Scheduled Dependency Audits

name: Weekly dependency audit
on:
  schedule:
    - cron: "0 14 * * 5"   # Fridays 14:00 UTC
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Pull CISA KEV catalog
        run: |
          curl -fsSL \
            https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \
            -o kev.json

      - name: Run osv-scanner against the repo
        uses: google/osv-scanner-action/osv-scanner-action@v2
        with:
          scan-args: |-
            --recursive
            --format=json
            --output=osv.json
            ./
        continue-on-error: true   # don't fail the job on findings; we want the diff

      - name: Cross-reference recent KEV against scanner findings
        id: audit
        run: |
          python3 - <<'PY'
          import json, os, pathlib
          from datetime import datetime, timedelta, timezone

          # CISA KEV additions in the last 7 days
          kev = json.loads(open("kev.json").read())
          cutoff = datetime.now(timezone.utc) - timedelta(days=7)
          recent = set()
          for v in kev.get("vulnerabilities", []):
              try:
                  added = datetime.fromisoformat(v["dateAdded"] + "T00:00:00+00:00")
                  if added >= cutoff:
                      recent.add(v["cveID"])
              except Exception:
                  pass

          try:
              osv = json.loads(open("osv.json").read())
          except Exception:
              osv = {"results": []}

          hits = []
          for r in osv.get("results", []):
              for pkg in r.get("packages", []):
                  for v in pkg.get("vulnerabilities", []):
                      cve_aliases = [a for a in v.get("aliases", []) if a.startswith("CVE-")]
                      if any(c in recent for c in cve_aliases):
                          fixed = None
                          for aff in v.get("affected", []):
                              for rng in aff.get("ranges", []):
                                  for ev in rng.get("events", []):
                                      if "fixed" in ev:
                                          fixed = ev["fixed"]; break
                          hits.append({
                              "ecosystem": pkg["package"].get("ecosystem"),
                              "name": pkg["package"]["name"],
                              "current": pkg["package"].get("version"),
                              "fixed": fixed,
                              "cve": cve_aliases[0],
                              "manifest": r.get("source", {}).get("path"),
                          })

          out = pathlib.Path("audit-hits.json")
          out.write_text(json.dumps(hits, indent=2))
          print(f"::notice::Audit: {len(hits)} dep(s) match recent CISA KEV")
          gh_out = os.environ.get("GITHUB_OUTPUT")
          if gh_out:
              with open(gh_out, "a") as f:
                  f.write(f"hits={len(hits)}\n")
          PY

      - name: Open / update audit PR
        if: steps.audit.outputs.hits != '0'
        uses: peter-evans/create-pull-request@v6
        with:
          branch: security/weekly-audit
          title: "Weekly audit: ${{ steps.audit.outputs.hits }} dep(s) in CISA KEV recent additions"
          body-path: audit-hits.json
          commit-message: "chore(security): weekly KEV audit findings"
          labels: security, automated