feat: add go symbol matching qualifier for better go vuln matching #6447
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Validations" | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: {} | |
| jobs: | |
| Static-Analysis: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Static analysis" | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| - name: Run static analysis | |
| run: make static-analysis | |
| Unit-Test: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Unit tests" | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| cache-test-fixtures: true | |
| - name: Run unit tests | |
| run: make unit | |
| Quality-Test: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Quality tests" | |
| runs-on: ubuntu-22.04-4core-16gb | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| submodules: true | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| cache-test-fixtures: true | |
| python-version: "3.11" | |
| - name: Run quality tests | |
| run: make quality | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Archive the provider state | |
| if: ${{ failure() }} | |
| run: tar -czvf qg-capture-state.tar.gz -C test/quality --exclude tools --exclude labels .yardstick.yaml .yardstick | |
| - name: Upload the provider state archive | |
| if: ${{ failure() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: qg-capture-state | |
| path: qg-capture-state.tar.gz | |
| - name: Show instructions to debug | |
| if: ${{ failure() }} | |
| run: | | |
| ARCHIVE_BASENAME=qg-capture-state | |
| ARCHIVE_NAME=$ARCHIVE_BASENAME.zip | |
| cat << EOF >> $GITHUB_STEP_SUMMARY | |
| ## Troubleshooting failed run | |
| Download the artifact from this workflow run: \`$ARCHIVE_NAME\` | |
| Then run the following commands to debug: | |
| \`\`\`bash | |
| # copy the archive to the tests/quality directory | |
| cd test/quality | |
| unzip $ARCHIVE_NAME && tar -xzf $ARCHIVE_BASENAME.tar.gz | |
| \`\`\` | |
| Now you can debug the with yardstick: | |
| \`\`\`bash | |
| poetry shell | |
| yardstick result list | |
| yardstick label explore | |
| \`\`\` | |
| EOF | |
| Integration-Test: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Integration tests" | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| cache-test-fixtures: true | |
| - name: Restore integration test cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0 | |
| with: | |
| path: ${{ github.workspace }}/test/integration/testdata/cache | |
| key: ${{ runner.os }}-integration-test-cache-${{ hashFiles('test/integration/testdata/cache.fingerprint') }} | |
| - name: Run integration tests | |
| run: make integration | |
| Build-Snapshot-Artifacts: | |
| name: "Build snapshot artifacts" | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| # why have another build cache key? We don't want unit/integration/etc test build caches to replace | |
| # the snapshot build cache, which includes builds for all OSs and architectures. As long as this key is | |
| # unique from the cache-key-prefix in other CI jobs, we should be fine. | |
| # | |
| # note: ideally this value should match what is used in release (just to help with build times). | |
| cache-key-prefix: "snapshot" | |
| bootstrap-apt-packages: "" | |
| - name: Build snapshot artifacts | |
| run: make snapshot | |
| - name: Upload snapshot artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1 | |
| with: | |
| name: snapshot | |
| path: snapshot/ | |
| retention-days: 30 | |
| Acceptance-Linux: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Acceptance tests (Linux)" | |
| needs: [Build-Snapshot-Artifacts] | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # only need go to drive the make-shim into go-make; skip tool install + apt | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| tools: "false" | |
| bootstrap-apt-packages: "" | |
| - name: Download snapshot build | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 | |
| with: | |
| name: snapshot | |
| path: snapshot | |
| - name: Restore executable permissions | |
| run: chmod -R +x snapshot/**/grype | |
| - name: Restore install.sh test image cache | |
| id: install-test-image-cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0 | |
| with: | |
| path: ${{ github.workspace }}/test/install/cache | |
| key: ${{ runner.os }}-install-test-image-cache-${{ hashFiles('test/install/cache.fingerprint') }} | |
| - name: Load test image cache | |
| if: steps.install-test-image-cache.outputs.cache-hit == 'true' | |
| run: make install-test-cache-load | |
| - name: Run install.sh tests (Linux) | |
| run: make install-test | |
| - name: (cache-miss) Create test image cache | |
| if: steps.install-test-image-cache.outputs.cache-hit != 'true' | |
| run: make install-test-cache-save | |
| Acceptance-Mac: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "Acceptance tests (Mac)" | |
| needs: [Build-Snapshot-Artifacts] | |
| runs-on: macos-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 #v4.1.2 | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # only need go to drive the make-shim into go-make; skip tool install + apt | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| tools: "false" | |
| bootstrap-apt-packages: "" | |
| - name: Download snapshot build | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 | |
| with: | |
| name: snapshot | |
| path: snapshot | |
| - name: Restore executable permissions | |
| run: chmod -R +x snapshot/**/grype | |
| - name: Restore docker image cache for compare testing | |
| id: mac-compare-testing-cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0 | |
| with: | |
| path: image.tar | |
| key: ${{ runner.os }}-${{ hashFiles('test/compare/mac.sh') }} | |
| - name: Run install.sh tests (Mac) | |
| run: make install-test-ci-mac | |
| Cli-Linux: | |
| # Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline | |
| name: "CLI tests (Linux)" | |
| needs: [Build-Snapshot-Artifacts] | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 #v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Bootstrap environment | |
| uses: ./.github/actions/bootstrap | |
| with: | |
| cache-test-fixtures: true | |
| - name: Restore CLI test-fixture cache | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 #v6.1.0 | |
| with: | |
| path: ${{ github.workspace }}/test/cli/testdata/cache | |
| key: ${{ runner.os }}-cli-test-cache-${{ hashFiles('test/cli/testdata/cache.fingerprint') }} | |
| - name: Download snapshot build | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1 | |
| with: | |
| name: snapshot | |
| path: snapshot | |
| - name: Restore executable permissions | |
| run: chmod -R +x snapshot/**/grype | |
| - name: Run CLI Tests (Linux) | |
| run: make cli | |
| env: | |
| GRYPE_SNAPSHOT_PREBUILT: "true" | |
| GRYPE_BINARY_LOCATION: ${{ github.workspace }}/snapshot/linux-build_linux_amd64_v1/grype |