test OSV Action with custom lock file

Author: kikofernandez

.github/scripts/otp-compliance.es

@@ -1220,64 +1220,85 @@ osv_scan(_) ->
     application:ensure_all_started([ssl, inets]),
     URI = "https://api.osv.dev/v1/querybatch",
     Format = "application/x-www-form-urlencoded",
+    File = "osv-scanner.json",
 
     VendorSrcFiles = find_vendor_src_files("."),
     Packages = generate_vendor_info_package(VendorSrcFiles),
 
-    OSVQuery = generate_osv_query(Packages),
-    io:format("[OSV] Information sent~n~s~n", [json:format(OSVQuery)]),
-    OSV = json:encode(OSVQuery),
-
-    Content = {URI, [], Format, OSV},
-    Result = httpc:request(post, Content, [], []),
-    case Result of
-        {ok,{{_, 200,_}, _Headers, Body}} ->
-            #{~"results" := OSVResults} = json:decode(erlang:list_to_binary(Body)),
-            Vulnerabilities = lists:filter(fun (#{~"vulns" := _Ids}) -> true; (_) -> false end, OSVResults),
-            case Vulnerabilities of
-                [] ->
-                    io:format("[OSV] No vulnerabilities found.~n");
-                _ ->
-                    FormatVulns = format_vulnerabilities(OSVQuery, OSVResults),
-                    fail("[OSV] There are existing vulnerabilities:~n~s", [FormatVulns])
-            end;
-        {error, Error} ->
-            fail("[OSV] POST request to ~p errors: ~p", [URI, Error])
-    end.
-
-format_vulnerabilities(OSVQuery, OSVResults) ->
-    NameVulnerabilities = lists:zip(osv_names(OSVQuery), OSVResults),
-    ExistingVulnerabilities = lists:filtermap(fun ({Name, #{~"vulns" := Ids}}) ->
-                                                      {true, {Name, [Id || #{~"id" := Id} <- Ids]}};
-                                                  (_) ->
-                                                      false
-                                              end, NameVulnerabilities),
-    lists:map(fun ({N, Ids}) ->
-                      io_lib:format("- ~s: ~s~n", [N, lists:join(",", Ids)])
-              end, ExistingVulnerabilities).
-
-osv_names(#{~"queries" := Packages}) ->
-    lists:map(fun osv_names/1, Packages);
-osv_names(#{~"package" := #{~"name" := Name }}) ->
-    Name.
-
-generate_osv_query(Packages) ->
-    #{~"queries" => lists:foldl(fun generate_osv_query/2, [], Packages)}.
-generate_osv_query(#{~"versionInfo" := Vsn, ~"ecosystem" := Ecosystem, ~"name" := Name}, Acc) ->
-    Package = #{~"package" => #{~"name" => Name, ~"ecosystem" => Ecosystem}, ~"version" => Vsn},
+    %% Test if this works in a Github Workflow
+    OSVQueryResults = generate_osv_results(Packages),
+    file:write_file(File, json:format(OSVQueryResults)).
+
+    %% OSVQuery = generate_osv_query(Packages),
+%%     io:format("[OSV] Information sent~n~s~n", [json:format(OSVQuery)]),
+%%     OSV = json:encode(OSVQuery),
+
+%%     Content = {URI, [], Format, OSV},
+%%     Result = httpc:request(post, Content, [], []),
+%%     case Result of
+%%         {ok,{{_, 200,_}, _Headers, Body}} ->
+%%             #{~"results" := OSVResults} = json:decode(erlang:list_to_binary(Body)),
+%%             Vulnerabilities = lists:filter(fun (#{~"vulns" := _Ids}) -> true; (_) -> false end, OSVResults),
+%%             case Vulnerabilities of
+%%                 [] ->
+%%                     io:format("[OSV] No vulnerabilities found.~n");
+%%                 _ ->
+%%                     FormatVulns = format_vulnerabilities(OSVQuery, OSVResults),
+%%                     fail("[OSV] There are existing vulnerabilities:~n~s", [FormatVulns])
+%%             end;
+%%         {error, Error} ->
+%%             fail("[OSV] POST request to ~p errors: ~p", [URI, Error])
+%%     end.
+
+%% format_vulnerabilities(OSVQuery, OSVResults) ->
+%%     NameVulnerabilities = lists:zip(osv_names(OSVQuery), OSVResults),
+%%     ExistingVulnerabilities = lists:filtermap(fun ({Name, #{~"vulns" := Ids}}) ->
+%%                                                       {true, {Name, [Id || #{~"id" := Id} <- Ids]}};
+%%                                                   (_) ->
+%%                                                       false
+%%                                               end, NameVulnerabilities),
+%%     lists:map(fun ({N, Ids}) ->
+%%                       io_lib:format("- ~s: ~s~n", [N, lists:join(",", Ids)])
+%%               end, ExistingVulnerabilities).
+
+%% osv_names(#{~"queries" := Packages}) ->
+%%     lists:map(fun osv_names/1, Packages);
+%% osv_names(#{~"package" := #{~"name" := Name }}) ->
+%%     Name.
+
+%% generate_osv_query(Packages) ->
+%%     #{~"queries" => lists:foldl(fun generate_osv_query/2, [], Packages)}.
+%% generate_osv_query(#{~"versionInfo" := Vsn, ~"ecosystem" := Ecosystem, ~"name" := Name}, Acc) ->
+%%     Package = #{~"package" => #{~"name" => Name, ~"ecosystem" => Ecosystem}, ~"version" => Vsn},
+%%     [Package | Acc];
+%% generate_osv_query(#{~"sha" := SHA, ~"downloadLocation" := Location}, Acc) ->
+%%     case string:prefix(Location, ~"https://") of
+%%         nomatch ->
+%%             Acc;
+%%         URI ->
+%%             Package = #{~"package" => #{~"name" => URI}, ~"commit" => SHA},
+%%             [Package | Acc]
+%%     end;
+%% generate_osv_query(_, Acc) ->
+%%     Acc.
+
+
+generate_osv_results(Packages) ->
+    #{~"results" => [#{~"packages" => lists:foldl(fun generate_osv_results/2, [], Packages)}]}.
+generate_osv_results(#{~"versionInfo" := Vsn, ~"ecosystem" := Ecosystem, ~"name" := Name}, Acc) ->
+    Package = #{~"package" => #{~"name" => Name, ~"ecosystem" => Ecosystem, ~"version" => Vsn}},
     [Package | Acc];
-generate_osv_query(#{~"sha" := SHA, ~"downloadLocation" := Location}, Acc) ->
+generate_osv_results(#{~"sha" := SHA, ~"downloadLocation" := Location}, Acc) ->
     case string:prefix(Location, ~"https://") of
         nomatch ->
             Acc;
         URI ->
-            Package = #{~"package" => #{~"name" => URI}, ~"commit" => SHA},
+            Package = #{~"package" => #{~"name" => URI, ~"commit" => SHA}},
             [Package | Acc]
     end;
-generate_osv_query(_, Acc) ->
+generate_osv_results(_, Acc) ->
     Acc.
 
