Skip to content

Commit 017f7c1

Browse files
olamilekan000olamilekan000
committed
added path base CVE scanner
1 parent d0494b5 commit 017f7c1

1 file changed

Lines changed: 183 additions & 0 deletions

File tree

‎.github/workflows/nightly-security-scan.yml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
name: Nightly Security Scan
2+
3+
on:
4+
schedule:
5+
- cron: '30 0 * * *'
6+
workflow_dispatch:
7+
8+
permissions:
9+
contents: read
10+
security-events: write
11+
actions: read
12+
checks: write
13+
statuses: write
14+
15+
jobs:
16+
osv-scan:
17+
name: OSV-Scanner
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@v4
22+
23+
- name: System Cleanup
24+
run: sudo rm -rf /usr/local/bin/* /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache/CodeQL
25+
26+
- name: Run OSV-Scanner
27+
id: osv-scan
28+
uses: google/osv-scanner-action/osv-scan@c51854704019a247608d928f370c98740469d4b5 # v2.3.5
29+
with:
30+
scan-args: --format json --output osv-results.json
31+
continue-on-error: true
32+
33+
- name: Generate CVE Report
34+
id: report
35+
if: always()
36+
env:
37+
GH_TOKEN: ${{ github.token }}
38+
run: |
39+
if [ ! -f osv-results.json ]; then
40+
echo "osv-results.json not found"
41+
echo ":warning: OSV-Scanner failed to produce results" > osv-summary.txt
42+
exit 0
43+
fi
44+
45+
# Count vulnerabilities by severity from OSV JSON
46+
CRITICAL=$(jq '[.results[].packages[]?.vulnerabilities[]? | select(.database_specific.severity == "CRITICAL")] | length' osv-results.json || echo 0)
47+
HIGH=$(jq '[.results[].packages[]?.vulnerabilities[]? | select(.database_specific.severity == "HIGH")] | length' osv-results.json || echo 0)
48+
MEDIUM=$(jq '[.results[].packages[]?.vulnerabilities[]? | select(.database_specific.severity == "MEDIUM")] | length' osv-results.json || echo 0)
49+
LOW=$(jq '[.results[].packages[]?.vulnerabilities[]? | select(.database_specific.severity == "LOW")] | length' osv-results.json || echo 0)
50+
51+
# Helper function to generate lines for a specific severity in the format expected by the CVE-Processor
52+
generate_lines() {
53+
local sev=$1
54+
jq -r --arg sev "$sev" '
55+
.results[]? |
56+
.packages[]? as $pkg |
57+
($pkg.vulnerabilities // [])[]? |
58+
select(.database_specific.severity == $sev) |
59+
"- (\(.id)) (score: \(.database_specific.cvss.score // .database_specific.cvss3_score // 0), affects: \($pkg.package.name)@\($pkg.package.version), fixed: \([.affected[]?.ranges[]?.events[]?.fixed | select(. != null)] | unique | join(",") // "unknown")): \(.summary // .details | split("\n")[0] | sub("^[ ]+"; ""))"
60+
' osv-results.json | sort -u
61+
}
62+
63+
{
64+
echo "# CVE Report: tykio/${{ github.event.repository.name }}:path-based"
65+
echo ""
66+
echo "| Severity | Count |"
67+
echo "|----------|-------|"
68+
echo "| Critical | $CRITICAL |"
69+
echo "| High | $HIGH |"
70+
echo "| Medium | $MEDIUM |"
71+
echo "| Low | $LOW |"
72+
echo ""
73+
echo "## Critical CVEs"
74+
generate_lines CRITICAL
75+
echo ""
76+
echo "## High CVEs"
77+
generate_lines HIGH
78+
echo ""
79+
echo "## Medium CVEs"
80+
generate_lines MEDIUM
81+
echo ""
82+
echo "## Low CVEs"
83+
generate_lines LOW
84+
