From 593fd0a1780dafbf06c20ee845937ce9cdc1a38b Mon Sep 17 00:00:00 2001 From: Gavin D'souza Date: Mon, 20 Jun 2022 17:00:30 +0530 Subject: [PATCH] ci: Add audit for python dependencies via pip-audit --- .github/workflows/deps-checker.yml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 .github/workflows/deps-checker.yml diff --git a/.github/workflows/deps-checker.yml b/.github/workflows/deps-checker.yml new file mode 100644 index 0000000000..3f81b5c633 --- /dev/null +++ b/.github/workflows/deps-checker.yml @@ -0,0 +1,22 @@ +name: 'Python Dependency Check' +on: + pull_request: + workflow_dispatch: + push: + branches: [ develop ] + +permissions: + contents: read + +jobs: + deps-vulnerable-check: + name: 'Vulnerable Dependency' + runs-on: ubuntu-latest + + steps: + - uses: actions/setup-python@v4 + with: + python-version: 3.8 + - uses: actions/checkout@v3 + - run: pip install pip-audit + - run: pip-audit ${GITHUB_WORKSPACE}