study-app-multitenant/.github/workflows/dependency-audit.yml at develop · osushi0404-dev/study-app-multitenant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
name: Dependency Audit

# I109: 依存脆弱性ドリフトの定期検知。
# PR ゲート（ci.yml）と同一ツール・同一条件で develop を毎日監査し、
# fail 時に scripts/claude/dependency-audit-issue.sh がイシューを自動起票する。
# 監査コマンドは ci.yml と一致させること（test_i109_dependency_audit.sh がペア検証）。

on:
  schedule:
    - cron: '0 22 * * *'  # UTC 22:00 = JST 翌朝 7:00（毎日）
  workflow_dispatch:
    inputs:
      simulate_failure:
        description: '検知動作テスト用: 監査を強制 fail させる対象'
        type: choice
        options:
          - none
          - backend
          - frontend
        default: none

permissions:
  contents: read
  issues: write

jobs:
  backend-audit:
    name: Backend Dependency Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: develop   # default branch がどちらでも監査対象を develop に固定
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: '3.11'
          cache: 'pip'
          cache-dependency-path: backend/requirements-dev.txt
      - name: Install dev dependencies
        run: pip install -r backend/requirements-dev.txt
      - name: pip-audit
        working-directory: backend
        run: |
          if [ "${{ inputs.simulate_failure }}" = "backend" ]; then
            echo "SIMULATED FAILURE (workflow_dispatch テスト)" | tee /tmp/audit_backend.txt
            exit 1
          fi
          set -o pipefail
          pip-audit -r requirements.txt 2>&1 | tee /tmp/audit_backend.txt
      - name: Report failure as issue
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash scripts/claude/dependency-audit-issue.sh backend /tmp/audit_backend.txt

  frontend-audit:
    name: Frontend Dependency Audit
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with:
          ref: develop
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: '18'
      - name: npm audit
        working-directory: frontend
        run: |
          if [ "${{ inputs.simulate_failure }}" = "frontend" ]; then
            echo "SIMULATED FAILURE (workflow_dispatch テスト)" | tee /tmp/audit_frontend.txt
            exit 1
          fi
          set -o pipefail
          npm audit --audit-level=critical --omit=dev 2>&1 | tee /tmp/audit_frontend.txt
      - name: Report failure as issue
        if: failure()
        env:
          GH_TOKEN: ${{ github.token }}
        run: bash scripts/claude/dependency-audit-issue.sh frontend /tmp/audit_frontend.txt