Reusable flow to check for vulns in dependencies of a Nsolid branch #60
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Reusable flow to check for vulns in dependencies of a Nsolid branch | |
| on: | |
| workflow_call: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| description: 'N|Solid branch or ref to scan' | |
| secrets: | |
| NVD_API_KEY: | |
| required: true | |
| workflow_dispatch: | |
| inputs: | |
| nsolidStream: | |
| type: string | |
| default: 'main' | |
| description: 'N|Solid branch or ref to scan' | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| check-vulns: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set_matrix.outputs.matrix }} | |
| scan_status: ${{ steps.scan.outputs.status }} | |
| steps: | |
| - name: Setup Python 3.11 | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: '18' | |
| - name: Verify Node.js and npm installation | |
| run: | | |
| echo "Node.js version:" | |
| node --version | |
| echo "npm version:" | |
| npm --version | |
| echo "Python version:" | |
| python3 --version | |
| - name: Checkout current repository | |
| uses: actions/checkout@v4 | |
| - name: Debug directory structure | |
| run: | | |
| echo "Current directory:" | |
| pwd | |
| echo "Directory contents:" | |
| ls -la | |
| echo "dep_checker directory exists:" | |
| ls -la dep_checker/ || echo "dep_checker directory not found" | |
| - name: Installing pre-reqs | |
| working-directory: ./dep_checker | |
| run: pip install -r requirements.txt | |
| - name: Checkout Nsolid repo | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: nodesource/nsolid | |
| path: nsolid | |
| ref: ${{ inputs.nsolidStream }} | |
| - name: Run the check | |
| id: scan | |
| working-directory: ./dep_checker | |
| run: | | |
| set +e | |
| set -o pipefail | |
| python3 main.py --json-output --include-npm --npm-timeout 600 --gh-token ${{ secrets.GITHUB_TOKEN }} --nvd-key=${{ secrets.NVD_API_KEY }} ../nsolid ${{ inputs.nsolidStream }} 2>&1 | tee result.log | |
| status=${PIPESTATUS[0]} | |
| echo "status=$status" >> "$GITHUB_OUTPUT" | |
| echo "Scanner exit status: $status" | |
| cat result.log | |
| exit 0 | |
| - name: build matrix | |
| id: set_matrix | |
| if: ${{ steps.scan.outputs.status == '1' }} | |
| working-directory: ./dep_checker | |
| run: | | |
| # Extract vulnerabilities JSON from the log | |
| vulnerabilities_json=$(grep -o '{.*}' result.log | tail -1) | |
| echo "Raw vulnerabilities JSON: $vulnerabilities_json" | |
| # Use the matrix formatter to build the complete matrix with labels | |
| matrix=$(python3 ../.github/workflows/format_matrix.py "$vulnerabilities_json" "${{ inputs.nsolidStream }}") | |
| echo "Formatted matrix: $matrix" | |
| echo "matrix=$matrix" >> $GITHUB_OUTPUT | |
| - name: Fail on scan error | |
| if: ${{ steps.scan.outputs.status != '0' && steps.scan.outputs.status != '1' }} | |
| run: | | |
| echo "Dependency vulnerability scan failed; no issue matrix was generated." | |
| exit 1 | |
| create-issues: | |
| needs: check-vulns | |
| if: ${{ needs.check-vulns.outputs.scan_status == '1' }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{ fromJson(needs.check-vulns.outputs.matrix) }} | |
| max-parallel: 1 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Debug matrix data | |
| run: | | |
| echo "Matrix vulnerability data:" | |
| echo "ID: ${{ matrix.vulnerabilities.id }}" | |
| echo "Dependency: ${{ matrix.vulnerabilities.dependency }}" | |
| echo "Source: ${{ matrix.vulnerabilities.source }}" | |
| echo "Labels: ${{ join(matrix.vulnerabilities.labels, ', ') }}" | |
| echo "ISSUE_LABELS: ${{ join(matrix.vulnerabilities.labels, ',') }}" | |
| - name: Create or update GitHub issue | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| VULN_ID: ${{ matrix.vulnerabilities.id }} | |
| VULN_URL: ${{ matrix.vulnerabilities.url }} | |
| VULN_DEP_NAME: ${{ matrix.vulnerabilities.dependency }} | |
| VULN_DEP_VERSION: ${{ matrix.vulnerabilities.version }} | |
| VULN_SOURCE: ${{ matrix.vulnerabilities.source }} | |
| VULN_TITLE: ${{ matrix.vulnerabilities.title }} | |
| VULN_MAIN_DEP_NAME: ${{ matrix.vulnerabilities.main_dep_name }} | |
| VULN_MAIN_DEP_PATH: ${{ matrix.vulnerabilities.main_dep_path }} | |
| NODEJS_STREAM: ${{ inputs.nsolidStream }} | |
| ACTION_URL: "https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}" | |
| LABELS: ${{ join(matrix.vulnerabilities.labels, ',') }} | |
| run: | | |
| .github/workflows/create_issue.sh |