Skip to content

Merge pull request #238 from atsign-foundation/dependabot/github_acti… #216

Merge pull request #238 from atsign-foundation/dependabot/github_acti…

Merge pull request #238 from atsign-foundation/dependabot/github_acti… #216

name: static_analysis
# Runs the workflow on the below events:
# 1. on pull request raised to trunk branch.
# 2. on push event to trunk branch.
on:
push:
branches:
- trunk
pull_request:
branches:
- trunk
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
static_analysis:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
- uses: dart-lang/setup-dart@0a8a0fc875eb934c15d08629302413c671d3f672 # v1.6.5
with:
sdk: stable
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
with:
go-version: "stable"
cache-dependency-path: tools/osv-scanner/go.sum
# Runs dart lint rules
- name: Install dependencies and run analyze - mwc_demo/dart/iot_sender
working-directory: ./demos/mwc_demo/dart/iot_sender/
run: |
dart pub get
dart analyze
- name: Install dependencies and run analyze - at_notifications
working-directory: ./demos/at_notifications/
run: |
dart pub get
dart analyze
- name: Install dependencies and run analyze - at_demo_data
working-directory: ./packages/at_demo_data/
run: |
dart pub get
dart analyze
- name: Install dependencies and run analyze - at_data_share
working-directory: ./demos/at_data_share/
run: |
dart pub get
dart analyze
# Runs osv-scanner to find any vulnerable Dart dependencies
# It needs to look at pubspec.lock files, which is why it's
# placed here, as the `dart pub get` above will create them
- name: Run osv-scanner
run: |
go install github.com/google/osv-scanner/cmd/osv-scanner@6316373e47d7e3e4b4fd3630c4bbc10987738de6 # v1.4.3
osv-scanner --lockfile=./demos/mwc_demo/dart/iot_sender/pubspec.lock
osv-scanner --lockfile=./demos/at_notifications/pubspec.lock
osv-scanner --lockfile=./packages/at_demo_data/pubspec.lock
osv-scanner --lockfile=./demos/at_data_share/pubspec.lock