Skip to content

Commit 2d6eef8

Browse files
thomasleplusthomasleplus
committed
ci(osv-scanner): bump osv-scanner version to 2.5.0
1 parent c9af569 commit 2d6eef8

2 files changed

Lines changed: 135 additions & 0 deletions

File tree

‎.github/workflows/osv-scanner-pr.yml-e‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
# This workflow uses actions that are not certified by GitHub.
3+
# They are provided by a third-party and are governed by
4+
# separate terms of service, privacy policy, and support
5+
# documentation.
6+
7+
# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
8+
# in addition to a PR check which fails if new vulnerabilities are introduced.
9+
#
10+
# For more examples and options, including how to ignore specific vulnerabilities,
11+
# see https://google.github.io/osv-scanner/github-action/
12+
13+
name: "OSV Scanner - PR"
14+
15+
on:
16+
pull_request:
17+
branches: ["main"]
18+
workflow_dispatch:
19+
20+
permissions: {}
21+
22+
jobs:
23+
osv-scanner-pr:
24+
permissions:
25+
# Require writing security events to upload SARIF file to security tab
26+
security-events: write
27+
# Read commit contents
28+
contents: read
29+
# Actions read-only
30+
actions: read
31+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@8deb546fdb875b9996d27d4950be7312dac076a1" # v2.5.0
32+
with:
33+
fail-on-vuln: false
34+
check:
35+
runs-on: ubuntu-latest
36+
needs: osv-scanner-pr
37+
steps:
38+
- name: Check OSV scan results
39+
shell: bash
40+
env:
41+
# Passed through the environment rather than interpolated into the
42+
# script body. The runner injects these out-of-band, so the scanner
43+
# JSON can never break out of the surrounding shell context no matter
44+
# what it contains or how large it is.
45+
NEW_RESULTS: ${{ needs.osv-scanner-pr.outputs.new-results }}
46+
OLD_RESULTS: ${{ needs.osv-scanner-pr.outputs.old-results }}
47+
run: |
48+
set -euo pipefail
49+
IFS=$'\n\t'
50+
# printf is a bash builtin, so the (potentially very large) values are
51+
# written to disk without hitting the ARG_MAX command-line limit.
52+
printf '%s' "${NEW_RESULTS}" > "${RUNNER_TEMP}/new_results.json"
53+
printf '%s' "${OLD_RESULTS}" > "${RUNNER_TEMP}/old_results.json"
54+
# Fail if any vulnerability present in the new results is absent from
55+
# the old results, i.e. the PR introduces it. Read via process
56+
# substitution rather than a pipe so the rc assignment is not lost in
57+
# a subshell, and use a fixed-string match for the exact vuln id.
58+
rc=0
59+
while read -r vid; do
60+
if ! grep -qF -e "\"${vid}\"" "${RUNNER_TEMP}/old_results.json"; then
61+
rc=1
62+
>&2 echo "error: PR introduces new vulnerability ${vid} (see step 'scan > osv-scanner-pr > Run osv-scanner-reporter' for details)"
63+
fi
64+
done < <(jq -r '.results[]?.packages[]?.vulnerabilities[]?.id' "${RUNNER_TEMP}/new_results.json")
65+
if [ "${rc}" -ne 0 ]; then
66+
exit 1
67+
fi

‎.github/workflows/osv-scanner.yml-e‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
# This workflow uses actions that are not certified by GitHub.
3+
# They are provided by a third-party and are governed by
4+
# separate terms of service, privacy policy, and support
5+
# documentation.
6+
7+
# A sample workflow which sets up periodic OSV-Scanner scanning for vulnerabilities,
8+
# in addition to a PR check which fails if new vulnerabilities are introduced.
9+
#
10+
# For more examples and options, including how to ignore specific vulnerabilities,
11+
# see https://google.github.io/osv-scanner/github-action/
12+
13+
name: "OSV Scanner"
14+
15+
on:
16+
push:
17+
branches: ["main"]
18+
schedule:
19+
- cron: "0 0 * * 0"
20+
workflow_dispatch:
21+
22+
permissions: {}
23+
24+
jobs:
25+
osv-scanner:
26+
permissions:
27+
# Required to upload the SARIF file to the security tab
28+
security-events: write
29+
# Required to read the code
30+
contents: read
31+
# Required to read the code
32+
actions: read
33+
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@8deb546fdb875b9996d27d4950be7312dac076a1" # v2.5.0
34+
with:
35+
fail-on-vuln: false
36+
check:
37+
runs-on: ubuntu-latest
38+
needs: osv-scanner
39+
steps:
40+
- name: Check OSV scan results
41+
shell: bash
42+
env:
43+
# Passed through the environment rather than interpolated into the
44+
# script body. The runner injects this out-of-band, so the scanner
45+
# JSON can never break out of the surrounding shell context no matter
46+
# what it contains or how large it is.
47+
RESULTS: ${{ needs.osv-scanner.outputs.results }}
48+
run: |
49+
set -euo pipefail
50+
IFS=$'\n\t'
51+
# printf is a bash builtin, so the (potentially very large) value is
52+
# written to disk without hitting the ARG_MAX command-line limit.
53+
printf '%s' "${RESULTS}" > "${RUNNER_TEMP}/results.json"
54+
# jq expression:
55+
# - iterate packages -> vulnerabilities -> full osv entry -> severity[] (type, score)
56+
# - extract numeric scores for CVSS types (cvss_v3 or numeric severity[].score)
57+
# - compare to threshold
58+
if jq '
59+
.results[]
60+
| .packages[]?
61+
| .vulnerabilities[]?
62+
| ( .severity[]?.score // "" ) as $s
63+
| select($s != "")
64+
| ($s | tonumber) >= 4.0
65+
' "${RUNNER_TEMP}/results.json" | grep -q -e . ; then
66+
>&2 echo "error: found one or more vulnerabilities with a medium or higher severity (see step 'scan > osv-scanner > Run osv-scanner-reporter' for details)"
67+
exit 1
68+
fi

0 commit comments

Comments
 (0)