Create a jira ticket of issue type Bug when a critical dependabot pull request is created in the repository.
Criticality can be configured by setting a CVSS threshold.
See action.yml.
The action needs a series of inputs to be set in order to function properly.
| Item | Description | Default |
|---|---|---|
| jira_base_url | The base url of jira. | - |
| jira_user_email | The email of jira user to open the bug. | - |
| jira_project | The jira project key that the bug will be opened. | - |
| jira_issue_type | The jira ticket issue type. | Bug |
| jira_label | The jira ticket label. | dependabot-critical |
| cvss_threshold | The CVSS threshold that you want to trigger the bug creation. | 9.0 |
The repository needs two secrets, the pat_token which is a
Github Access Token
with the repo.public_repo scope if it is a public repository or all scopes under repo for private repositories
and the jira_api_token which is a Jira API Token.
Nothing to output.
The composite action is called inside a pull request only when it is opened. Also, the PR's actor should be dependabot.
Example snippet:
on:
pull_request:
types:
- opened
jobs:
critical-jira-creator:
runs-on: ubuntu-latest
if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
steps:
- name: Checkout Repository
uses: actions/[email protected]
- name: Create jira ticket
uses: Orfium/critical-dependabot-jira@test
with:
pat_token: ${{ secrets.PAT_TOKEN }}
jira_base_url: ${{ secrets.JIRA_BASE_URL }}
jira_user_email: ${{ secrets.JIRA_USER_EMAIL }}
jira_api_token: ${{ secrets.JIRA_API_TOKEN }}
jira_project: 'ADR'
cvss_threshold: 5.0
One can also change the CVSS threshold to his/her liking. As the PR is opened from dependabot, it is crucial to set the secrets under Dependabot in Secrets sidebar. More information can be found here.
It is best to enable the setting that allows dependabot to create pull requests regarding security updates automatically. Reference link: Configuring Dependabot security updates .
When running this GitHub action, there are some warnings and errors that you might face:
- You get a
Logged in as: undefined, when the GitHub action tries to log in to your jira user. This is a known and non-stopper issue that it is described here: GitHub Issue. set-outputis deprecated. We will wait for its fix.
Special thanks to @le4ker for his contribution.