Skip to content

Housekeeping

Housekeeping #692

Workflow file for this run

name: Housekeeping
on:
# Run daily at 7:00
schedule:
- cron: '0 7 * * *'
workflow_dispatch:
env:
IMAGE_NAME: threatdragon/owasp-threat-dragon:latest
# for security reasons the github actions are pinned to specific release versions
jobs:
chores:
name: Tidy workflows
runs-on: ubuntu-24.04
permissions:
actions: write
steps:
- name: Delete stale workflow runs
uses: Mattraks/[email protected]
with:
token: ${{ github.token }}
repository: ${{ github.repository }}
retain_days: 28
keep_minimum_runs: 10
- name: Delete unused workflows
uses: otto-de/[email protected]
with:
token: ${{ github.token }}
stale:
name: Tidy pull requests
runs-on: ubuntu-24.04
permissions:
pull-requests: write
issues: write
steps:
- name: Tidy stale PRs and issues
uses: actions/stale@v9
with:
days-before-issue-stale: 190
days-before-issue-close: -1
stale-issue-message: 'This issue is stale because it has been open for more than 6 months with no activity'
stale-issue-label: stale
remove-issue-stale-when-updated: true
days-before-pr-stale: 21
days-before-pr-close: 7
stale-pr-message: 'This PR is stale because it has been open 21 days with no activity. Remove stale label, or add a comment, otherwise it will be closed in 7 days'
close-pr-message: 'This PR was closed because it has been stalled for 28 days with no activity'
trivy:
name: Scan with Trivy
runs-on: ubuntu-24.04
permissions:
contents: write
security-events: write
steps:
- name: Checkout repository
uses: actions/[email protected]
with:
ref: main
- name: Run Trivy vulnerability scanner
uses: aquasecurity/[email protected]
with:
image-ref: '${{ env.IMAGE_NAME }}'
format: 'template'
template: '@/contrib/sarif.tpl'
trivyignores: '.github/workflows/.trivyignore'
output: 'trivy-results.sarif'
- name: Upload scan results to GitHub Security tab
uses: github/codeql-action/[email protected]
with:
sarif_file: 'trivy-results.sarif'
codeql:
name: Analyze with codeql
runs-on: ubuntu-24.04
permissions:
security-events: write
strategy:
fail-fast: false
steps:
- name: Checkout repository
uses: actions/[email protected]
with:
ref: main
- name: Initialize CodeQL
uses: github/codeql-action/[email protected]
with:
languages: 'javascript'
config-file: ./.github/codeql/codeql-config.yml
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
- name: CodeQL autobuild
uses: github/codeql-action/[email protected]
- name: Perform vulnerability analysis
uses: github/codeql-action/[email protected]
link_checker:
name: Link checker
runs-on: ubuntu-24.04
steps:
- name: Checkout markdown
uses: actions/[email protected]
- name: Link Checker
uses: lycheeverse/[email protected]
with:
fail: true
env:
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}