generated from actions/javascript-action
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
bc56426
commit bf31f39
Showing
3 changed files
with
37 additions
and
170 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,182 +1,59 @@ | ||
| # VulnAPI GitHub Action | ||
|
|
||
| [](https://github.com/cerberauth/vulnapi-action) | ||
|  | ||
|
|
||
| Use this action to scan your project for vulnerabilities using the VulnAPI. | ||
|
|
||
| ## Initial Setup | ||
|
|
||
| After you've cloned the repository to your local machine or codespace, you'll | ||
| need to perform some initial setup steps before you can develop your action. | ||
|
|
||
| > [!NOTE] | ||
| > | ||
| > You'll need to have a reasonably modern version of | ||
| > [Node.js](https://nodejs.org) handy. If you are using a version manager like | ||
| > [`nodenv`](https://github.com/nodenv/nodenv) or | ||
| > [`nvm`](https://github.com/nvm-sh/nvm), you can run `nodenv install` in the | ||
| > root of your repository to install the version specified in | ||
| > [`package.json`](./package.json). Otherwise, 20.x or later should work! | ||
| 1. :hammer_and_wrench: Install the dependencies | ||
|
|
||
| ```bash | ||
| npm install | ||
| ``` | ||
|
|
||
| 1. :building_construction: Package the JavaScript for distribution | ||
|
|
||
| ```bash | ||
| npm run bundle | ||
| ``` | ||
|
|
||
| 1. :white_check_mark: Run the tests | ||
|
|
||
| ```bash | ||
| $ npm test | ||
|
|
||
| PASS ./index.test.js | ||
| ✓ throws invalid number (3ms) | ||
| ✓ wait 500 ms (504ms) | ||
| ✓ test runs (95ms) | ||
|
|
||
| ... | ||
| ``` | ||
|
|
||
| ## Update the Action Metadata | ||
|
|
||
| The [`action.yml`](action.yml) file defines metadata about your action, such as | ||
| input(s) and output(s). For details about this file, see | ||
| [Metadata syntax for GitHub Actions](https://docs.github.com/en/actions/creating-actions/metadata-syntax-for-github-actions). | ||
|
|
||
| When you copy this repository, update `action.yml` with the name, description, | ||
| inputs, and outputs for your action. | ||
|
|
||
| ## Update the Action Code | ||
| Find out more about the VulnAPI project at [https://github.com/cerberauth/vulnapi](https://github.com/cerberauth/vulnapi). | ||
|
|
||
| The [`src/`](./src/) directory is the heart of your action! This contains the | ||
| source code that will be run when your action is invoked. You can replace the | ||
| contents of this directory with your own code. | ||
| ## Example usage | ||
|
|
||
| There are a few things to keep in mind when writing your action code: | ||
|
|
||
| - Most GitHub Actions toolkit and CI/CD operations are processed asynchronously. | ||
| In `main.js`, you will see that the action is run in an `async` function. | ||
|
|
||
| ```javascript | ||
| const core = require('@actions/core') | ||
| //... | ||
|
|
||
| async function run() { | ||
| try { | ||
| //... | ||
| } catch (error) { | ||
| core.setFailed(error.message) | ||
| } | ||
| } | ||
| ``` | ||
|
|
||
| For more information about the GitHub Actions toolkit, see the | ||
| [documentation](https://github.com/actions/toolkit/blob/master/README.md). | ||
|
|
||
| So, what are you waiting for? Go ahead and start customizing your action! | ||
|
|
||
| 1. Create a new branch | ||
|
|
||
| ```bash | ||
| git checkout -b releases/v1 | ||
| ``` | ||
|
|
||
| 1. Replace the contents of `src/` with your action code | ||
| 1. Add tests to `__tests__/` for your source code | ||
| 1. Format, test, and build the action | ||
| ```yaml | ||
| name: VulnAPI | ||
|
|
||
| ```bash | ||
| npm run all | ||
| ``` | ||
| on: [push] | ||
|
|
||
| > [!WARNING] | ||
| > | ||
| > This step is important! It will run [`ncc`](https://github.com/vercel/ncc) | ||
