cve_scan.yml

name: CVE scan

on:
  push:
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  cve_scan:
    name: CVE scan on dependencies
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
        with:
          egress-policy: audit

      - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
      - uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4.7.1
        with:
          python-version: '3.x'
          cache: 'pip'
          cache-dependency-path: '**/requirements.txt'
      - name: Get date
        id: get-date
        run: |
          echo "date=$(/bin/date -u "+%Y%m%d")" >> $GITHUB_OUTPUT
      - name: Get cached database
        uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
        with:
          path: cache
          key: Linux-cve-bin-tool-${{ steps.get-date.outputs.date }}
      - name: Install dependencies and cve-bin-tool
        run: |
          python -m pip install --upgrade pip
          python -m pip install --upgrade setuptools
          python -m pip install --upgrade wheel
          python -m pip install --upgrade pytest
          pip install . -r doc/requirements.txt
          [[ -e cache ]] && mkdir -p .cache && mv -f cache .cache/cve-bin-tool
          sleep 5
      - name: Test to check for CVEs for Python requirements and HTML report dependencies
        run: |
          pytest test/test_requirements.py