|
| 1 | +name: Check binaries |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_dispatch: |
| 5 | + schedule: |
| 6 | + - cron: "0 16 * * 1-5" # min h d Mo DoW / 9am PST M-F |
| 7 | + |
| 8 | +jobs: |
| 9 | + check-for-vulnerabilities: |
| 10 | + runs-on: ubuntu-latest |
| 11 | + outputs: |
| 12 | + report_contents: ${{ steps.save-output.outputs.report_contents }} |
| 13 | + steps: |
| 14 | + - name: Setup python |
| 15 | + uses: actions/setup-python@v5 |
| 16 | + with: |
| 17 | + python-version: '3.11' |
| 18 | + - name: Checkout code |
| 19 | + uses: actions/checkout@v4 |
| 20 | + with: |
| 21 | + ref: main |
| 22 | + - name: Download latest release |
| 23 | + |
| 24 | + with: |
| 25 | + latest: true |
| 26 | + fileName: 'aws-lambda-rie*' |
| 27 | + out-file-path: "bin" |
| 28 | + - name: Run check for vulnerabilities |
| 29 | + id: check-binaries |
| 30 | + run: | |
| 31 | + make check-binaries |
| 32 | + - if: always() && failure() # `always()` to run even if the previous step failed. Failure means that there are vulnerabilities |
| 33 | + name: Save content of the vulnerabilities report as GitHub output |
| 34 | + id: save-output |
| 35 | + run: | |
| 36 | + report_csv="$(ls -tr output.cve-bin-*.csv 2>/dev/null | tail -n1)" # last file generated |
| 37 | + if [ -z "$report_csv" ]; then |
| 38 | + echo "No file with vulnerabilities. Probably a failure in previous step." |
| 39 | + else |
| 40 | + echo "Vulnerabilities stored in $report_csv" |
| 41 | + fi |
| 42 | + final_report="${report_csv}.txt" |
| 43 | + awk -F',' '{n=split($10, path, "/"); print $2,$3,$4,$5,path[n]}' "$report_csv" | column -t > "$final_report" # make the CSV nicer |
| 44 | + echo "report_contents<<EOF" >> "$GITHUB_OUTPUT" |
| 45 | + cat "$final_report" >> "$GITHUB_OUTPUT" |
| 46 | + echo "EOF" >> "$GITHUB_OUTPUT" |
| 47 | + - if: always() && steps.save-output.outputs.report_contents |
| 48 | + name: Build new binaries and check vulnerabilities again |
| 49 | + id: check-new-version |
| 50 | + run: | |
| 51 | + mkdir ./bin2 |
| 52 | + mv ./bin/* ./bin2 |
| 53 | + make compile-with-docker-all |
| 54 | + latest_version=$(strings bin/aws-lambda-rie* | grep '^go1\.' | sort | uniq) |
| 55 | + echo "latest_version=$latest_version" >> "$GITHUB_OUTPUT" |
| 56 | + make check-binaries |
| 57 | + - if: always() && steps.save-output.outputs.report_contents |
| 58 | + name: Save outputs for the check with the latest build |
| 59 | + id: save-new-version |
| 60 | + run: | |
| 61 | + if [ "${{ steps.check-new-version.outcome }}" == "failure" ]; then |
| 62 | + fixed="No" |
| 63 | + else |
| 64 | + fixed="Yes" |
| 65 | + fi |
| 66 | + echo "fixed=$fixed" >> "$GITHUB_OUTPUT" |
| 67 | + - if: always() && steps.save-output.outputs.report_contents |
| 68 | + name: Create GitHub Issue indicating vulnerabilities |
| 69 | + id: create-issue |
| 70 | + uses: dacbd/create-issue-action@main |
| 71 | + with: |
| 72 | + token: ${{ github.token }} |
| 73 | + title: | |
| 74 | + CVEs found in latest RIE release |
| 75 | + body: | |
| 76 | + ### CVEs found in latest RIE release |
| 77 | + ``` |
| 78 | + ${{ steps.save-output.outputs.report_contents }} |
| 79 | + ``` |
| 80 | + |
| 81 | + #### Are these resolved by building with the latest patch version of Go (${{ steps.check-new-version.outputs.latest_version }})?: |
| 82 | + > **${{ steps.save-new-version.outputs.fixed }}** |
0 commit comments