Merge pull request #279 from mlibrary/2023-11-06-updates

November 2023 dependency updates.
mlibrary · Nov 6, 2023 · 6867a6a · 6867a6a
2 parents d7c286b + d6eb5e5
commit 6867a6a
Show file tree

Hide file tree

Showing 7 changed files with 79 additions and 34 deletions.
diff --git a/.github/workflows/build-deploy-release.yaml b/.github/workflows/build-deploy-release.yaml
@@ -14,6 +14,21 @@ jobs:
       tag: ${{ github.event.release.tag_name }}
       dockerfile: Dockerfile
     secrets: inherit
+
+  scan-image:
+    needs: build-production
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+          skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
 
   deploy-production:
     needs: build-production

diff --git a/.github/workflows/build-main.yaml b/.github/workflows/build-main.yaml
@@ -15,6 +15,21 @@ jobs:
       tag: ${{ github.sha }}
       dockerfile: Dockerfile
     secrets: inherit
+
+  scan-image:
+    needs: build-unstable
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ needs.build-unstable.outputs.image }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+          skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
 
   deploy-testing:
     needs: build-unstable

diff --git a/.github/workflows/deploy-production.yaml b/.github/workflows/deploy-production.yaml
@@ -16,7 +16,7 @@ jobs:
       tag: ${{ github.event.inputs.tag }}
       dockerfile: Dockerfile
     secrets: inherit
-
+      
   deploy-production:
     needs: build-production
     runs-on: ubuntu-latest

diff --git a/.github/workflows/manual-deploy-unstable.yaml b/.github/workflows/manual-deploy-unstable.yaml
@@ -25,6 +25,21 @@ jobs:
       dockerfile: Dockerfile
     secrets: inherit
 
+  scan-image:
+    needs: build-unstable
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ needs.build-unstable.outputs.image }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+          skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
+
   deploy:
     needs: build-unstable
     runs-on: ubuntu-latest

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -11,9 +11,9 @@ GIT
 GEM
   remote: https://rubygems.org/
   specs:
-    activemodel (7.1.0)
-      activesupport (= 7.1.0)
-    activesupport (7.1.0)
+    activemodel (7.1.1)
+      activesupport (= 7.1.1)
+    activesupport (7.1.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.0.2)
@@ -26,7 +26,7 @@ GEM
     addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
     aes_key_wrap (1.1.0)
-    anyway_config (2.5.3)
+    anyway_config (2.5.4)
       ruby-next-core (>= 0.14.0)
     ast (2.4.2)
     attr_required (1.0.1)
@@ -83,7 +83,7 @@ GEM
     mustermann (3.0.0)
       ruby2_keywords (~> 0.0.1)
     mutex_m (0.1.2)
-    net-imap (0.4.0)
+    net-imap (0.4.4)
       date
       net-protocol
     net-pop (0.1.2)
@@ -117,7 +117,7 @@ GEM
     parser (3.2.2.4)
       ast (~> 2.4.1)
       racc
-    prometheus-client (4.2.1)
+    prometheus-client (4.2.2)
     pry (0.14.2)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -127,7 +127,7 @@ GEM
     public_suffix (5.0.3)
     puma (6.4.0)
       nio4r (~> 2.0)
-    racc (1.7.1)
+    racc (1.7.3)
     rack (2.2.8)
     rack-oauth2 (2.2.0)
       activesupport
@@ -142,7 +142,7 @@ GEM
       rack (>= 1.3)
     rainbow (3.1.1)
     redcarpet (3.6.0)
-    regexp_parser (2.8.1)
+    regexp_parser (2.8.2)
     rexml (3.2.6)
     rspec (3.12.0)
       rspec-core (~> 3.12.0)
@@ -169,7 +169,7 @@ GEM
       rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.29.0)
+    rubocop-ast (1.30.0)
       parser (>= 3.2.1.0)
     rubocop-performance (1.19.1)
       rubocop (>= 1.7.0, < 2.0)
@@ -196,18 +196,18 @@ GEM
       tilt (~> 2.0)
     sinatra-flash (0.3.0)
       sinatra (>= 1.0.0)
-    standard (1.31.1)
+    standard (1.31.2)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.0)
-      rubocop (~> 1.56.2)
+      rubocop (~> 1.56.4)
       standard-custom (~> 1.0.0)
       standard-performance (~> 1.2)
     standard-custom (1.0.2)
       lint_roller (~> 1.0)
       rubocop (~> 1.50)
-    standard-performance (1.2.0)
+    standard-performance (1.2.1)
       lint_roller (~> 1.1)
-      rubocop-performance (~> 1.19.0)
+      rubocop-performance (~> 1.19.1)
     swd (2.0.2)
       activesupport (>= 3)
       attr_required (>= 0.0.5)
@@ -275,4 +275,4 @@ DEPENDENCIES
   yabeda-puma-plugin
 
 BUNDLED WITH
-   2.4.20
+   2.4.21
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -3,13 +3,13 @@
   "version": "1.0.0",
   "description": "for account.lib",
   "devDependencies": {
-    "esbuild": "^0.19.4",
-    "eslint": "^8.50.0",
+    "esbuild": "^0.19.5",
+    "eslint": "^8.53.0",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.28.1",
+    "eslint-plugin-import": "^2.29.0",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^6.1.1",
-    "sass": "^1.68.0"
+    "sass": "^1.69.5"
   },
   "scripts": {
     "build": "npm run build-css && npm run build-js",