diff --git a/.github/workflows/dependency-analysis.yml b/.github/workflows/dependency-analysis.yml index 8f6b41e..74b2531 100644 --- a/.github/workflows/dependency-analysis.yml +++ b/.github/workflows/dependency-analysis.yml @@ -174,6 +174,32 @@ jobs: fi echo "fail_the_build=$FAIL_THE_BUILD" >> "$GITHUB_ENV" cat $GITHUB_ENV + + ## POC list and block direct nodeJS dependencies installations + # TODO: remove this section when all workflows will be compliant + + ## Scan for direct NodeJS dependencies installations without --frozen-lockfile + echo "[INFO] - Scan for direct NodeJS dependencies installations without --frozen-lockfile" + ERROR=0 + # TODO Fill error_log with issues to add them in the PR comment + for file in $(find .github -type f -name "*.yml" -o -name "*.yaml"); do + if grep -E 'pnpm install( [^-\n][^"]*)?$' "$file" | grep -v -- '--frozen-lockfile'; then + echo "[ERROR] - NodeJS installation without --frozen-lockfile found in $file" + ERROR=1 + fi + if grep -E 'yarn install( [^-\n][^"]*)?$' "$file" | grep -v -- '--frozen-lockfile'; then + echo "[ERROR] - NodeJS installation without --frozen-lockfile found in $file" + ERROR=1 + fi + if grep -E 'npm install( [^-\n][^"]*)?$' "$file" | grep -v -- '--frozen-lockfile'; then + echo "[ERROR] - NodeJS installation without --frozen-lockfile found in $file" + ERROR=1 + fi + done + if [ $ERROR -eq 1 ]; then + echo "[ERROR] - Non-compliant NodeJS installations were found." + exit 1 + fi shell: bash - name: comment_PR