audit security vulnerabilities as part of ci (actions#280)

digitaldataservice · Jan 3, 2020 · 803934e · 803934e
1 parent 4e69ce1
commit 803934e
Show file tree

Hide file tree

Showing 11 changed files with 18 additions and 19 deletions.
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
@@ -47,3 +47,9 @@ jobs:
 
     - name: Format
       run: npm run format-check
+
+    - name: audit tools
+      run: npm audit --audit-level=moderate
+
+    - name: audit packages
+      run: npm run audit-all
diff --git a/package.json b/package.json
@@ -2,6 +2,7 @@
   "name": "root",
   "private": true,
   "scripts": {
+    "audit-all": "lerna run audit-moderate",
     "bootstrap": "lerna bootstrap",
     "build": "lerna run tsc",
     "check-all": "concurrently \"npm:format-check\" \"npm:lint\" \"npm:test\" \"npm:build -- -- --noEmit\"",

diff --git a/packages/core/package.json b/packages/core/package.json
@@ -27,6 +27,7 @@
     "directory": "packages/core"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "echo \"Error: run tests from root\" && exit 1",
     "tsc": "tsc"
   },

diff --git a/packages/exec/package-lock.json b/packages/exec/package-lock.json
diff --git a/packages/exec/package.json b/packages/exec/package.json
@@ -27,6 +27,7 @@
     "directory": "packages/exec"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "echo \"Error: run tests from root\" && exit 1",
     "tsc": "tsc"
   },

diff --git a/packages/github/package.json b/packages/github/package.json
@@ -26,6 +26,7 @@
     "directory": "packages/github"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "jest",
     "build": "tsc",
     "format": "prettier --write **/*.ts",

diff --git a/packages/glob/package-lock.json b/packages/glob/package-lock.json
diff --git a/packages/glob/package.json b/packages/glob/package.json
@@ -28,6 +28,7 @@
     "directory": "packages/glob"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "echo \"Error: run tests from root\" && exit 1",
     "tsc": "tsc"
   },

diff --git a/packages/io/package-lock.json b/packages/io/package-lock.json
diff --git a/packages/io/package.json b/packages/io/package.json
@@ -27,6 +27,7 @@
     "directory": "packages/io"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "echo \"Error: run tests from root\" && exit 1",
     "tsc": "tsc"
   },

diff --git a/packages/tool-cache/package.json b/packages/tool-cache/package.json
@@ -28,15 +28,16 @@
     "directory": "packages/tool-cache"
   },
   "scripts": {
+    "audit-moderate": "npm install && npm audit --audit-level=moderate",
     "test": "echo \"Error: run tests from root\" && exit 1",
     "tsc": "tsc"
   },
   "bugs": {
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^1.1.0",
-    "@actions/exec": "^1.0.1",
+    "@actions/core": "^1.2.0",
+    "@actions/exec": "^1.0.0",
     "@actions/io": "^1.0.1",
     "semver": "^6.1.0",
     "typed-rest-client": "^1.4.0",