security-checker-action

This action checks your composer.lock for known vulnerabilities in your package dependencies.

Inputs

lock optional The path to the composer.lock file (defaults to the repository root directory).
format optional The output format (defaults to json, supported: markdown, json, print_r, or yaml).

Outputs

updates A JSON payload containing all detected security updates.

Usage

If you want the step to fail whenever there is a security issue in one of your dependencies, use this action:

steps:
    - uses: actions/checkout@v3
    - uses: druidfi/security-checker-action@v1

To speed up security checks, you can cache the vulnerability database:

steps:
    - uses: actions/checkout@v3
    - uses: actions/cache@v2
      id: cache-db
      with:
          path: ~/.symfony/cache
          key: db
    - uses: druidfi/security-checker-action@v1

If the composer.lock is not in the repository root directory, pass is as an input:

steps:
    - uses: actions/checkout@v3
    - uses: druidfi/security-checker-action@v1
      with:
          lock: subdir/composer.lock

Development

Test code with example composer.lock in tests/repo:

make test

Test Docker image with example composer.lock in tests/repo:

make test-docker

Test Github Action image with example composer.lock in tests/repo:

make test-docker

Example: Check some Drupal repository:

docker pull ghcr.io/druidfi/security-checker-action
docker run -it --rm -w /workspace -v $(pwd):/workspace ghcr.io/druidfi/security-checker-action /checker --format=markdown