PrivateMusicDesktop/.github/workflows/dependency-security.yml at main · decoder-dev/PrivateMusicDesktop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
name: Dependency security
on:
  push:
    branches: [main]
    paths: ["**/Cargo.toml", "**/Cargo.lock", "**/*.gradle.kts", "**/*.gradle", "**/gradle.properties", ".github/workflows/dependency-security.yml", "scripts/security-android-prepare.sh"]
  pull_request:
    branches: [main]
  schedule:
    - cron: '37 3 * * 1'
  workflow_dispatch:
permissions:
  contents: read
jobs:
  audit:
    if: github.event_name != 'pull_request'
    name: Rust advisories (cargo-audit)
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
        with:
          persist-credentials: false
      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
        id: tool
        with:
          path: ~/.cargo/bin/cargo-audit
          key: cargo-audit-0.22.2-ubuntu-24.04
      - name: Install cargo-audit
        if: steps.tool.outputs.cache-hit != 'true'
        run: cargo install cargo-audit --version 0.22.2 --locked
      # Known vulnerabilities fail the job; unmaintained-crate warnings (Tauri/zbus internals) do not.
      # Accepted exceptions are in .cargo/audit.toml, each with a reason.
      - name: Audit Cargo.lock
        run: cargo audit
  review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high
          license-check: false
          comment-summary-in-pr: never
          retry-on-snapshot-warnings: true
          retry-on-snapshot-warnings-timeout: 120
  gradle-dependencies:
    if: github.event_name != 'pull_request'
    name: Android dependencies (${{ matrix.plugin }})
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: write
    strategy:
      fail-fast: false
      matrix:
        plugin: [media-session, vk-login]
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Android SDK and Tauri API sources
        run: bash scripts/security-android-prepare.sh
      - uses: gradle/actions/dependency-submission@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
        env:
          # Report what ships in the APK, not Gradle/AGP build tooling that Dependabot cannot update.
          DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: '(debug|release)RuntimeClasspath'
        with:
          gradle-version: '9.6.1' # Match the Android wrappers and AGP 9.3.x.
          build-root-directory: plugins/${{ matrix.plugin }}/android
          cache-provider: basic
          dependency-graph: generate-and-submit