From db7cc81de58ade7303769243b6c64def0b6c749e Mon Sep 17 00:00:00 2001 From: Corneil du Plessis Date: Tue, 2 Apr 2024 18:08:14 +0200 Subject: [PATCH] [CI] Check sarif location --- .github/workflows/common.yml | 108 +++++++++++++++++------------------ scan-folders.sh | 2 + 2 files changed, 56 insertions(+), 54 deletions(-) diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml index b973434e..4d4a93f8 100644 --- a/.github/workflows/common.yml +++ b/.github/workflows/common.yml @@ -357,24 +357,6 @@ jobs: echo "::info ::$MESSAGE" fi popd > /dev/null - - name: Scan Jar files - shell: bash - id: scan - run: | - ROOT_DIR=$(realpath $PWD) - pushd stream-applications > /dev/null - $ROOT_DIR/scan-folders.sh - popd > /dev/null - if [ -f scan.sarif ]; then - echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT - else - echo "scan_file=" >> $GITHUB_OUTPUT - fi - - name: Upload Trivy scan results to GitHub Security tab - if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: '${{ steps.scan.output.scan_file }}' - name: 'Configure: Docker login' uses: docker/login-action@v2 with: @@ -403,6 +385,24 @@ jobs: MAVEN_THREADS: ${{ inputs.mavenThreads }} BUILD_VERSION_TYPE: ${{ needs.parameters.outputs.build_version_type }} run: ./build-app.sh "stream-applications" "applications/processor/${{ matrix.app }}" + - name: 'Scan Jar files' + shell: bash + id: scan + run: | + ROOT_DIR=$(realpath $PWD) + pushd stream-applications > /dev/null + $ROOT_DIR/scan-folders.sh + popd > /dev/null + if [ -f scan.sarif ]; then + echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT + else + echo "scan_file=" >> $GITHUB_OUTPUT + fi + - name: Upload Trivy scan results to GitHub Security tab + if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: '${{ steps.scan.output.scan_file }}' - name: Unit Test Report uses: dorny/test-reporter@v1 if: ${{ success() || failure() }} @@ -504,24 +504,6 @@ jobs: echo "::info ::$MESSAGE" fi popd > /dev/null - - name: Scan Jar files - id: scan - shell: bash - run: | - ROOT_DIR=$(realpath $PWD) - pushd stream-applications > /dev/null - $ROOT_DIR/scan-folders.sh - popd > /dev/null - if [ -f scan.sarif ]; then - echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT - else - echo "scan_file=" >> $GITHUB_OUTPUT - fi - - name: Upload Trivy scan results to GitHub Security tab - if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: '${{ steps.scan.output.scan_file }}' - name: 'Configure: Docker login' uses: docker/login-action@v2 with: @@ -550,6 +532,24 @@ jobs: MAVEN_THREADS: ${{ inputs.mavenThreads }} BUILD_VERSION_TYPE: ${{ needs.parameters.outputs.build_version_type }} run: ./build-app.sh "stream-applications" "applications/sink/${{ matrix.app }}" + - name: 'Scan Jar files' + shell: bash + id: scan + run: | + ROOT_DIR=$(realpath $PWD) + pushd stream-applications > /dev/null + $ROOT_DIR/scan-folders.sh + popd > /dev/null + if [ -f scan.sarif ]; then + echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT + else + echo "scan_file=" >> $GITHUB_OUTPUT + fi + - name: Upload Trivy scan results to GitHub Security tab + if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: '${{ steps.scan.output.scan_file }}' - name: 'Upload: Test Reports' if: ${{ always() }} uses: actions/upload-artifact@v3 @@ -652,24 +652,6 @@ jobs: echo "::info ::$MESSAGE" fi popd > /dev/null - - name: Scan Jar files - shell: bash - id: scan - run: | - ROOT_DIR=$(realpath $PWD) - pushd stream-applications > /dev/null - $ROOT_DIR/scan-folders.sh - popd > /dev/null - if [ -f scan.sarif ]; then - echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT - else - echo "scan_file=" >> $GITHUB_OUTPUT - fi - - name: Upload Trivy scan results to GitHub Security tab - if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: '${{ steps.scan.output.scan_file }}' - name: 'Configure: Docker login' uses: docker/login-action@v2 with: @@ -698,6 +680,24 @@ jobs: MAVEN_THREADS: ${{ inputs.mavenThreads }} BUILD_VERSION_TYPE: ${{ needs.parameters.outputs.build_version_type }} run: ./build-app.sh "stream-applications" "applications/source/${{ matrix.app }}" + - name: 'Scan Jar files' + shell: bash + id: scan + run: | + ROOT_DIR=$(realpath $PWD) + pushd stream-applications > /dev/null + $ROOT_DIR/scan-folders.sh + popd > /dev/null + if [ -f scan.sarif ]; then + echo "scan_file=$(realpath scan.sarif)" >> $GITHUB_OUTPUT + else + echo "scan_file=" >> $GITHUB_OUTPUT + fi + - name: Upload Trivy scan results to GitHub Security tab + if: ${{ steps.scan.output.scan_file != null && steps.scan.output.scan_file != '' }} + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: '${{ steps.scan.output.scan_file }}' - name: Unit Test Report uses: dorny/test-reporter@v1 if: ${{ success() || failure() }} diff --git a/scan-folders.sh b/scan-folders.sh index 06853473..4083e574 100755 --- a/scan-folders.sh +++ b/scan-folders.sh @@ -11,6 +11,8 @@ while [ "$1" != "" ]; do fi shift done +REAL_PATH=$(realpath $PWD) +echo "Scanning in $REAL_PATH" find . -type d -name target -exec bash "$SCDIR/scan-jars.sh" '{}' \; echo "{\"version\": \"2.1.0\", \"\$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\", \"runs\": [" > "$SCDIR/scan.sarif" if [ -f "$SCDIR/runs.sarif" ]; then