Check branch vulnerabilities

action.yml

@@ -39,6 +39,10 @@ inputs:
   test-junit-path:
     required: false
     description: 'Paths (newline-separated glob patterns) of JUnit XML files containing test results'
+  report-vulnerabilities:
+    required: false
+    description: 'Whether to report vulnerabilities found for dependencies'
+    default: 'false'
   check-dependencies-status:
     required: false
     description: 'Checks the status of dependencies, and fails the build if not all dependencies in the current commit are accepted and controlled'

src/input.ts

@@ -11,6 +11,7 @@ export type ActionInput = {
   artifactPath: string[];
   testCucumberPath: string[];
   testJunitPath: string[];
+  reportVulnerabilities: boolean;
   checkDependenciesStatus: boolean;
   checkReleaseStatus: boolean;
 };
@@ -38,6 +39,7 @@ export function readActionInput(): ActionInput {
 
   const log = core.getInput('log');
 
+  const reportVulnerabilities = core.getBooleanInput('report-vulnerabilities');
   const checkDependenciesStatus = core.getBooleanInput(
     'check-dependencies-status'
   );
@@ -59,6 +61,7 @@ export function readActionInput(): ActionInput {
     testCucumberPath,
     testJunitPath,
     buildName,
+    reportVulnerabilities,
     checkDependenciesStatus,
     checkReleaseStatus,
   };

src/main.ts

@@ -46,6 +46,16 @@ async function run(): Promise<void> {
       core.setFailed(`Failure reporting build to Ketryx: ${buildData.error}`);
     }
 
+    if (buildData.vulnerabilities) {
+      core.info(`Vulnerabilities: ${buildData.vulnerabilities.length}`);
+      for (const vulnerability of buildData.vulnerabilities) {
+        core.error(vulnerability.summary, {
+          file: vulnerability.filePaths[0],
+          title: vulnerability.dependencyName,
+        });
+      }
+    }
+
     core.setOutput('ok', buildData.ok);
     core.setOutput('error', buildData.error);
     core.setOutput('build-id', buildData.buildId);

src/upload.ts

@@ -25,6 +25,7 @@ type BuildApiInputData = {
     log?: string;
   }>;
   artifacts?: Array<ArtifactData>;
+  returnVulnerabilities?: boolean;
   checkDependenciesStatus?: boolean;
   checkReleaseStatus?: boolean;
 };
@@ -40,6 +41,18 @@ type BuildApiResponseData = {
   dependenciesAccepted?: boolean | null;
   dependenciesControlled?: boolean | null;
   versionsReleased?: boolean | null;
+  vulnerabilities?: VulnerabilityReturnData[];
+};
+
+type VulnerabilityReturnData = {
+  id: string;
+  summary: string;
+  description: string;
+  severity: number | null;
+  version: string;
+  urls: string[];
+  filePaths: string[];
+  dependencyName: string;
 };
 
 export async function uploadBuildArtifact(
@@ -121,6 +134,8 @@ export async function uploadBuild(
     // on the Ketryx side, to make sure the current commit can be found.
     syncRepositoryUpdate:
       input.checkDependenciesStatus || input.checkReleaseStatus,
+
+    returnVulnerabilities: input.reportVulnerabilities,
     checkDependenciesStatus: input.checkDependenciesStatus,
     checkReleaseStatus: input.checkReleaseStatus,
   };