mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 17:08:53 +00:00
95b1c0df62
proposal/idea to check once a day if `timestamps.json` is expired and send a slack notification if it expires on the same day or it already expired.
65 lines
1.9 KiB
YAML
65 lines
1.9 KiB
YAML
name: Check TUF timestamps
|
|
|
|
on:
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/check-tuf-timestamps.yml'
|
|
workflow_dispatch: # Manual
|
|
schedule:
|
|
- cron: '0 10 * * *'
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test-go:
|
|
strategy:
|
|
matrix:
|
|
os: [ubuntu-latest]
|
|
runs-on: ${{ matrix.os }}
|
|
|
|
steps:
|
|
- name: Check remote timestamp.json file
|
|
run: |
|
|
expires=$(curl -s http://tuf.fleetctl.com/timestamp.json | jq -r '.signed.expires' | cut -c 1-10)
|
|
today=$(date "+%Y-%m-%d")
|
|
tomorrow=$(date -d "$today + 1 day" "+%Y-%m-%d")
|
|
expires_sec=$(date -d "$expires" "+%s")
|
|
tomorrow_sec=$(date -d "$tomorrow" "+%s")
|
|
|
|
if [ "$expires_sec" -le "$tomorrow_sec" ]; then
|
|
exit 1
|
|
else
|
|
exit 0
|
|
fi
|
|
|
|
- name: Slack Notification
|
|
if: failure()
|
|
uses: slackapi/slack-github-action@e28cf165c92ffef168d23c5c9000cffc8a25e117 # v1.24.0
|
|
with:
|
|
payload: |
|
|
{
|
|
"text": "${{ job.status }}\n${{ github.event.pull_request.html_url || github.event.head.html_url }}",
|
|
"blocks": [
|
|
{
|
|
"type": "section",
|
|
"text": {
|
|
"type": "mrkdwn",
|
|
"text": "⚠️ TUF timestamp.json is about to expire or has already expired\nhttps://github.com/fleetdm/fleet/actions/runs/${{ github.run_id }}"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
env:
|
|
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
|
|
SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
|