} > report.md
85+
86+
# Create Check Run via GitHub API to embed the report in the Actions UI
87+
CHECK_URL=$(jq -n \
88+
--arg name "Scan Report - tykio/${{ github.event.repository.name }}:path-based" \
89+
--arg sha "${{ github.sha }}" \
90+
--arg title "CVE Scan results - tykio/${{ github.event.repository.name }}:path-based" \
91+
--arg text "$(cat report.md)" \
92+
'{
93+
name: $name,
94+
head_sha: $sha,
95+
status: "completed",
96+
conclusion: "neutral",
97+
output: {title: $title, summary: "", text: $text}
98+
}' | gh api repos/${{ github.repository }}/check-runs --input - --jq '.html_url')
99+
100+
echo "url=$CHECK_URL" >> "$GITHUB_OUTPUT"
101+
102+
pad_count() {
103+
printf '%2s' "$1" | sed 's/ / /g'
104+
}
105+
106+
SLACK_SUMMARY=":red_circle: Critical: $(pad_count "$CRITICAL") :large_orange_circle: High: $(pad_count "$HIGH") :large_yellow_circle: Medium: $(pad_count "$MEDIUM") :white_circle: Low: $(pad_count "$LOW") ${{ github.repository }} (path-based)"
107+
108+
# Store summary and URL for the notification job
109+
echo "$SLACK_SUMMARY" > osv-summary.txt
110+
echo "$CHECK_URL" >> osv-summary.txt
111+
112+
{
113+
echo "### Nightly Path-Based Scan Summary (OSV)"
114+
echo "| Severity | Count |"
115+
echo "|----------|-------|"
116+
echo "| Critical | $CRITICAL |"
117+
echo "| High | $HIGH |"
118+
echo "| Medium | $MEDIUM |"
119+
echo "| Low | $LOW |"
120+
echo ""
121+
echo "[View Detailed Report]($CHECK_URL)"
122+
} >> "$GITHUB_STEP_SUMMARY"
123+
124+
- name: Upload OSV Results
125+
if: always()
126+
uses: actions/upload-artifact@v4
127+
with:
128+
name: osv-results
129+
path: osv-results.json
130+
131+
- name: Upload OSV Summary
132+
if: always()
133+
uses: actions/upload-artifact@v4
134+
with:
135+
name: osv-summary
136+
path: osv-summary.txt
137+
138+
s1-scan:
139+
name: SentinelOne CNS Scan
140+
uses: TykTechnologies/github-actions/.github/workflows/s1-cns-scan.yml@d3fa20888fa2878e877e22bb7702141217290e7c # main
141+
permissions:
142+
contents: read
143+
with:
144+
iac_enabled: false
145+
tag: service:vulnscan
146+
scope_type: ACCOUNT
147+
secrets:
148+
S1_API_TOKEN: ${{ secrets.S1_API_TOKEN }}
149+
CONSOLE_URL: ${{ secrets.S1_CONSOLE_URL }}
150+
SCOPE_ID: ${{ secrets.S1_SCOPE_ID }}
151+
152+
notify-complete:
153+
name: Notify Slack on completion
154+
runs-on: ubuntu-latest
155+
needs: [osv-scan, s1-scan]
156+
if: always()
157+
steps:
158+
- name: Download OSV Summary
159+
uses: actions/download-artifact@v4
160+
with:
161+
name: osv-summary
162+
ignore-any-missing-artifacts: true
163+
164+
- name: Post to Slack
165+
if: env.SLACK_BOT_TOKEN != ''
166+
uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
167+
with:
168+
method: chat.postMessage
169+
payload: |
170+
{
171+
"channel": "${{ secrets.CVE_SLACK_CHANNEL }}",
172+
"blocks": [
173+
{
174+
"type": "section",
175+
"text": {
176+
"type": "mrkdwn",
177+
"text": "*Nightly Path-Based CVE Scan: ${{ github.repository }}*\n$(head -n 1 osv-summary.txt || echo ':warning: Summary not found')\n<$(tail -n 1 osv-summary.txt)|Full CVE Report>"
178+
}
179+
}
180+
]
181+
}
182+
env:
183+
SLACK_BOT_TOKEN: ${{ secrets.SLACK_TOKEN }}

0 commit comments

Comments
 (0)