Update Security News Feed #137
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Update Security News Feed | |
| on: | |
| schedule: | |
| # Every 6 hours UTC | |
| - cron: "0 */6 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pages: write | |
| id-token: write | |
| concurrency: | |
| group: microsoft-security-news-feed | |
| cancel-in-progress: true | |
| jobs: | |
| build-and-deploy: | |
| name: Fetch, Publish and Deploy | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v5 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.14" | |
| cache: "pip" | |
| cache-dependency-path: scripts/requirements.txt | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r scripts/requirements.txt | |
| - name: Fetch Microsoft security feeds | |
| run: | | |
| python scripts/fetch_feeds.py | tee feed-output.log | |
| - name: Publish pipeline summary | |
| run: | | |
| echo "# 🛡️ Microsoft Security Feed Update" >> $GITHUB_STEP_SUMMARY | |
| echo "" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| cat feed-output.log >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| - name: Commit updated feed data | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add data/feeds.json data/feed.xml | |
| if git diff --staged --quiet; then | |
| echo "No feed changes detected." | |
| else | |
| git commit -m "🛡️ Update Microsoft security feeds - $(date -u '+%Y-%m-%d %H:%M UTC')" | |
| git push | |
| fi | |
| - name: Patch sw.js cache version, index.html SRI and CSP hashes | |
| run: | | |
| # --- sw.js: bump CACHE_NAME with the current short commit SHA ------- | |
| # Using the short SHA means every deploy gets a unique cache name, | |
| # forcing browsers to evict stale/tampered cached assets on activate. | |
| SHORT_SHA=$(git rev-parse --short HEAD) | |
| CACHE_VERSION="securitynews-${SHORT_SHA}" | |
| sed -i "s|securitynews-v[^\"]*|${CACHE_VERSION}|g" sw.js | |
| if grep -q "\"${CACHE_VERSION}\"" sw.js; then | |
| echo "✅ sw.js cache version patched to: ${CACHE_VERSION}" | |
| else | |
| echo "❌ sw.js cache version patch failed — aborting deployment" | |
| exit 1 | |
| fi | |
| # --- index.html: regenerate SRI hash for app.js -------------------- | |
| HASH=$(openssl dgst -sha384 -binary js/app.js | openssl base64 -A) | |
| SRI="sha384-${HASH}" | |
| echo "Generated SRI hash: ${SRI}" | |
| sed -i "s|integrity=\"sha384-[^\"]*\"|integrity=\"${SRI}\"|g" index.html | |
| if grep -q "integrity=\"${SRI}\"" index.html; then | |
| echo "✅ SRI hash successfully patched into index.html" | |
| else | |
| echo "❌ SRI patch failed — aborting deployment" | |
| exit 1 | |
| fi | |
| # --- index.html: regenerate CSP hash for the inline theme script ---- | |
| # The inline theme bootstrap is whitelisted in the CSP by its sha256. | |
| # Recompute it from the live script body so editing that script can | |
| # never silently ship a CSP that blocks it (which would break theming | |
| # and log a violation). Mirrors the SRI patch above. | |
| SCRIPT_BODY=$(grep -oP '(?<=<script>).*?(?=</script>)' index.html | head -1) | |
| if [ -z "${SCRIPT_BODY}" ]; then | |
| echo "❌ Could not extract inline theme script body — aborting deployment" | |
| exit 1 | |
| fi | |
| CSP_HASH="sha256-$(printf '%s' "${SCRIPT_BODY}" | openssl dgst -sha256 -binary | openssl base64 -A)" | |
| echo "Generated CSP script hash: ${CSP_HASH}" | |
| sed -i "s|'sha256-[A-Za-z0-9+/=]*'|'${CSP_HASH}'|g" index.html | |
| if grep -q "'${CSP_HASH}'" index.html; then | |
| echo "✅ CSP script hash successfully patched into index.html" | |
| else | |
| echo "❌ CSP hash patch failed — aborting deployment" | |
| exit 1 | |
| fi | |
| - name: Stage site for deploy | |
| run: | | |
| # Publish only what the live site serves. This keeps .git/, scripts/, | |
| # .github/, docs and the unused source logos out of the Pages artifact. | |
| # Runs after the patch step so the patched sw.js/index.html are staged. | |
| rm -rf _site | |
| mkdir -p _site | |
| cp index.html sw.js manifest.json favicon.ico security-libre-devops-white.png _site/ | |
| cp -r css js data icons _site/ | |
| - name: Configure GitHub Pages | |
| uses: actions/configure-pages@v6 | |
| - name: Upload Pages artifact | |
| uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: _site | |
| - name: Deploy Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v5 |