Merge pull request #264 from romoh/main

Move security audit checks to a daily schedule [SAME VERSION]

.github/workflows/check-rust.yml

@@ -20,15 +20,6 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
-  security_audit:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v1
-      - uses: actions-rs/audit-check@v1
-        with:
-          # token is only used for creating the audit report and does not impact the 
-          # functionality or success/failure of the job in case the token is unavailable 
-          token: ${{ secrets.GITHUB_TOKEN }}
   build:
     runs-on: ubuntu-latest
     timeout-minutes: 30

.github/workflows/security-audit.yml

@@ -0,0 +1,43 @@
+# This is a security audit workflow that runs security audit checks and send an email in case any vulnerabilities are detected.
+
+name: Security Audit
+on:
+  schedule:
+  - cron: '0 0 * * *' #runs daily at 12:00 am UTC
+
+jobs:
+  security_audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v1
+      - name: Run security audit check
+        id: cargo-audit
+        if: github.repository == 'deislabs/akri' # only run on main repo and not forks
+        continue-on-error: true
+        uses: actions-rs/audit-check@v1
+        with:
+          # token is only used for creating the audit report and does not impact the 
+          # functionality or success/failure of the job in case the token is unavailable 
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      # sends an email if security audit failed 
+      - name: Send mail
+        if: steps.cargo-audit.outcome != 'success' && github.repository == 'deislabs/akri' # only run on main repo and not forks
+        uses: dawidd6/action-send-mail@v2
+        with:
+          server_address: smtp-mail.outlook.com
+          server_port: 587
+          username: ${{secrets.AKRI_BOT_EMAIL}}
+          password: ${{secrets.AKRI_BOT_PASSWORD}}
+          subject: "Security vulnerability detected in ${{github.repository}}"
+          body: |-
+            A security vulnerability was detected in one or more of Akri's dependencies. For more details, check the output of the [security audit workflow](https://github.com/${{github.repository}}/actions/runs/${{github.run_id}})
+
+            Hint: In most cases, running the [auto-update dependencies](https://github.com/deislabs/akri/actions/workflows/auto-update-dependencies.yml) workflow will fix the issue.
+
+            -Your friendly Akri bot 🤖
+          to: ${{secrets.AKRI_TEAM_EMAIL}}
+          from: ${{secrets.AKRI_BOT_EMAIL}}
+          content_type: text/html
+          convert_markdown: true
+