blob: 66f27ceabd1c8b63fee72943b4a0b6111d1ec2f4 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
# This workflow triggers after cargo-vet workflow has run.
# It adds a comment to the PR with the results of the cargo vet run.
# It first adds a comment if the cargo vet run fails,
# and updates the comment if the cargo vet run succeeds after having failed at least once.
name: Cargo vet PR comment
on:
workflow_run:
workflows: [cargo-vet]
types:
- completed
permissions:
contents: read
pull-requests: write
concurrency:
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
cancel-in-progress: true
jobs:
find-pr-comment:
# This job runs when the cargo-vet job fails or succeeds
# It will download the artifact from the failed job and post a comment on the PR
runs-on: ubuntu-latest
outputs:
comment-id: ${{ steps.get-comment-id.outputs.comment-id }}
pr-number: ${{ steps.get-pr-number.outputs.pr_number }}
if: github.event.workflow_run.event == 'pull_request'
steps:
- name: 'Download artifact'
uses: actions/download-artifact@v6
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
name: pr
path: pr/
run-id: ${{ github.event.workflow_run.id }}
- name: 'Get PR number'
id: get-pr-number
run: echo "pr_number=$(cat ./pr/NR)" >> $GITHUB_OUTPUT
- name: 'Find existing comment'
id: find-comment
uses: peter-evans/find-comment@v4
with:
issue-number: ${{ steps.get-pr-number.outputs.pr_number }}
comment-author: 'github-actions[bot]'
body-includes: 'comment-tag: [cargo-vet]'
- name: 'Get comment ID'
id: get-comment-id
if: ${{ steps.find-comment.outputs.comment-id != '' }}
run: echo "comment-id=${{ steps.find-comment.outputs.comment-id }}" >> $GITHUB_OUTPUT
post-comment-failure:
# This job runs when the cargo-vet job fails
# It will download the artifact from the failed job and post a comment on the PR
runs-on: ubuntu-latest
needs: find-pr-comment
if: github.event.workflow_run.conclusion == 'failure'
steps:
- name: 'Comment on PR - Failure'
uses: peter-evans/create-or-update-comment@v5
with:
comment-id: ${{ needs.find-pr-comment.outputs.comment-id }}
issue-number: ${{ needs.find-pr-comment.outputs.pr-number }}
body: |
# Cargo Vet Audit Failed
`cargo vet` has failed in this PR. Please run `cargo vet --locked` locally to check for new or updated unvetted dependencies.
Details about the vetting process can be found in [supply-chain/README.md](../blob/main/supply-chain/README.md)
## If the unvetted dependencies are not needed
Please modify Cargo.toml file to avoid including the dependencies.
## If the unvetted dependencies are needed
Post a new comment with the questionnaire below to the PR to help the auditors vet the dependencies.
After the auditors have vetted the dependencies, the PR will need to be rebased to pick up the new audits and pass this check.
### Copy and paste the questionnaire as a new comment and provide your answers:
**1. What crates (with version) need to be audited?**
**2. How many of the crates are version updates vs new dependencies?**
**3. To confirm none of the already included crates serve your needs, please provide a brief description of the purpose of the new crates.**
**4. Any extra notes to the auditors to help with their audits.**
<!--
This comment is auto-generated by the cargo-vet workflow.
Please do not edit it directly.
comment-tag: [cargo-vet]
-->
edit-mode: replace
- name: 'Label PR'
uses: actions/github-script@v8
with:
script: |
github.rest.issues.addLabels({
issue_number: ${{ needs.find-pr-comment.outputs.pr-number }},
owner: context.repo.owner,
repo: context.repo.repo,
labels: ['cargo vet']
})
post-comment-success:
# This job runs when the cargo-vet job succeeds
# It will update the comment on the PR with a success message
runs-on: ubuntu-latest
needs: find-pr-comment
if: github.event.workflow_run.conclusion == 'success'
steps:
- name: 'Comment on PR - Success'
# Only update the comment if it exists
# This is to avoid creating a new comment if the cargo-vet job has never failed before
if: ${{ needs.find-pr-comment.outputs.comment-id }}
uses: peter-evans/create-or-update-comment@v5
with:
comment-id: ${{ needs.find-pr-comment.outputs.comment-id }}
issue-number: ${{ needs.find-pr-comment.outputs.pr-number }}
body: |
# Cargo Vet Audit Passed
`cargo vet` has passed in this PR. No new unvetted dependencies were found.
<!--
This comment is auto-generated by the cargo-vet workflow.
Please do not edit it directly.
comment-tag: [cargo-vet]
-->
edit-mode: replace
|
