From cde215411e80fbbada420c86b17b31b3f6ece6b4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=98=D0=BB=D1=8C=D1=8F=20=D0=9B=D1=8F=D1=89=D1=83=D0=BA?= <40496434+prog-time@users.noreply.github.com> Date: Thu, 25 Jun 2026 13:39:15 +0300 Subject: [PATCH 1/3] issues-35|add composer-audit security snippet --- CI/security/composer-audit.yml | 42 ++++++++++++++++++++++++ scripts/CI/security/composer-audit.yml | 22 +++++++++++++ scripts/shell/security/composer-audit.sh | 21 ++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 CI/security/composer-audit.yml create mode 100644 scripts/CI/security/composer-audit.yml create mode 100644 scripts/shell/security/composer-audit.sh diff --git a/CI/security/composer-audit.yml b/CI/security/composer-audit.yml new file mode 100644 index 0000000..8e39f02 --- /dev/null +++ b/CI/security/composer-audit.yml @@ -0,0 +1,42 @@ +composer-audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: "8.2" + + - name: Cache Composer + uses: actions/cache@v4 + with: + path: vendor + key: composer-${{ hashFiles('composer.lock') }} + restore-keys: composer- + + - name: Install dependencies + run: composer install --no-interaction --prefer-dist + + - name: Run composer-audit + run: | + set -euo pipefail + + if ! command -v composer &> /dev/null; then + echo "::error::composer not found. Install it before running this script." + exit 1 + fi + + if [[ ! -f "composer.lock" ]]; then + echo "::error::No composer.lock found. Run 'composer install' to generate one." + exit 1 + fi + + echo "ℹ️ Running composer audit..." + + if composer audit --abandoned=ignore; then + echo "✅ composer-audit passed" + else + echo "❌ composer-audit found vulnerabilities" + exit 1 + fi diff --git a/scripts/CI/security/composer-audit.yml b/scripts/CI/security/composer-audit.yml new file mode 100644 index 0000000..bcd987d --- /dev/null +++ b/scripts/CI/security/composer-audit.yml @@ -0,0 +1,22 @@ +composer-audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Setup PHP + uses: shivammathur/setup-php@v2 + with: + php-version: "8.2" + + - name: Cache Composer + uses: actions/cache@v4 + with: + path: vendor + key: composer-${{ hashFiles('composer.lock') }} + restore-keys: composer- + + - name: Install dependencies + run: composer install --no-interaction --prefer-dist + + - name: Run composer-audit + run: bash scripts/shell/security/composer-audit.sh diff --git a/scripts/shell/security/composer-audit.sh b/scripts/shell/security/composer-audit.sh new file mode 100644 index 0000000..d0c90c3 --- /dev/null +++ b/scripts/shell/security/composer-audit.sh @@ -0,0 +1,21 @@ +#!/usr/bin/env bash +set -euo pipefail + +if ! command -v composer &> /dev/null; then + echo "::error::composer not found. Install it before running this script." + exit 1 +fi + +if [[ ! -f "composer.lock" ]]; then + echo "::error::No composer.lock found. Run 'composer install' to generate one." + exit 1 +fi + +echo "ℹ️ Running composer audit..." + +if composer audit --abandoned=ignore; then + echo "✅ composer-audit passed" +else + echo "❌ composer-audit found vulnerabilities" + exit 1 +fi From 26143dc626f8ee3b2d22e51ff15bc3785be642ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=98=D0=BB=D1=8C=D1=8F=20=D0=9B=D1=8F=D1=89=D1=83=D0=BA?= <40496434+prog-time@users.noreply.github.com> Date: Thu, 25 Jun 2026 13:39:15 +0300 Subject: [PATCH 2/3] issues-35|add BATS tests for composer-audit --- tests/security/composer-audit.bats | 56 ++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 tests/security/composer-audit.bats diff --git a/tests/security/composer-audit.bats b/tests/security/composer-audit.bats new file mode 100644 index 0000000..6514a78 --- /dev/null +++ b/tests/security/composer-audit.bats @@ -0,0 +1,56 @@ +#!/usr/bin/env bats + +load "../helpers/common" + +SCRIPT="$BATS_TEST_DIRNAME/../../scripts/shell/security/composer-audit.sh" + +setup() { + setup_test_dir +} + +teardown() { + teardown_test_dir +} + +make_composer_stub() { + local audit_exit_code="$1" + mkdir -p "$TEST_DIR/bin" + cat > "$TEST_DIR/bin/composer" < Date: Thu, 25 Jun 2026 13:39:15 +0300 Subject: [PATCH 3/3] issues-35|document composer-audit in README --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 8a3c2c9..49bb489 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ that projects compose into their own workflows. | Tool | Category | File | |------|----------|------| | bundler-audit | security | [CI/security/bundler-audit.yml](https://github.com/prog-time/workflows/blob/main/CI/security/bundler-audit.yml) | +| composer-audit | security | [CI/security/composer-audit.yml](https://github.com/prog-time/workflows/blob/main/CI/security/composer-audit.yml) | | gitleaks | security | [CI/security/gitleaks.yml](https://github.com/prog-time/workflows/blob/main/CI/security/gitleaks.yml) | | pip-audit | security | [CI/security/pip-audit.yml](https://github.com/prog-time/workflows/blob/main/CI/security/pip-audit.yml) | | semgrep | security | [CI/security/semgrep.yml](https://github.com/prog-time/workflows/blob/main/CI/security/semgrep.yml) |