Reusable flow to check for vulns in dependencies of a Nsolid branch #33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable flow to check for vulns in dependencies of a Nsolid branch | |
| on: | |
| workflow_call: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| secrets: | |
| NVD_API_KEY: | |
| required: true | |
| workflow_dispatch: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| check-vulns: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set_matrix.outputs.matrix }} | |
| steps: | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Verify Node.js and npm installation | |
| run: | | |
| echo "Node.js version:" | |
| node --version | |
| echo "npm version:" | |
| npm --version | |
| echo "Python version:" | |
| python3 --version | |
| - name: Checkout current repository | |
| uses: actions/checkout@v4 | |
| - name: Debug directory structure | |
| run: | | |
| echo "Current directory:" | |
| pwd | |
| echo "Directory contents:" | |
| ls -la | |
| echo "dep_checker directory exists:" | |
| ls -la dep_checker/ || echo "dep_checker directory not found" | |
| - name: Installing pre-reqs | |
| working-directory: ./dep_checker | |
| run: pip install -r requirements.txt | |
| - name: Checkout Nsolid repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: nodesource/nsolid | |
| path: nsolid | |
| ref: ${{ inputs.nsolidStream }} | |
| - name: Run the check | |
| working-directory: ./dep_checker | |
| run: | | |
| ( | |
| set -o pipefail | |
| python3 main.py --json-output --include-npm --npm-timeout 600 --gh-token ${{ secrets.GITHUB_TOKEN }} --nvd-key=${{ secrets.NVD_API_KEY }} ../nsolid ${{ inputs.nsolidStream }} 2>&1 | tee result.log | |
| ) | |
| cat result.log | |
| - name: build matrix | |
| id: set_matrix | |
| if: ${{ failure() }} | |
| working-directory: ./dep_checker | |
| run: | | |
| # Extract vulnerabilities JSON from the log | |
| vulnerabilities_json=$(grep -o '{.*}' result.log | tail -1) | |
| echo "Raw vulnerabilities JSON: $vulnerabilities_json" | |
| # Use the matrix formatter to build the complete matrix with labels | |
| matrix=$(python3 ../.github/workflows/format_matrix.py "$vulnerabilities_json" "${{ inputs.nsolidStream }}") | |
| echo "Formatted matrix: $matrix" | |
| echo "matrix=$matrix" >> $GITHUB_OUTPUT | |
| create-issues: | |
| needs: check-vulns | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.check-vulns.outputs.matrix) }} | |
| max-parallel: 1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Debug matrix data | |
| run: | | |
| echo "Matrix vulnerability data:" | |
| echo "ID: ${{ matrix.vulnerabilities.id }}" | |
| echo "Dependency: ${{ matrix.vulnerabilities.dependency }}" | |
| echo "Source: ${{ matrix.vulnerabilities.source }}" | |
| echo "Labels: ${{ join(matrix.vulnerabilities.labels, ', ') }}" | |
| echo "ISSUE_LABELS: ${{ join(matrix.vulnerabilities.labels, ',') }}" | |
| - name: Create or update GitHub issue | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Set variables | |
| VULN_ID="${{ matrix.vulnerabilities.id }}" | |
| VULN_URL="${{ matrix.vulnerabilities.url }}" | |
| VULN_DEP_NAME="${{ matrix.vulnerabilities.dependency }}" | |
| VULN_DEP_VERSION="${{ matrix.vulnerabilities.version }}" | |
| VULN_SOURCE="${{ matrix.vulnerabilities.source }}" | |
| VULN_MAIN_DEP_NAME="${{ matrix.vulnerabilities.main_dep_name }}" | |
| VULN_MAIN_DEP_PATH="${{ matrix.vulnerabilities.main_dep_path }}" | |
| NODEJS_STREAM="${{ inputs.nsolidStream }}" | |
| ACTION_URL="https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| LABELS="${{ join(matrix.vulnerabilities.labels, ',') }}" | |
| # Create issue title | |
| ISSUE_TITLE="${VULN_ID} (${VULN_DEP_NAME}) found on ${NODEJS_STREAM}" | |
| # Create issue body | |
| ISSUE_BODY="A new vulnerability for ${VULN_DEP_NAME} ${VULN_DEP_VERSION} was found: | |
| Vulnerability ID: ${VULN_ID} | |
| Vulnerability URL: ${VULN_URL}" | |
| # Add npm-specific info if applicable | |
| if [ "${VULN_SOURCE}" = "npm" ] && [ -n "${VULN_MAIN_DEP_NAME}" ]; then | |
| ISSUE_BODY="${ISSUE_BODY} | |
| Main Dependency: ${VULN_MAIN_DEP_NAME} | |
| Main Dependency Path: ${VULN_MAIN_DEP_PATH}" | |
| fi | |
| ISSUE_BODY="${ISSUE_BODY} | |
| Failed run: ${ACTION_URL}" | |
| # Check if issue already exists | |
| EXISTING_ISSUE=$(gh issue list --search "in:title ${ISSUE_TITLE}" --state open --json number,title --jq '.[] | select(.title == "'"${ISSUE_TITLE}"'") | .number') | |
| if [ -n "${EXISTING_ISSUE}" ]; then | |
| echo "Updating existing issue #${EXISTING_ISSUE}: ${ISSUE_TITLE}" | |
| gh issue edit "${EXISTING_ISSUE}" --body "${ISSUE_BODY}" | |
| echo "Updated issue: https://github.com/${{ github.repository }}/issues/${EXISTING_ISSUE}" | |
| else | |
| echo "Creating new issue: ${ISSUE_TITLE}" | |
| # Create issue and capture the URL, then extract issue number | |
| ISSUE_URL=$(gh issue create --title "${ISSUE_TITLE}" --body "${ISSUE_BODY}" --label "${LABELS}") | |
| ISSUE_NUMBER=$(echo "${ISSUE_URL}" | sed 's/.*\/issues\///') | |
| echo "Created issue: ${ISSUE_URL}" | |
| fi |