test: add yarn audit to ci (#4250)

ci/partials/audit-admin.yml

@@ -0,0 +1,8 @@
+platform: linux
+inputs: [name: src]
+outputs: [name: src]
+run:
+  dir: src/admin-client
+  path: bash
+  # https://classic.yarnpkg.com/lang/en/docs/cli/audit
+  args: [-c, "yarn audit; [[ $? -ge $VULN_THRESHOLD ]] && exit 1 || exit 0"]

ci/partials/audit.yml

@@ -0,0 +1,8 @@
+platform: linux
+inputs: [name: src]
+outputs: [name: src]
+run:
+  dir: src
+  path: bash
+  # https://classic.yarnpkg.com/lang/en/docs/cli/audit
+  args: [-c, "yarn audit; [[ $? -ge $VULN_THRESHOLD ]] && exit 1 || exit 0"]

ci/pipeline-dev.yml

@@ -342,6 +342,50 @@ jobs:
             username: ((slack-username))
             icon_url: ((slack-icon-url))
 
+  - name: audit-dependencies
+    plan: 
+      - get: src
+        resource: pr-((deploy-env))
+        trigger: true
+        passed: [set-pipeline]
+      - get: node
+        in_parallel:
+          - task: audit-app
+            file: src/ci/partials/audit.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+          - task: audit-admin
+            file: src/ci/partials/audit-admin.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+    on_failure:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: failure}
+        - put: slack
+          params:
+            text: |
+              :x: FAILED: dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
+    on_success:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: success}
+        - put: slack
+          params:
+            text: |
+              :white_check_mark: SUCCESS: Successfully passed dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
 
   - name: set-pipeline
     plan:

ci/pipeline-production.yml

@@ -342,6 +342,51 @@ jobs:
         username: ((slack-username))
         icon_url: ((slack-icon-url))
 
+  - name: audit-dependencies
+    plan: 
+      - get: src
+        resource: pr-((deploy-env))
+        trigger: true
+        passed: [set-pipeline]
+      - get: node
+        in_parallel:
+          - task: audit-app
+            file: src/ci/partials/audit.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+          - task: audit-admin
+            file: src/ci/partials/audit-admin.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+    on_failure:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: failure}
+        - put: slack
+          params:
+            text: |
+              :x: FAILED: dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
+    on_success:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: success}
+        - put: slack
+          params:
+            text: |
+              :white_check_mark: SUCCESS: Successfully passed dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
+
   - name: set-pipeline
     plan:
     - get: src

ci/pipeline-staging.yml

@@ -416,6 +416,51 @@ jobs:
                 username: ((slack-username))
                 icon_url: ((slack-icon-url))
 
+  - name: audit-dependencies
+    plan: 
+      - get: src
+        resource: pr-((deploy-env))
+        trigger: true
+        passed: [set-pipeline]
+      - get: node
+        in_parallel:
+          - task: audit-app
+            file: src/ci/partials/audit.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+          - task: audit-admin
+            file: src/ci/partials/audit-admin.yml
+            image: node
+            params:
+              VULN_THRESHOLD: 8 # errors on critical or high
+    on_failure:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: failure}
+        - put: slack
+          params:
+            text: |
+              :x: FAILED: dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
+    on_success:
+      in_parallel:
+        - put: gh-status
+          inputs: [src]
+          params: {state: success}
+        - put: slack
+          params:
+            text: |
+              :white_check_mark: SUCCESS: Successfully passed dependency audit on pages ((deploy-env))
+              <$ATC_EXTERNAL_URL/teams/$BUILD_TEAM_NAME/pipelines/$BUILD_PIPELINE_NAME/jobs/$BUILD_JOB_NAME/builds/$BUILD_NAME?vars.deploy-env="((deploy-env))"|View build details>
+            channel: ((slack-channel))
+            username: ((slack-username))
+            icon_url: ((slack-icon-url))
+
   - name: set-pipeline
     plan:
     - get: src