Skip to content

Commit cf45775

Browse files
m4nch0tm4nch0t
authored
Merge pull request #17 from scality/add_dependabot
👷 add dependabot and tests
2 parents 6ad0a64 + 10d735b commit cf45775

11 files changed

Lines changed: 264 additions & 21 deletions

File tree

‎.devcontainer/Dockerfile‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM mcr.microsoft.com/devcontainers/base:jammy
1+
FROM mcr.microsoft.com/devcontainers/base:noble
22

33
RUN export DEBIAN_FRONTEND=noninteractive && \
44
apt-get update && \
@@ -8,14 +8,29 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
88
bash-completion \
99
curl \
1010
git \
11+
libsqlite3-dev \
12+
python3 \
1113
python3-pip \
14+
python3-venv \
1215
p7zip-full \
1316
skopeo \
1417
tmux \
1518
vim \
1619
&& \
1720
apt-get clean
21+
22+
USER vscode
23+
24+
ENV LANG=C.UTF-8
25+
ENV LC_ALL=C.UTF-8
26+
27+
# Create virtual environment
28+
ENV VIRTUAL_ENV=/home/vscode/venv
29+
RUN python3 -m venv $VIRTUAL_ENV
30+
ENV PATH="$VIRTUAL_ENV/bin:$PATH"
31+
1832
COPY requirements.txt /tmp/requirements.txt
19-
RUN python3 -m pip install --no-cache-dir --upgrade pip && \
20-
python3 -m pip install --no-cache-dir -r /tmp/requirements.txt
21-
USER vscode
33+
34+
# Install python libs in the virtual environment
35+
RUN pip install --upgrade pip && \
36+
pip install -r /tmp/requirements.txt

‎.devcontainer/requirements.txt‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
requests==2.32.0
2-
GitPython==3.1.43
1+
requests==2.32.3
2+
GitPython==3.1.44
33
pyunpack==0.3
4-
patool==2.2.0
4+
patool==4.0.0
5+
pre-commit==4.1.0

‎.devcontainer/setup.sh‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
set -xe
44

5-
if [ "$CODESPACES" = "true" ]; then
5+
if [[ "${CODESPACES}" = "true" ]]; then
66
# NOTE: This is the only way I managed to have the right
77
# permissions files for git sources files
88
# (Some salt pylint test check file permissions and expected 644
@@ -19,10 +19,11 @@ fi
1919
echo "Updating localtime"
2020
sudo ln -fs /usr/share/zoneinfo/UTC /etc/localtime
2121

22-
# Install act
23-
gh extension install https://github.com/nektos/gh-act
22+
echo "Install pre-commit hooks"
23+
pre-commit install --install-hooks
2424

25-
# Install dependencies
2625
echo "Installing dependencies"
27-
python3 src/main.py install
26+
# Run with sudo and preserved environment
27+
sudo PATH="${PATH}" python3 src/main.py install
28+
2829
echo "End of setup"

‎.github/dependabot.yml‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
---
2+
version: 2
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/.github/workflows"
6+
schedule:
7+
interval: "daily"
8+
reviewers:
9+
- "scality/metalk8s"
10+
11+
- package-ecosystem: "pip"
12+
directory: "./requirements.txt"
13+
schedule:
14+
interval: "daily"
15+
rebase-strategy: "auto"
16+
reviewers:
17+
- "scality/metalk8s"
18+
19+
- package-ecosystem: "npm"
20+
directory: "/tests"
21+
schedule:
22+
interval: "daily"
23+
labels: [test]
24+
ignore:
25+
- dependency-name: "*"
26+
27+
- package-ecosystem: "github-actions"
28+
directory: "/tests"
29+
schedule:
30+
interval: "daily"
31+
labels: [test]
32+
ignore:
33+
- dependency-name: "*"

