Skip to content
This repository was archived by the owner on Jun 6, 2025. It is now read-only.
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
7606157
Move testing from CircleCI to Github Actions
Janell-Huyck May 22, 2025
a877862
Add usage_notes.md for github actions
Janell-Huyck May 22, 2025
6a6c3dd
Add ruby installation to setup-ruby-deps/action.yml
Janell-Huyck May 23, 2025
610ba00
Put correct file at .github/actions/migrate/action.yml
Janell-Huyck May 23, 2025
e1e337f
Disable spring when running migrations
Janell-Huyck May 23, 2025
df3e65e
Disable spring when running tests
Janell-Huyck May 23, 2025
768d0c8
Stop caching webpack assets and build every time
Janell-Huyck May 23, 2025
8e9d389
Remove checking out code from the migrate action
Janell-Huyck May 23, 2025
0bf4660
Make spec/support/capybara.rb look for ENV['CHROME_BIN'] variable
Janell-Huyck May 23, 2025
89a03aa
Restore spec_helper to qa version
Janell-Huyck May 23, 2025
307406f
Restore Gemfile to qa version
Janell-Huyck May 23, 2025
d4239a4
Add GitHub Actions workflow to run bundler-audit and fail on high-ris…
Janell-Huyck May 27, 2025
c661430
Intentionally un-ignore CVE-2022-25765
Janell-Huyck May 27, 2025
95f5eb4
Allow bundler-audit to exit with code 1 for vulnerability findings wi…
Janell-Huyck May 27, 2025
c8fdf01
Remove obsolete bundler-audit ignore, add nokogiri ignore
Janell-Huyck May 27, 2025
f8d00a6
Merge branch 'qa' into LIBTREATDB-144-run-bundler-audit-via-github-wo…
Janell-Huyck May 28, 2025
18c0436
Update regex check for Critical/High, intentionally fail with a high-…
Janell-Huyck May 28, 2025
7335a0e
Remove .bundler-audit file
Janell-Huyck May 28, 2025
a294f28
Re-add .bundler_audit.yml
Janell-Huyck May 28, 2025
d2bf1fa
Look for Criticality: Critical/High
Janell-Huyck May 28, 2025
4fd1356
Don't ignore known vulnerability
Janell-Huyck May 28, 2025
8379942
Add fake issue to ignore
Janell-Huyck May 28, 2025
7a69f00
Add fake issue to ignore
Janell-Huyck May 28, 2025
bd4c065
Restore correct .bundler-audit ignore
Janell-Huyck May 28, 2025
24d2fd8
Merge branch 'qa' into LIBTREATDB-144-run-bundler-audit-via-github-wo…
Janell-Huyck Jun 2, 2025
ef361de
Update Gemfile after merging in QA
Janell-Huyck Jun 2, 2025
acff8bf
test 144
hortongn Jun 2, 2025
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .bundler-audit.yml

This file was deleted.

46 changes: 46 additions & 0 deletions .github/workflows/bundler-audit.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
name: Ensure Bundler-Audit Passes

on:
pull_request:
types: [opened, synchronize, reopened]

jobs:
bundler-audit:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3

- name: Set up Ruby and install gems
uses: ./.github/actions/setup-ruby-deps

- name: Run Bundler-Audit
run: |
mkdir -p tmp
# Allow bundler-audit to return 1 (vulnerabilities found) without failing the step
set +e
bundle exec bundler-audit check --update > tmp/bundler-audit-output.txt
AUDIT_EXIT=$?
set -e
if [ $AUDIT_EXIT -ne 0 ] && [ $AUDIT_EXIT -ne 1 ]; then
echo "bundler-audit failed unexpectedly (exit code $AUDIT_EXIT)"
exit $AUDIT_EXIT
fi
shell: bash

- name: Analyze Bundler-Audit Output
run: |
if grep -Eq '^Criticality:\s*(Critical|High)' tmp/bundler-audit-output.txt; then
echo "High or Critical vulnerabilities detected!"
cat tmp/bundler-audit-output.txt
exit 1
else
echo "No High or Critical vulnerabilities detected."
fi
shell: bash

- name: Upload Bundler-Audit Report
uses: actions/upload-artifact@v4
with:
name: bundler-audit-report
path: tmp/bundler-audit-output.txt
2 changes: 1 addition & 1 deletion Gemfile.lock
Original file line number Diff line number Diff line change
Expand Up @@ -377,11 +377,11 @@ PLATFORMS
aarch64-linux
aarch64-linux-gnu
aarch64-linux-musl
arm64-darwin-23
arm-linux
arm-linux-gnu
arm-linux-musl
arm64-darwin
arm64-darwin-23
x86-linux
x86-linux-gnu
x86-linux-musl
Expand Down
Loading