER_EMAIL" | |
| git config user.name "$GIT_OWNER_NAME" | |
| if [[ `git status --porcelain` ]]; then | |
| git add -f logs/daily_log.json | |
| git add -f logs/daily_log_snapshot.json | |
| git add -f logs/daily_audit.json | |
| git add -f logs/vci_snapshot.json | |
| git add -f logs/vci_snapshot.sig | |
| git commit -a -m "daily dir and audit snapshot" | |
| COMMIT=$(git rev-parse HEAD) | |
| DATETIME=$(git log -n 1 --no-decorate --date=iso-strict -- logs/daily_log.json | head -3 | grep Date | cut -c 9-) | |
| echo $COMMIT, $DATETIME >> logs/audit-index.csv | |
| git add -f logs/audit-index.csv | |
| git commit -a -m "added commit hash to audit index" | |
| git remote add myorigin https://$GIT_OWNER_NAME:[email protected]/$GIT_REPO_PATH/vci-directory.git | |
| git pull --rebase | |
| git push myorigin HEAD:main | |
| else | |
| echo 'no changes' | |
| fi | |
| - name: save log files | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: save-log-files | |
| path: logs/* |