| > to build the final JavaScript action code with all dependencies included. | ||
| > If you do not run this step, your action will not work correctly when it is | ||
| > used in a workflow. This step also includes the `--license` option for | ||
| > `ncc`, which will create a license file for all of the production node | ||
| > modules used in your project. | ||
| permissions: | ||
| contents: read | ||
|
|
||
| 1. Commit your changes | ||
| jobs: | ||
| build: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| ```bash | ||
| git add . | ||
| git commit -m "My first action is ready!" | ||
| ``` | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
|
|
||
| 1. Push them to your repository | ||
| - name: VulnAPI | ||
| uses: cerberauth/vulnapi-action@v1 | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| with: | ||
| curl: 'curl http://localhost:8080 -H "Authorization: Bearer eyJhbGci..."' | ||
| ``` | ||
| ```bash | ||
| git push -u origin releases/v1 | ||
| ``` | ||
| ## Inputs | ||
| 1. Create a pull request and get feedback on your action | ||
| 1. Merge the pull request into the `main` branch | ||
| ### General | ||
| Your action is now published! :rocket: | ||
| | Name | Required | Description | Default | | ||
| |---------|----------|-------------| -------- | | ||
| | version | false | The version of the file to scan. | latest | | ||
| For information about versioning your action, see | ||
| [Versioning](https://github.com/actions/toolkit/blob/master/docs/action-versioning.md) | ||
| in the GitHub Actions toolkit. | ||
| ### Curl Scan Options | ||
| ## Validate the Action | ||
| | Name | Required | Description | Default | | ||
| |---------|----------|-------------| -------- | | ||
| | curl_command | true | The curl command to scan. | | | ||
| You can now validate the action by referencing it in a workflow file. For | ||
| example, [`ci.yml`](./.github/workflows/ci.yml) demonstrates how to reference an | ||
| action in the same repository. | ||
| ### OpenAPI Scan Options | ||
| ```yaml | ||
| steps: | ||
| - name: Checkout | ||
| id: checkout | ||
| uses: actions/checkout@v3 | ||
|
|
||
| - name: Test Local Action | ||
| id: test-action | ||
| uses: ./ | ||
| with: | ||
| milliseconds: 1000 | ||
|
|
||
| - name: Print Output | ||
| id: output | ||
| run: echo "${{ steps.test-action.outputs.time }}" | ||
| ``` | ||
| | Name | Required | Description | Default | | ||
| |---------|----------|-------------| -------- | | ||
| | openapi_url | true | The URL to scan. | | | ||
| For example workflow runs, check out the | ||
| [Actions tab](https://github.com/actions/javascript-action/actions)! :rocket: | ||
| ## Outputs | ||
| ## Usage | ||
| No outputs. | ||
| After testing, you can create version tag(s) that developers can use to | ||
| reference different stable versions of your action. For more information, see | ||
| [Versioning](https://github.com/actions/toolkit/blob/master/docs/action-versioning.md) | ||
| in the GitHub Actions toolkit. | ||
| ## License | ||
| To include the action in a workflow in another repository, you can use the | ||
| `uses` syntax with the `@` symbol to reference a specific branch, tag, or commit | ||
| hash. | ||
|
|
||
| ```yaml | ||
| steps: | ||
| - name: Checkout | ||
| id: checkout | ||
| uses: actions/checkout@v4 | ||
| - name: Run my Action | ||
| id: run-action | ||
| uses: actions/javascript-action@v1 # Commit with the `v1` tag | ||
| with: | ||
| milliseconds: 1000 | ||
|
|
||
| - name: Print Output | ||
| id: output | ||
| run: echo "${{ steps.run-action.outputs.time }}" | ||
| ``` | ||
| This project is licensed under the MIT License - see the [LICENSE](./LICENSE) file for details. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters