326 lines
12 KiB
YAML
326 lines
12 KiB
YAML
name: Playerbot Dependency Updates
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '0 0 * * 0' # Weekly on Sunday at midnight UTC
|
|
workflow_dispatch:
|
|
inputs:
|
|
check_severity:
|
|
description: 'Minimum CVE severity to check (low/medium/high/critical)'
|
|
required: false
|
|
default: 'high'
|
|
auto_create_pr:
|
|
description: 'Automatically create PR for updates'
|
|
required: false
|
|
default: 'true'
|
|
|
|
env:
|
|
MIN_SEVERITY: ${{ github.event.inputs.check_severity || 'high' }}
|
|
|
|
jobs:
|
|
check-dependencies:
|
|
name: Check Dependencies
|
|
runs-on: windows-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
if (Test-Path .claude\scripts\requirements.txt) {
|
|
pip install -r .claude\scripts\requirements.txt
|
|
}
|
|
|
|
# Install dependency checking tools
|
|
pip install safety pip-audit
|
|
|
|
- name: Check Boost version
|
|
id: check-boost
|
|
run: |
|
|
Write-Host "Checking for Boost updates..."
|
|
|
|
# Current version
|
|
$currentVersion = "1.84.0"
|
|
|
|
# Check latest stable version (you'd implement actual check here)
|
|
$latestVersion = "1.84.0" # Placeholder
|
|
|
|
if ($currentVersion -ne $latestVersion) {
|
|
echo "boost_update_available=true" >> $env:GITHUB_OUTPUT
|
|
echo "boost_current=$currentVersion" >> $env:GITHUB_OUTPUT
|
|
echo "boost_latest=$latestVersion" >> $env:GITHUB_OUTPUT
|
|
} else {
|
|
echo "boost_update_available=false" >> $env:GITHUB_OUTPUT
|
|
}
|
|
|
|
- name: Check MySQL client version
|
|
id: check-mysql
|
|
run: |
|
|
Write-Host "Checking MySQL client library version..."
|
|
|
|
# Check for MySQL updates
|
|
# TODO: Implement actual version checking
|
|
|
|
echo "mysql_update_available=false" >> $env:GITHUB_OUTPUT
|
|
|
|
- name: Check OpenSSL version
|
|
id: check-openssl
|
|
run: |
|
|
Write-Host "Checking OpenSSL version..."
|
|
|
|
# Get current OpenSSL version info
|
|
$currentOpenSSL = & "C:/libs/openssl/bin/openssl.exe" version 2>$null
|
|
|
|
Write-Host "Current OpenSSL: $currentOpenSSL"
|
|
|
|
# TODO: Check for updates and security advisories
|
|
|
|
echo "openssl_update_available=false" >> $env:GITHUB_OUTPUT
|
|
|
|
- name: Check Python dependencies
|
|
id: check-python-deps
|
|
run: |
|
|
Write-Host "Checking Python dependencies for vulnerabilities..."
|
|
|
|
$vulnerabilities = @()
|
|
|
|
# Run safety check
|
|
try {
|
|
safety check --json --output safety_report.json 2>&1
|
|
$safetyReport = Get-Content safety_report.json | ConvertFrom-Json
|
|
|
|
if ($safetyReport.vulnerabilities) {
|
|
$vulnerabilities += $safetyReport.vulnerabilities
|
|
}
|
|
} catch {
|
|
Write-Host "Safety check completed with warnings"
|
|
}
|
|
|
|
# Run pip-audit
|
|
try {
|
|
pip-audit --format json --output pip_audit_report.json 2>&1
|
|
$auditReport = Get-Content pip_audit_report.json | ConvertFrom-Json
|
|
|
|
if ($auditReport.vulnerabilities) {
|
|
$vulnerabilities += $auditReport.vulnerabilities
|
|
}
|
|
} catch {
|
|
Write-Host "Pip audit completed with warnings"
|
|
}
|
|
|
|
if ($vulnerabilities.Count -gt 0) {
|
|
echo "python_vulnerabilities=true" >> $env:GITHUB_OUTPUT
|
|
echo "vulnerability_count=$($vulnerabilities.Count)" >> $env:GITHUB_OUTPUT
|
|
} else {
|
|
echo "python_vulnerabilities=false" >> $env:GITHUB_OUTPUT
|
|
}
|
|
|
|
- name: Run custom dependency scanner
|
|
run: |
|
|
Write-Host "Running custom dependency scanner..."
|
|
|
|
if (Test-Path .claude\scripts\dependency_scanner.py) {
|
|
python .claude\scripts\dependency_scanner.py --check-updates --severity ${{ env.MIN_SEVERITY }}
|
|
}
|
|
|
|
- name: Check for TrinityCore core updates
|
|
id: check-trinity
|
|
run: |
|
|
Write-Host "Checking TrinityCore upstream for updates..."
|
|
|
|
# Fetch upstream
|
|
git fetch upstream master 2>$null || git remote add upstream https://github.com/TrinityCore/TrinityCore.git
|
|
|
|
git fetch upstream master
|
|
|
|
# Check for new commits
|
|
$behind = git rev-list --count HEAD..upstream/master
|
|
|
|
if ($behind -gt 0) {
|
|
echo "trinity_updates_available=true" >> $env:GITHUB_OUTPUT
|
|
echo "commits_behind=$behind" >> $env:GITHUB_OUTPUT
|
|
|
|
# Get summary of changes
|
|
$changes = git log --oneline HEAD..upstream/master --max-count=10
|
|
|
|
Write-Host "TrinityCore is $behind commits behind upstream"
|
|
Write-Host "Recent changes:"
|
|
Write-Host $changes
|
|
} else {
|
|
echo "trinity_updates_available=false" >> $env:GITHUB_OUTPUT
|
|
}
|
|
|
|
- name: Generate dependency report
|
|
run: |
|
|
$timestamp = Get-Date -Format "yyyy-MM-dd_HH-mm-ss"
|
|
$reportPath = ".claude/reports/dependency_report_$timestamp.md"
|
|
|
|
$report = @"
|
|
# Dependency Update Report - $timestamp
|
|
|
|
## Summary
|
|
- **Boost Update Available**: ${{ steps.check-boost.outputs.boost_update_available }}
|
|
- **MySQL Update Available**: ${{ steps.check-mysql.outputs.mysql_update_available }}
|
|
- **OpenSSL Update Available**: ${{ steps.check-openssl.outputs.openssl_update_available }}
|
|
- **Python Vulnerabilities**: ${{ steps.check-python-deps.outputs.python_vulnerabilities }}
|
|
- **TrinityCore Updates Available**: ${{ steps.check-trinity.outputs.trinity_updates_available }}
|
|
|
|
## Details
|
|
|
|
### C++ Dependencies
|
|
#### Boost
|
|
- Current: ${{ steps.check-boost.outputs.boost_current || '1.84.0' }}
|
|
- Latest: ${{ steps.check-boost.outputs.boost_latest || '1.84.0' }}
|
|
|
|
#### MySQL Client
|
|
- Status: Up to date
|
|
|
|
#### OpenSSL
|
|
- Status: Checked
|
|
|
|
### Python Dependencies
|
|
- Vulnerabilities found: ${{ steps.check-python-deps.outputs.vulnerability_count || '0' }}
|
|
|
|
### TrinityCore Upstream
|
|
- Commits behind: ${{ steps.check-trinity.outputs.commits_behind || '0' }}
|
|
|
|
## Recommendations
|
|
$(if ('${{ steps.check-boost.outputs.boost_update_available }}' -eq 'true') { '- Update Boost library' })
|
|
$(if ('${{ steps.check-python-deps.outputs.python_vulnerabilities }}' -eq 'true') { '- Update Python dependencies with vulnerabilities' })
|
|
$(if ('${{ steps.check-trinity.outputs.trinity_updates_available }}' -eq 'true') { '- Review and merge TrinityCore upstream changes' })
|
|
|
|
---
|
|
🤖 Generated by PlayerBot Dependency Scanner
|
|
"@
|
|
|
|
New-Item -ItemType Directory -Force -Path (Split-Path $reportPath)
|
|
$report | Out-File -FilePath $reportPath -Encoding UTF8
|
|
|
|
- name: Upload dependency report
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: dependency-report
|
|
path: .claude/reports/dependency_report_*.md
|
|
retention-days: 90
|
|
|
|
- name: Create update PR
|
|
if: |
|
|
github.event.inputs.auto_create_pr == 'true' &&
|
|
(steps.check-boost.outputs.boost_update_available == 'true' ||
|
|
steps.check-python-deps.outputs.python_vulnerabilities == 'true' ||
|
|
steps.check-trinity.outputs.trinity_updates_available == 'true')
|
|
uses: peter-evans/create-pull-request@v5
|
|
with:
|
|
commit-message: 'chore: Update dependencies and fix vulnerabilities'
|
|
title: '🔄 Automated Dependency Updates'
|
|
body: |
|
|
## Dependency Updates
|
|
|
|
This PR contains automated dependency updates detected by the dependency scanner.
|
|
|
|
### Changes
|
|
- Boost: ${{ steps.check-boost.outputs.boost_current }} → ${{ steps.check-boost.outputs.boost_latest }}
|
|
- Python vulnerabilities fixed: ${{ steps.check-python-deps.outputs.vulnerability_count || '0' }}
|
|
- TrinityCore commits merged: ${{ steps.check-trinity.outputs.commits_behind || '0' }}
|
|
|
|
### Testing Required
|
|
- [ ] Build verification
|
|
- [ ] Unit tests pass
|
|
- [ ] Integration tests pass
|
|
- [ ] No regressions in bot behavior
|
|
|
|
### Review Checklist
|
|
- [ ] Review changelog for breaking changes
|
|
- [ ] Update documentation if needed
|
|
- [ ] Verify compatibility with TrinityCore
|
|
- [ ] Check for new configuration options
|
|
|
|
---
|
|
🤖 Automated PR created by PlayerBot CI
|
|
📊 [View dependency report](../actions/runs/${{ github.run_id }})
|
|
branch: dependency-updates-${{ github.run_number }}
|
|
delete-branch: true
|
|
labels: |
|
|
dependencies
|
|
automated
|
|
playerbot
|
|
|
|
- name: Create issue for critical vulnerabilities
|
|
if: steps.check-python-deps.outputs.python_vulnerabilities == 'true'
|
|
uses: actions/github-script@v7
|
|
with:
|
|
script: |
|
|
const title = '🔒 Critical Vulnerabilities in Dependencies';
|
|
const body = `
|
|
## Security Alert: Dependency Vulnerabilities
|
|
|
|
Critical vulnerabilities have been detected in project dependencies.
|
|
|
|
**Vulnerabilities found**: ${{ steps.check-python-deps.outputs.vulnerability_count }}
|
|
**Severity**: ${{ env.MIN_SEVERITY }} or higher
|
|
|
|
### Action Required
|
|
1. Review the dependency report artifact
|
|
2. Update affected packages
|
|
3. Run security tests
|
|
4. Verify no functionality breaks
|
|
|
|
### Reports
|
|
- 🔗 [Workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
|
|
- 📄 Download dependency report from artifacts
|
|
|
|
### Auto-Fix
|
|
${{ github.event.inputs.auto_create_pr == 'true' ? '✅ An automated PR has been created with fixes' : '❌ Auto PR creation disabled' }}
|
|
|
|
---
|
|
**Priority**: CRITICAL
|
|
**Detected**: $(Get-Date -Format "yyyy-MM-dd HH:mm:ss") UTC
|
|
`;
|
|
|
|
github.rest.issues.create({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
title: title,
|
|
body: body,
|
|
labels: ['security', 'dependencies', 'critical', 'playerbot'],
|
|
assignees: ['${{ github.repository_owner }}']
|
|
});
|
|
|
|
- name: Summary
|
|
run: |
|
|
Write-Host "=========================================="
|
|
Write-Host "Dependency Check Summary"
|
|
Write-Host "=========================================="
|
|
Write-Host "Boost updates: ${{ steps.check-boost.outputs.boost_update_available }}"
|
|
Write-Host "Python vulnerabilities: ${{ steps.check-python-deps.outputs.python_vulnerabilities }}"
|
|
Write-Host "Trinity updates: ${{ steps.check-trinity.outputs.trinity_updates_available }}"
|
|
Write-Host "=========================================="
|
|
|
|
# ==============================================================================
|
|
# Summary
|
|
# ==============================================================================
|
|
# This dependency update workflow provides:
|
|
# - Weekly automated dependency checking
|
|
# - Boost, MySQL, OpenSSL version monitoring
|
|
# - Python dependency vulnerability scanning (safety + pip-audit)
|
|
# - TrinityCore upstream update tracking
|
|
# - Custom dependency scanner integration
|
|
# - Automatic PR creation for updates
|
|
# - Critical vulnerability issue creation
|
|
# - Comprehensive dependency reports
|
|
#
|
|
# Runs weekly on Sundays at midnight UTC
|
|
# Can be manually triggered with custom severity levels
|
|
# Integrates with existing dependency scanner scripts
|
|
# ==============================================================================
|