chore: release 2.15.9 #1449
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Check | |
| on: | |
| pull_request: | |
| branches: [main, "release-[0-9]*.[0-9]*"] | |
| permissions: | |
| contents: read | |
| issues: write | |
| concurrency: | |
| group: vulnerability-check-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| GOTOOLCHAIN: auto | |
| jobs: | |
| govulncheck: | |
| name: govulncheck | |
| runs-on: ubuntu-26.04 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-go-cached | |
| with: | |
| go-version-file: src/go.mod | |
| go-sum-path: src/go.sum | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 24 | |
| package-manager-cache: false | |
| - uses: ./.github/actions/setup-task | |
| with: | |
| version: 3.49.1 | |
| - name: Load tool versions | |
| id: versions | |
| run: | | |
| gh_cli_version="" | |
| govulncheck_version="" | |
| while IFS='=' read -r name value; do | |
| case "${name}" in | |
| GH_CLI_VERSION) gh_cli_version="${value}" ;; | |
| GOVULNCHECK_VERSION) govulncheck_version="${value}" ;; | |
| esac | |
| done < versions.env | |
| if ! [[ "${gh_cli_version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "GH_CLI_VERSION must be X.Y.Z" >&2 | |
| exit 1 | |
| fi | |
| if ! [[ "${govulncheck_version}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "GOVULNCHECK_VERSION must be vX.Y.Z" >&2 | |
| exit 1 | |
| fi | |
| echo "GH_CLI_VERSION=${gh_cli_version}" >> "${GITHUB_ENV}" | |
| echo "GOVULNCHECK_VERSION=${govulncheck_version}" >> "${GITHUB_ENV}" | |
| echo "gh-cli-version=${gh_cli_version}" >> "${GITHUB_OUTPUT}" | |
| echo "govulncheck-version=${govulncheck_version}" >> "${GITHUB_OUTPUT}" | |
| - name: Install GitHub CLI | |
| run: | | |
| case "$(uname -m)" in | |
| x86_64|amd64) arch="amd64" ;; | |
| aarch64|arm64) arch="arm64" ;; | |
| *) echo "Unsupported architecture for gh: $(uname -m)" >&2; exit 1 ;; | |
| esac | |
| archive="gh_${GH_CLI_VERSION}_linux_${arch}.tar.gz" | |
| tool_dir="${RUNNER_TEMP:-${PWD}/.tools}/gh-cli" | |
| mkdir -p "${tool_dir}/bin" | |
| curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/${archive}" -o "${tool_dir}/${archive}" | |
| curl -fsSL "https://github.com/cli/cli/releases/download/v${GH_CLI_VERSION}/gh_${GH_CLI_VERSION}_checksums.txt" -o "${tool_dir}/gh_checksums.txt" | |
| (cd "${tool_dir}" && grep " ${archive}$" gh_checksums.txt | sha256sum -c -) | |
| tar -xzf "${tool_dir}/${archive}" -C "${tool_dir}" | |
| install -m 0755 "${tool_dir}/gh_${GH_CLI_VERSION}_linux_${arch}/bin/gh" "${tool_dir}/bin/gh" | |
| echo "${tool_dir}/bin" >> "${GITHUB_PATH}" | |
| - name: Install govulncheck | |
| run: | | |
| go install "golang.org/x/vuln/cmd/govulncheck@${GOVULNCHECK_VERSION}" | |
| echo "$(go env GOPATH)/bin" >> "${GITHUB_PATH}" | |
| - name: Verify installed tools | |
| run: | | |
| git --version | |
| gh --version | |
| go version | |
| node --version | |
| task --version | |
| govulncheck -version | |
| - name: Generate API code | |
| run: task build:gen-apis | |
| - name: Run govulncheck | |
| run: | | |
| mkdir -p vulnerability-check | |
| set +e | |
| ( | |
| cd src | |
| govulncheck -format json ./... > ../vulnerability-check/govulncheck.json 2> ../vulnerability-check/govulncheck.stderr | |
| ) | |
| exit_code=$? | |
| set -e | |
| printf '%s\n' "${exit_code}" > vulnerability-check/govulncheck.exit | |
| - name: Generate vulnerability summary | |
| run: | | |
| node tools/vulnerability-check/render-govulncheck-summary.mjs | |
| env: | |
| GOVULNCHECK_JSON: vulnerability-check/govulncheck.json | |
| GOVULNCHECK_STDERR: vulnerability-check/govulncheck.stderr | |
| GOVULNCHECK_EXIT_FILE: vulnerability-check/govulncheck.exit | |
| VULN_COMMENT_PATH: vulnerability-check/comment.md | |
| VULN_SUMMARY_PATH: vulnerability-check/summary.json | |
| - name: Generate fixable vulnerability comment | |
| run: | | |
| node tools/vulnerability-check/render-govulncheck-summary.mjs | |
| env: | |
| GOVULNCHECK_JSON: vulnerability-check/govulncheck.json | |
| GOVULNCHECK_STDERR: vulnerability-check/govulncheck.stderr | |
| GOVULNCHECK_EXIT_FILE: vulnerability-check/govulncheck.exit | |
| VULN_COMMENT_MODE: fixable | |
| VULN_COMMENT_PATH: vulnerability-check/comment.md | |
| VULN_SUMMARY_PATH: vulnerability-check/comment-summary.json | |
| VULN_APPEND_STEP_SUMMARY: "false" | |
| - name: Comment vulnerability summary | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| fixable_count=$(node -e "const fs = require('node:fs'); const summary = JSON.parse(fs.readFileSync('vulnerability-check/summary.json', 'utf8')); console.log(summary.fixableFindingCount || 0);") | |
| comment_id=$(gh api --paginate --slurp "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" | node -e ' | |
| const fs = require("node:fs"); | |
| const pages = JSON.parse(fs.readFileSync(0, "utf8")); | |
| const comments = pages.flat(); | |
| const comment = comments.find((item) => item.body?.includes("<!-- harbor-next-vulnerability-check -->")); | |
| console.log(comment?.id || ""); | |
| ' | |
| ) | |
| if [ "${fixable_count}" -eq 0 ]; then | |
| if [ -n "${comment_id}" ]; then | |
| gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" --method DELETE || { | |
| echo "Unable to delete stale vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}" | |
| } | |
| fi | |
| exit 0 | |
| fi | |
| body=$(cat vulnerability-check/comment.md) | |
| if [ -n "${comment_id}" ]; then | |
| gh api "repos/${GITHUB_REPOSITORY}/issues/comments/${comment_id}" \ | |
| --method PATCH \ | |
| --field "body=${body}" || { | |
| echo "Unable to update vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}" | |
| } | |
| else | |
| gh api "repos/${GITHUB_REPOSITORY}/issues/${PR_NUMBER}/comments" \ | |
| --method POST \ | |
| --field "body=${body}" || { | |
| echo "Unable to create vulnerability comment; continuing." >> "${GITHUB_STEP_SUMMARY}" | |
| } | |
| fi | |
| - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| if: always() | |
| with: | |
| name: vulnerability-check | |
| path: vulnerability-check/ | |
| if-no-files-found: warn | |
| - name: Enforce scanner health | |
| run: | | |
| node <<'NODE' | |
| const { readFileSync } = require('node:fs'); | |
| const summary = JSON.parse(readFileSync('vulnerability-check/summary.json', 'utf8')); | |
| if (summary.scannerError) { | |
| console.error('govulncheck failed before producing vulnerability findings.'); | |
| process.exit(1); | |
| } | |
| console.log(`govulncheck completed with ${summary.findingCount} vulnerabilities.`); | |
| NODE |