fix(deps): update security patches [security] #7619
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OSV-Scanner PR Scan | |
| on: | |
| pull_request: | |
| branches: [master] | |
| merge_group: | |
| branches: [master] | |
| permissions: | |
| actions: read | |
| security-events: write | |
| contents: read | |
| jobs: | |
| scan-pr: | |
| name: osv-scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Preserve current scan config | |
| id: preserve-config | |
| run: | | |
| if [ -f osv-scanner.toml ]; then | |
| cp osv-scanner.toml "$RUNNER_TEMP/osv-scanner.toml" | |
| echo "has_config=true" >> "$GITHUB_OUTPUT" | |
| echo "config_path=$RUNNER_TEMP/osv-scanner.toml" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "has_config=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Checkout target branch | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| run: | | |
| if [ -z "$BASE_REF" ]; then | |
| echo "::error::Unable to determine the base ref for the OSV scan." | |
| exit 1 | |
| fi | |
| git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF" | |
| git checkout "origin/$BASE_REF" | |
| git submodule update --recursive | |
| - name: Run scanner on existing code with config | |
| if: ${{ steps.preserve-config.outputs.has_config == 'true' }} | |
| uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --format=json | |
| --output=old-results.json | |
| --config=${{ steps.preserve-config.outputs.config_path }} | |
| -r | |
| ./ | |
| - name: Run scanner on existing code without config | |
| if: ${{ steps.preserve-config.outputs.has_config != 'true' }} | |
| uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --format=json | |
| --output=old-results.json | |
| -r | |
| ./ | |
| - name: Checkout current branch | |
| run: | | |
| git checkout "$GITHUB_SHA" | |
| git submodule update --recursive | |
| - name: Run scanner on new code with config | |
| if: ${{ steps.preserve-config.outputs.has_config == 'true' }} | |
| uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --format=json | |
| --output=new-results.json | |
| --config=${{ steps.preserve-config.outputs.config_path }} | |
| -r | |
| ./ | |
| - name: Run scanner on new code without config | |
| if: ${{ steps.preserve-config.outputs.has_config != 'true' }} | |
| uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 | |
| continue-on-error: true | |
| with: | |
| scan-args: |- | |
| --format=json | |
| --output=new-results.json | |
| -r | |
| ./ | |
| - name: Run osv-scanner-reporter | |
| # Enable GitHub annotations so vulnerabilities are surfaced directly in the PR UI. | |
| uses: google/osv-scanner-action/osv-reporter-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0 | |
| with: | |
| scan-args: |- | |
| --output=results.sarif | |
| --old=old-results.json | |
| --new=new-results.json | |
| --gh-annotations=true | |
| --fail-on-vuln=true | |
| - name: Upload artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: OSV Scanner SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload old scan json results | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: old-json-results | |
| path: old-results.json | |
| retention-days: 5 | |
| - name: Upload new scan json results | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: new-json-results | |
| path: new-results.json | |
| retention-days: 5 | |
| - name: Upload to code-scanning | |
| id: upload_sarif | |
| if: ${{ !cancelled() }} | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| sarif_file: results.sarif | |
| - name: Print Code Scanning PR URL | |
| if: ${{ !cancelled() }} | |
| run: | | |
| echo "View the OSV-Scanner results for this PR in the 'Security' tab, using the following link:" | |
| echo "${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=pr%3A${{ github.event.pull_request.number }}" | |
| - name: Error troubleshooter | |
| if: ${{ always() && steps.upload_sarif.outcome == 'failure' }} | |
| run: | | |
| echo "::error::Artifact upload failed. This is most likely caused by an error during scanning earlier in the workflow." |