bullmq/.github/workflows/osv-scanner.yml at 783bc496e49997bade26042e5aa754a9c072d9fc · taskforcesh/bullmq · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: OSV-Scanner PR Scan

on:
  pull_request:
    branches: [master]
  merge_group:
    branches: [master]

permissions:
  actions: read
  security-events: write
  contents: read

jobs:
  scan-pr:
    name: osv-scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0

      - name: Preserve current scan config
        id: preserve-config
        run: |
          if [ -f osv-scanner.toml ]; then
            cp osv-scanner.toml "$RUNNER_TEMP/osv-scanner.toml"
            echo "has_config=true" >> "$GITHUB_OUTPUT"
            echo "config_path=$RUNNER_TEMP/osv-scanner.toml" >> "$GITHUB_OUTPUT"
          else
            echo "has_config=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Checkout target branch
        env:
          BASE_REF: ${{ github.base_ref }}
        run: |
          if [ -z "$BASE_REF" ]; then
            echo "::error::Unable to determine the base ref for the OSV scan."
            exit 1
          fi
          git fetch origin "$BASE_REF:refs/remotes/origin/$BASE_REF"
          git checkout "origin/$BASE_REF"
          git submodule update --recursive

      - name: Run scanner on existing code with config
        if: ${{ steps.preserve-config.outputs.has_config == 'true' }}
        uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=old-results.json
            --config=${{ steps.preserve-config.outputs.config_path }}
            -r
            ./

      - name: Run scanner on existing code without config
        if: ${{ steps.preserve-config.outputs.has_config != 'true' }}
        uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=old-results.json
            -r
            ./

      - name: Checkout current branch
        run: |
          git checkout "$GITHUB_SHA"
          git submodule update --recursive

      - name: Run scanner on new code with config
        if: ${{ steps.preserve-config.outputs.has_config == 'true' }}
        uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=new-results.json
            --config=${{ steps.preserve-config.outputs.config_path }}
            -r
            ./

      - name: Run scanner on new code without config
        if: ${{ steps.preserve-config.outputs.has_config != 'true' }}
        uses: google/osv-scanner-action/osv-scanner-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0
        continue-on-error: true
        with:
          scan-args: |-
            --format=json
            --output=new-results.json
            -r
            ./

      - name: Run osv-scanner-reporter
        # Enable GitHub annotations so vulnerabilities are surfaced directly in the PR UI.
        uses: google/osv-scanner-action/osv-reporter-action@8deb546fdb875b9996d27d4950be7312dac076a1 # v2.5.0
        with:
          scan-args: |-
            --output=results.sarif
            --old=old-results.json
            --new=new-results.json
            --gh-annotations=true
            --fail-on-vuln=true

      - name: Upload artifact
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: OSV Scanner SARIF file
          path: results.sarif
          retention-days: 5

      - name: Upload old scan json results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: old-json-results
          path: old-results.json
          retention-days: 5

      - name: Upload new scan json results
        if: ${{ !cancelled() }}
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: new-json-results
          path: new-results.json
          retention-days: 5

      - name: Upload to code-scanning
        id: upload_sarif
        if: ${{ !cancelled() }}
        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          sarif_file: results.sarif

      - name: Print Code Scanning PR URL
        if: ${{ !cancelled() }}
        run: |
          echo "View the OSV-Scanner results for this PR in the 'Security' tab, using the following link:"
          echo "${{ github.server_url }}/${{ github.repository }}/security/code-scanning?query=pr%3A${{ github.event.pull_request.number }}"

      - name: Error troubleshooter
        if: ${{ always() && steps.upload_sarif.outcome == 'failure' }}
        run: |
          echo "::error::Artifact upload failed. This is most likely caused by an error during scanning earlier in the workflow."