Dependency auditing

tusooa commented

2022-02-27 20:00:34 +00:00

Owner

There is currently no routine for updating dependencies regularly, which could lead to security vulnerabilities.

For frontend, hj recommended https://docs.renovatebot.com/ which could be integrated with gitlab.

For backend, https://github.com/mirego/mix_audit or mix hex.outdated is suggested.

Both should be run on a regular basis.

There is currently no routine for updating dependencies regularly, which could lead to security vulnerabilities. For frontend, hj recommended https://docs.renovatebot.com/ which could be integrated with gitlab. For backend, https://github.com/mirego/mix_audit or `mix hex.outdated` is suggested. Both should be run on a regular basis.

ilja commented

2022-02-27 20:37:39 +00:00

Member

Extra for BE that we could also run

mix hex.audit # Shows retired Hex deps for the current project

mix hex.outdated # Shows outdated Hex deps for the current project

See mix hex

Extra for BE that we could also run > mix hex.audit # Shows retired Hex deps for the current project > mix hex.outdated # Shows outdated Hex deps for the current project See `mix hex`

tusooa commented

2022-03-04 18:52:24 +00:00

Author

Owner

Some trials:

https://lily.kazv.moe/infra/renovator

Create a new account on gitlab, grant it access to push to the pleroma-fe repo (I think developer is ok)
Create a token on gitlab for that account that has api, read_user, write_repository
Create a user on GitHub.com, create a personal access token (the doc says "read-only" is ok, i gave it read:packages scope)
Create a repo, using https://lily.kazv.moe/infra/renovator as a template

Change as needed:
- endpoint: 'https://lily.kazv.moe/api/v4/',
- repositories: ['infra/pleroma-fe'],
- export RENOVATE_GIT_AUTHOR='Renovate Bot <renovate@lily.kazv.moe>' (change it to the email associated with that account)
In CI/CD configuration for that repo, add variables GITHUB_COM_TOKEN (the github.com token just created) and RENOVATE_TOKEN (the gitlab token just created).
Add a scheduled pipeline that runs at a desired frequency. To check everything works, play that pipeline and see it creates a merge request that adds a config file to the repo (like https://lily.kazv.moe/infra/pleroma-fe/-/merge_requests/1 ). Merge that and run the pipeline again, it should start creating other mrs.

Some trials: https://lily.kazv.moe/infra/renovator 0. Create a new account on gitlab, grant it access to push to the pleroma-fe repo (I think developer is ok) 1. Create a token on gitlab for that account that has `api, read_user, write_repository` 2. Create a user on GitHub.com, create a personal access token (the doc says "read-only" is ok, i gave it `read:packages` scope) 3. Create a repo, using https://lily.kazv.moe/infra/renovator as a template Change as needed: - `endpoint: 'https://lily.kazv.moe/api/v4/',` - `repositories: ['infra/pleroma-fe'],` - `export RENOVATE_GIT_AUTHOR='Renovate Bot <renovate@lily.kazv.moe>'` (change it to the email associated with that account) 4. In CI/CD configuration for that repo, add variables `GITHUB_COM_TOKEN` (the github.com token just created) and `RENOVATE_TOKEN` (the gitlab token just created). 5. Add a scheduled pipeline that runs at a desired frequency. To check everything works, play that pipeline and see it creates a merge request that adds a config file to the repo (like https://lily.kazv.moe/infra/pleroma-fe/-/merge_requests/1 ). **Merge that** and run the pipeline again, it should start creating other mrs.

tusooa commented

2022-03-04 19:02:03 +00:00

Author

Owner

The only thing I frown upon is the requirement of a GitHub account.

seanking commented

2022-03-05 04:43:44 +00:00

Member

Me: It surely can't be that bad if you're self-hosted.

Renovate Bot docs: The GitHub.com token in env is necessary in order to retrieve Release Notes that are usually hosted on github.com. You don't need to add it if you are already running the bot against github.com, but you do need to add it if you're using GitHub Enterprise, GitLab, Azure DevOps, or Bitbucket.

Me: Oh....

An additional edit: Apparently, the reason they require this is because of GitHub's rate limits for unauthenticated requests to their API. https://github.com/renovatebot/renovate/blob/main/docs/usage/getting-started/running.md#githubcom-token-for-release-notes

Me: It surely can't be that bad if you're self-hosted. Renovate Bot docs: The GitHub.com token in env is necessary in order to retrieve Release Notes that are usually hosted on github.com. You don't need to add it if you are already running the bot against github.com, but you do need to add it if you're using GitHub Enterprise, GitLab, Azure DevOps, or Bitbucket. Me: Oh.... **An additional edit:** Apparently, the reason they require this is because of GitHub's rate limits for unauthenticated requests to their API. https://github.com/renovatebot/renovate/blob/main/docs/usage/getting-started/running.md#githubcom-token-for-release-notes

tusooa commented

2022-03-05 19:46:51 +00:00

Author

Owner

yea, it's possible to just register an empty account for it... but again considering npm/yarn audit does not need a github.com account

Rows
Columns

Dependency auditing #62