mirror of
https://github.com/renovatebot/renovate.git
synced 2026-10-27 07:50:47 +00:00
Jamie Tanna
2d566bfe0b
The Unified Agent scan passes `secrets.WS_ORG_TOKEN` as a `-apiKey` CLI argument. Actions masks it in logs, but command-line arguments are visible in the runner's process table to anything else running on the machine. As the Unified Agent reads any configuration parameter from a `WS_`-prefixed environment variable, we can supply `WS_APIKEY` via `env:` and drop the argument. Co-authored-by: Claude Fable 5 <jamie.tanna+claude-code@mend.io>
28 lines
903 B
YAML
28 lines
903 B
YAML
name: whitesource-scan
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
WS_SCAN:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
show-progress: false
|
|
persist-credentials: false
|
|
|
|
- name: Download UA
|
|
run: curl -LJO https://github.com/whitesource/unified-agent-distribution/releases/latest/download/wss-unified-agent.jar
|
|
|
|
- name: Run UA scan
|
|
env:
|
|
# the Unified Agent reads any config parameter from a `WS_`-prefixed
|
|
# environment variable, keeping the key out of the process arguments
|
|
WS_APIKEY: ${{ secrets.WS_ORG_TOKEN }}
|
|
run: java -jar wss-unified-agent.jar -d "$GITHUB_WORKSPACE" -noConfig true -product W4D -project "Renovate OS - main" -resolveAllDependencies false -npm_resolveDependencies true || true
|