Files
advisory-db/.github/workflows/export-osv.yml
William Woodruff d43d0de229 ci: ratchet down permissions, pin all actions (#2444)
Signed-off-by: William Woodruff <william@astral.sh>
2025-10-26 12:38:01 +01:00

40 lines
1.2 KiB
YAML

name: Export to OSV format
on:
push:
branches: main
permissions: {}
jobs:
publish-web:
runs-on: ubuntu-latest
permissions:
contents: write # needed for pushing back to the repo
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
ref: osv
persist-credentials: true # persists the token for git push below
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
id: admin-cache
with:
path: ~/.cargo/bin
key: rustsec-admin-c7f56c474e01619b78b9c39bdb626d982f3bee90
- name: Install rustsec-admin
if: steps.admin-cache.outputs.cache-hit != 'true'
run: cargo install --git https://github.com/rustsec/rustsec rustsec-admin --rev c7f56c474e01619b78b9c39bdb626d982f3bee90
- run: |
mkdir -p crates
rustsec-admin osv crates
# FIXME: hack to avoid committing advisories without an ID
rm -f crates/RUSTSEC-0000-0000.json
git config user.name github-actions
git config user.email github-actions@github.com
git add .
git commit -m "Update OSV exported data" || true
git push || true