public-ui-kolibri

name: Daily CVE overview

env:
  issue: 9999

on:
  schedule:
    - cron: '30 1 * * *' # Runs daily at 01:30 UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  audit:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - base: develop
            version: v4
          - base: release/3
            version: v3
          - base: release/2
            version: v2
          - base: release/1
            version: v1
    env:
      version: ${{ matrix.version }}
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ matrix.base }}
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - uses: pnpm/action-setup@v4
        id: pnpm-install
        with:
          version: 10
          run_install: false
      - name: Get pnpm store directory
        id: pnpm-cache
        shell: bash
        run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
      - uses: actions/cache@v5
        with:
          path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
          key: ${{ runner.os }}-pnpm-store
          restore-keys: |
            ${{ runner.os }}-pnpm-store
      - name: Install
        run: pnpm i --frozen-lockfile
      - name: Run audit (production)
        run: pnpm audit --json --production > audit-prod.json || true
      - name: Run audit (all dependencies)
        run: pnpm audit --json > audit-all.json || true
      - name: Upload audit results
        uses: actions/upload-artifact@v6
        with:
          name: cve-audit-${{ matrix.version }}
          path: |
            audit-prod.json
            audit-all.json

  publish:
    runs-on: ubuntu-latest
    needs: audit
    steps:
      - uses: actions/checkout@v6
        with:
          ref: ${{ github.sha }}
          persist-credentials: false
      - uses: actions/setup-node@v6
        with:
          node-version: 22
      - uses: pnpm/action-setup@v4
        id: pnpm-install
        with:
          version: 10
          run_install: false
      - name: Install
        run: pnpm i --frozen-lockfile
      - name: Download audit results
        uses: actions/download-artifact@v7
        with:
          path: audits
      - name: Merge CVE overview
        run: node scripts/merge-cve-overview.mjs --output docs/CVE_OVERVIEW.md --audit-prod-v1 audits/cve-audit-v1/audit-prod.json --audit-v1 audits/cve-audit-v1/audit-all.json --audit-prod-v2 audits/cve-audit-v2/audit-prod.json --audit-v2 audits/cve-audit-v2/audit-all.json --audit-prod-v3 audits/cve-audit-v3/audit-prod.json --audit-v3 audits/cve-audit-v3/audit-all.json --audit-prod-v4 audits/cve-audit-v4/audit-prod.json --audit-v4 audits/cve-audit-v4/audit-all.json
      - name: Format generated markdown
        run: pnpm format
      - name: Clean up audit artifacts
        run: rm -rf audits/
      - name: Check for changes
        id: verify-changed-files
        run: |
          if [ -n "$(git status --porcelain)" ]; then
            echo "changed=true" >> $GITHUB_OUTPUT
          else
            echo "changed=false" >> $GITHUB_OUTPUT
          fi
      - name: Create Pull Request
        if: steps.verify-changed-files.outputs.changed == 'true'
        uses: peter-evans/create-pull-request@v8
        with:
          base: develop
          branch: ${{ env.issue }}/cve-overview
          commit-message: 'chore: update CVE overview'
          title: 'chore: update CVE overview'
          body: 'Automated CVE overview update from issue #${{ env.issue }}.'
          delete-branch: true