‎.github/scripts/update_scanners.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/usr/bin/env python3
2+
3+
import re
4+
import requests
5+
6+
# Define the scanners and their GitHub repositories
7+
scanners = {
8+
"syft": "anchore/syft",
9+
"grype": "anchore/grype",
10+
"trivy": "aquasecurity/trivy"
11+
}
12+
13+
def get_latest_release(repo):
14+
url = f"https://api.github.com/repos/{repo}/releases/latest"
15+
response = requests.get(url)
16+
response.raise_for_status()
17+
return response.json()["tag_name"].lstrip("v")
18+
19+
def update_versions(file_path):
20+
with open(file_path, "r") as file:
21+
content = file.read()
22+
23+
for scanner, repo in scanners.items():
24+
latest_version = get_latest_release(repo)
25+
content = re.sub(
26+
f'("{scanner}": ")([^"]+)',
27+
lambda match: f'{match.group(1)}{latest_version}',
28+
content
29+
)
30+
31+
with open(file_path, "w") as file:
32+
file.write(content)
33+
34+
if __name__ == "__main__":
35+
update_versions("src/lib/install.py")

‎.github/workflows/nightly.yaml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
---
2+
name: "nightly"
3+
run-name: "Nightly tests for ${{ github.ref_name }}"
4+
5+
on:
6+
schedule:
7+
- cron: "22 0 * * *" # Runs daily at 22:00 UTC
8+
workflow_dispatch:
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
update-scanners:
15+
runs-on: ubuntu-24.04
16+
steps:
17+
18+
- name: Create github token
19+
uses: actions/create-github-app-token@v1
20+
id: app-token
21+
with:
22+
app-id: ${{ vars.ACTIONS_APP_ID }}
23+
private-key: ${{ secrets.ACTIONS_APP_PRIVATE_KEY }}
24+
owner: ${{ github.repository_owner }}
25+
26+
- name: Checkout repository
27+
uses: actions/checkout@v4
28+
with:
29+
token: ${{ steps.app-token.outputs.token }}
30+
31+
- name: Set up Python
32+
uses: actions/setup-python@v5
33+
with:
34+
python-version: 3.12
35+
36+
- name: Install dependencies
37+
run: pip install requests
38+
39+
- name: Update scanner versions
40+
run: python .github/scripts/update_scanners.py
41+
42+
- name: Create pull request
43+
uses: actions/github-script@v7
44+
with:
45+
script: |
46+
const pr = await github.rest.pulls.create({
47+
owner: context.repo.owner,
48+
repo: context.repo.repo,
49+
head: "feature/deps-update",
50+
base: "main",
51+
title: ":arrow_up: Update scanner versions"
52+
})
53+
54+
vuln-scan:
55+
permissions:
56+
contents: read # for actions/checkout to fetch code
57+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
58+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
59+
runs-on: ubuntu-24.04
60+
steps:
61+
- name: Checkout
62+
uses: actions/checkout@v4
63+
with:
64+
fetch-depth: 0
65+
fetch-tags: true
66+
67+
- name: Create SBOM
68+
uses: anchore/sbom-action@v0
69+
with:
70+
path: ./
71+
format: cyclonedx-json
72+
output-file: "${{ github.event.repository.name }}-sbom.cdx.json"
73+
74+
- name: Scan SBOM
75+
uses: anchore/scan-action@v6
76+
id: scan
77+
with:
78+
sbom: "${{ github.event.repository.name }}-sbom.cdx.json"
79+
output-format: sarif
80+
fail-build: false
81+
add-cpes-if-none: true
82+
by-cve: true
83+
84+
- name: Upload SARIF report
85+
uses: github/codeql-action/upload-sarif@v3
86+
with:
87+
sarif_file: ${{ steps.scan.outputs.sarif }}

‎.github/workflows/tests.yaml‎

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ on:
55

66
jobs:
77
test-as-action:
8-
runs-on: ubuntu-22.04
8+
runs-on: ubuntu-24.04
99
steps:
1010
- name: Checkout
1111
uses: actions/checkout@v4
@@ -23,15 +23,15 @@ jobs:
2323
with:
2424
target: ./
2525
output-dir: "/tmp/test/sbom"
26-
syft-version: "1.1.0"
2726
vuln-report: True
2827

