diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index dba17ec41ac..79c20ef4ce2 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -319,6 +319,8 @@ js_tests: - yarn test pinpoint-check: + needs: + - job: install stage: test cache: - <<: *ruby_cache @@ -328,6 +330,18 @@ pinpoint-check: - *yarn_install - make lint_country_dialing_codes +audit_packages: + needs: + - job: install + stage: test + cache: + - <<: *ruby_cache + - <<: *yarn_cache + script: + - *bundle_install + - *yarn_install + - make audit + prepare_deploy: # Runs in parallel with tests so we can deploy more quickly after passing stage: test diff --git a/Makefile b/Makefile index dd275d8babb..04087052960 100644 --- a/Makefile +++ b/Makefile @@ -12,6 +12,7 @@ ARTIFACT_DESTINATION_FILE ?= ./tmp/idp.tar.gz .PHONY: \ analytics_events \ + audit \ brakeman \ build_artifact \ check \ @@ -74,11 +75,7 @@ endif make lint_analytics_events_sorted @echo "--- brakeman ---" make brakeman - @echo "--- bundler-audit ---" - bundle exec bundler-audit check --update # JavaScript - @echo "--- yarn audit ---" - yarn audit --groups dependencies; test $$? -le 7 @echo "--- eslint ---" yarn run lint @echo "--- typescript ---" @@ -105,6 +102,12 @@ endif @echo "--- lint migrations ---" make lint_migrations +audit: ## Checks packages for vulnerabilities + @echo "--- bundler-audit ---" + bundle exec bundler-audit check --update + @echo "--- yarn audit ---" + yarn audit --groups dependencies; test $$? -le 7 + lint_erb: ## Lints ERB files bundle exec erblint app/views app/components