-
 cleanup_path(<<"./", Path/binary>>) when is_binary(Path) -> Path;
 cleanup_path(Path) when is_binary(Path) -> Path.
 

.github/workflows/osv-scanner-scheduled.yml

@@ -76,6 +76,30 @@ jobs:
             /repos/${{ github.repository }}/actions/workflows/osv-scanner-scheduled.yml/dispatches \
             -f "ref=${{ matrix.type }}"
 
+  extract-deps:
+    name: Extract Dependencies
+    runs-on: ubuntu-latest
+    needs:
+        - pack
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # ratchet:actions/[email protected]
+      - uses: ./.github/actions/build-base-image
+        with:
+            BASE_BRANCH: ${{ env.BASE_BRANCH }}
+
+      # check that PRs do not introduce vulnerabilities in vendor dependencies
+      - name: 'Vendor Vulnerability Scanning'
+        run: |
+          docker run -v $PWD/:/github -v $HOME:$HOME otp \
+            "/github/.github/scripts/otp-compliance.es sbom osv-scan"
+
+      - name: "upload osv-scanner deps" # Upload the deps
+        uses: actions/upload-artifact@v4
+        with:
+          name: converted-OSV-Scanner-deps
+          path: osv-scanner.json
+          retention-days: 2
+
   scan-pr:
     # run-scheduled-scan triggers this job
     # PRs and pushes trigger this job
@@ -90,3 +114,5 @@ jobs:
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6fc714450122bda9d00e4ad5d639ad6a39eedb1f" # ratchet:google/osv-scanner-action/.github/workflows/[email protected]
     with:
         upload-sarif: ${{ github.repository == 'erlang/otp' }}
+        scan-args: |-
+            --lockfile=osv-scanner:osv-scanner.json