check-deps.yml

name: Check dependencies

permissions:
  contents: read

on:
  schedule:
  - cron: '0 8 * * *'
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-22.04
    if: >-
      ${{
          github.repository == 'envoyproxy/envoy'
          && (github.event.schedule
              || !contains(github.actor, '[bot]'))
      }}
    permissions:
      contents: read # to fetch code (actions/checkout)
      issues: write # required to open/close dependency issues
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          ref: ${{ github.head_ref }}
      - name: Set up Python (3.10)
        uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1
        with:
          python-version: "3.10"

      - name: Run dependency checker
        run: |
          TODAY_DATE=$(date -u -I"date")
          export TODAY_DATE
          bazel run //tools/dependency:check --action_env=TODAY_DATE -- -c release_issues --fix
          bazel run //tools/dependency:check --action_env=TODAY_DATE -- -c cves -w error
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}