Skip to content

Commit

Permalink
Merge branch 'main' into unpin-bb-test
Browse files Browse the repository at this point in the history
  • Loading branch information
Noxsios authored Apr 25, 2024
2 parents 57c5ff1 + 41a2448 commit c67463f
Show file tree
Hide file tree
Showing 4 changed files with 70 additions and 6 deletions.
33 changes: 33 additions & 0 deletions .github/workflows/compare-cves.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,33 @@
name: Compare CVEs to main

permissions:
contents: read

on:
pull_request:
paths:
- "go.mod"
- "go.sum"
- "cargo.toml"
- "cargo.lock"

jobs:
validate:
runs-on: ubuntu-latest
steps:
- name: Checkout repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.head_ref || github.ref_name }}

- name: fetch main
run: git fetch origin main --depth 1

- name: Setup golang
uses: ./.github/actions/golang

- name: Install tools
uses: ./.github/actions/install-tools

- name: Check for CVEs in Dependencies
run: "hack/check-vulnerabilities.sh"
6 changes: 0 additions & 6 deletions .github/workflows/scan-cves.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,6 @@ permissions:
on:
schedule:
- cron: "0 10 * * *"
pull_request:
paths:
- "go.mod"
- "go.sum"
- "cargo.toml"
- "cargo.lock"

jobs:
validate:
Expand Down
30 changes: 30 additions & 0 deletions hack/check-vulnerabilities.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
#!/usr/bin/env bash

set -euo pipefail

MAIN_BRANCH="main"
TARGET_BRANCH=$(git rev-parse --abbrev-ref HEAD)
echo "target branch is $TARGET_BRANCH"

mkdir -p build

git checkout $MAIN_BRANCH
go run main.go tools sbom scan . -o json --exclude './site' --exclude './examples' > build/main-syft.json

git checkout $TARGET_BRANCH
cat build/main-syft.json | grype -o template -t hack/compare.tmpl > build/main.json
go run main.go tools sbom scan . -o json --exclude './site' --exclude './examples' | grype -o template -t hack/compare.tmpl > build/target.json


result=$(jq --slurp '.[0] - .[1]' build/target.json build/main.json | jq '[.[] | select(.severity != "Low" and .severity != "Medium")]')

echo "CVEs on $MAIN_BRANCH are $(cat build/main.json | jq )"
echo "CVEs on $TARGET_BRANCH are $(cat build/target.json | jq)"

if [[ "$result" == "[]" ]]; then
echo "no new vulnerabilities on $TARGET_BRANCH"
exit 0
else
echo "new CVEs have been added with IDs $result"
exit 1
fi
7 changes: 7 additions & 0 deletions hack/compare.tmpl
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
[
{{- $length := len .Matches -}}
{{- range $index, $match := .Matches -}}
{ "id": "{{$match.Vulnerability.ID}}", "severity": "{{$match.Vulnerability.Severity}}" }
{{ if lt (add $index 1) $length }},{{ end }}
{{- end -}}
]

0 comments on commit c67463f

Please sign in to comment.