2928
- name: Scan directory
3029
uses: ./
3130
with:
32-
target: /etc
31+
target: /usr/local/bin
3332
output-dir: "/tmp/test/sbom"
34-
name: "ghactionetc"
33+
syft-version: "1.10.0"
34+
name: "usrlocalbin"
3535

3636
- name: Scan iso
3737
uses: ./
@@ -42,6 +42,39 @@ jobs:
4242
name: "tinycorelinux"
4343
vuln-report: False
4444

45+
- name: Ensure generated sbom file for repo contains the expected content
46+
shell: bash
47+
run: |
48+
if jq -e '.components[] | select(.name == "lodash")' /tmp/test/sbom/repo_sbom_*.json > /dev/null; then
49+
echo "lodash is present in the JSON file."
50+
exit 0
51+
else
52+
echo "lodash is NOT present in the JSON file."
53+
exit 1
54+
fi
55+
56+
- name: Ensure generated sbom file for iso contains the expected content
57+
shell: bash
58+
run: |
59+
if jq -e '.components[] | select(.version == "6.6.8-tinycore")' /tmp/test/sbom/iso_tinycorelinux_15.0.json > /dev/null; then
60+
echo "tinycore is present in the JSON file."
61+
exit 0
62+
else
63+
echo "tinycore is NOT present in the JSON file."
64+
exit 1
65+
fi
66+
67+
- name: Ensure generated sbom file for dir contains the expected content
68+
shell: bash
69+
run: |
70+
if jq -e '.components[] | select(.purl == "pkg:golang/github.com/anchore/syft@v1.10.0")' /tmp/test/sbom/dir_bin_undefined.json > /dev/null; then
71+
echo "syft is present in the JSON file."
72+
exit 0
73+
else
74+
echo "syft is NOT present in the JSON file."
75+
exit 1
76+
fi
77+
4578
- name: Print the content of generated sbom file
4679
shell: bash
4780
run: |

‎.pre-commit-config.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
---
2+
repos:
3+
- repo: https://github.com/psf/black
4+
rev: 25.1.0
5+
hooks:
6+
- id: black
7+
files: src/.*\.py
8+
name: Formatting Python
9+
- id: black
10+
files: src/.*\.py
11+
# We want this hook to be part of "lint" so that if we run
12+
# `pre-commit run lint` we include this hook
13+
alias: lint
14+
name: Checking Python formatting
15+
args:
16+
- --check
17+
- --diff
18+
19+
- repo: https://github.com/pycqa/pylint
20+
rev: v3.3.5
21+
hooks:
22+
- id: pylint
23+
alias: lint
24+
name: Lint Python (CLI)
25+
files: src/.*\.py
26+
additional_dependencies:
27+
- 'requests~=2.32.3'
28+
- 'GitPython~=3.1.44'
29+
- 'pyunpack~=0.3'
30+
- 'patool~=4.0.0'

‎CONTRIBUTING.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,9 @@ It has been installed through the `gh` extension.
1515
To run the workflow locally, execute the following command:
1616

1717
```bash
18-
gh act push --rm --workflows=.github/workflows/tests.yaml -P ubuntu-22.04=ghcr.io/catthehacker/ubuntu:act-22.04
18+
docker login ghcr.io
19+
gh extension install https://github.com/nektos/gh-act
20+
gh act push --rm --workflows=.github/workflows/tests.yaml -P ubuntu-24.04=ghcr.io/catthehacker/ubuntu:act-22.04
1921
```
2022

2123
For more information on how to use `act`, please refer to the [official documentation] or run `gh act --help`.

‎action.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
---
12
name: "Scality SBOM Action"
23
description: "Creates an SBOM (Software Bill Of Materials) from your code, and artifacts."
34
author: "Scality"
@@ -73,7 +74,7 @@ runs:
7374
file \
7475
jq \
7576
p7zip-full \
76-
python3-distutils
77+
python3-setuptools
7778
7879
- name: Run the scan
7980
shell: bash

0 commit comments

Comments
 (0)