#53 Improve scanning for upstream CVEs

lakedrops-execute.yml

@@ -25,6 +25,9 @@ Build Prod Site NG:
 Build Site:
   extends: '.build'
 
+Check 4 Security Vulnerability Advisories:
+  extends: '.check4security'
+
 Download DB:
   extends: '.dumpdb'
 

lakedrops.yml

@@ -60,9 +60,6 @@ Validate Environment:
 Check 4 Updates:
   extends: '.check4update'
 
-Check 4 Security Vulnerability Advisories:
-  extends: '.check4security'
-
 Release:
   extends: '.createrelease'
 

test-and-deploy.yml

@@ -680,6 +680,7 @@ Debug:
   script:
     - rm /tmp/test.log >/dev/null 2>&1 || true
     - composer update --no-interaction --no-progress --no-dev --dry-run $NAMESPACES_CHECK_UPDATE >/tmp/test.log 2>&1
+    - composer audit --no-dev --locked || true
     - EC=0
     - grep "Nothing to modify in lock file" /tmp/test.log || EC=$?
     - if [[ $EC -eq 0 ]]; then exit 0; fi
@@ -704,24 +705,30 @@ Debug:
       - develop
 
 .check4security:
-  stage: validation
+  stage: build
   tags:
     - default
   image: registry.lakedrops.com/docker/gitlab-drupal-ci/php-${PHP_MAJOR_VERSION}.${PHP_MINOR_VERSION}
   cache: {}
+  needs:
+    - job: Build Prod Site
+      artifacts: true
+      optional: true
+    - job: Build Prod Site NG
+      artifacts: true
+      optional: true
+    - job: Build Site
+      artifacts: true
+      optional: true
   before_script:
     - !reference [.prepareaccess, before_script]
     - !reference [.preparecomposerplugins, before_script]
   script:
     - rm /tmp/test.log >/dev/null 2>&1 || true
-    - composer audit --no-dev --locked --format=plain >/tmp/test.log 2>&1
+    - composer audit --no-dev --locked --format=plain >/tmp/test.log 2>&1 || true
     - EC=0
     - grep "No security vulnerability advisories found" /tmp/test.log || EC=$?
     - if [[ $EC -eq 0 ]]; then exit 0; fi
     - glab issue create --title "Security vulnerability advisories found" --description "$(cat /tmp/test.log)"
     - rm /tmp/test.log >/dev/null 2>&1 || true
-  only:
-    variables:
-      - $CHECKUPDATES
-    refs:
-      - develop
+    - exit 1