From 509ff6db09bfb3b341357e49fb8d11cab7a2c757 Mon Sep 17 00:00:00 2001 From: Timo Behrendt Date: Tue, 24 Mar 2026 21:18:56 +0100 Subject: [PATCH] remove setup-osv-scanner --- .gitea/workflows/ci.yaml | 33 ++++++--------- README.md | 3 +- setup-osv-db/README.md | 10 +++-- setup-osv-scanner/README.md | 47 --------------------- setup-osv-scanner/action.yaml | 78 ----------------------------------- 5 files changed, 21 insertions(+), 150 deletions(-) delete mode 100644 setup-osv-scanner/README.md delete mode 100644 setup-osv-scanner/action.yaml diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 35bfeb3..0fd373a 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -4,35 +4,28 @@ on: pull_request: jobs: - test-setup-osv-scanner: - strategy: - matrix: - arch: [ amd64, arm64 ] - name: Test Setup OSV-Scanner ${{ matrix.arch }} - runs-on: - - ubuntu-latest - - linux_${{ matrix.arch }} - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - name: Setup OSV-Scanner - uses: ./setup-osv-scanner - - name: Run OSV-Scanner - run: osv-scanner --version - test-setup-osv-db: name: Test Setup OSV offline DB runs-on: - ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - - uses: ./setup-osv-scanner - name: Setup offline DB id: setup-db uses: ./setup-osv-db - - name: Run OSV-Scanner with cached DB - env: - OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }} - run: osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles -r . + - name: Verify DB zips exist + shell: bash + run: | + set -euo pipefail + root="${{ steps.setup-db.outputs.cache-dir }}/osv-scanner" + [ -d "$root" ] || { echo "FAIL: missing directory $root"; exit 1; } + n=0 + while IFS= read -r -d '' f; do + [ -s "$f" ] || { echo "FAIL: empty or missing: $f"; exit 1; } + n=$((n + 1)) + done < <(find "$root" -type f -name all.zip -print0) + [ "$n" -ge 1 ] || { echo "FAIL: no all.zip under $root"; exit 1; } + echo "OK: $n non-empty all.zip file(s) under $root" test-get-images-from-files: name: Test Get Images From Files diff --git a/README.md b/README.md index bfcce44..2fa7aa4 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,11 @@ # OSV-Scanner Actions -Gitea-compatible composite actions for [Google OSV-Scanner](https://github.com/google/osv-scanner): install the CLI, cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. +Gitea-compatible composite actions around [Google OSV-Scanner](https://github.com/google/osv-scanner): cache the offline vulnerability database, merge SARIF reports, and extract container image references from manifests. Install the `osv-scanner` CLI from [upstream releases](https://github.com/google/osv-scanner/releases) (or your package manager) in your workflow. ## Actions | Directory | Purpose | | ---------------------- | ----------------------------------------------------------------------- | -| `setup-osv-scanner` | Download and cache a pinned `osv-scanner` release (Linux amd64 / arm64), SHA256-verified. | | `setup-osv-db` | Restore or populate selected ecosystem zips via curl; cache key includes hour bucket + ecosystem list. | | `merge-sarif-files` | Merge multiple SARIF files into one (tool-agnostic). | | `get-images-from-files`| Parse Dockerfiles, Kubernetes YAML, Compose, and Helmfile values for image refs (useful with `osv-scanner scan image …`). | diff --git a/setup-osv-db/README.md b/setup-osv-db/README.md index 67e217a..d344f6c 100644 --- a/setup-osv-db/README.md +++ b/setup-osv-db/README.md @@ -6,7 +6,7 @@ Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.go **Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths). -**Note:** This action only prepares the local DB directory. Install the scanner separately (e.g. with the `setup-osv-scanner` action). +**Note:** This action only prepares the local DB directory. Install the scanner separately. ## Ecosystems input @@ -33,8 +33,12 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - - name: Setup OSV-Scanner - uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-scanner@0.0.1 + - name: Install OSV-Scanner + run: | + curl -fsSL -o /usr/local/bin/osv-scanner \ + "https://github.com/google/osv-scanner/releases/download/v2.3.3/osv-scanner_linux_amd64" + chmod +x /usr/local/bin/osv-scanner + echo /usr/local/bin >> "$GITHUB_PATH" - name: Setup offline DB id: setup-db uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1 diff --git a/setup-osv-scanner/README.md b/setup-osv-scanner/README.md deleted file mode 100644 index c290eeb..0000000 --- a/setup-osv-scanner/README.md +++ /dev/null @@ -1,47 +0,0 @@ -# Setup OSV-Scanner Action - -A reusable Gitea Action that downloads and sets up the [OSV-Scanner](https://github.com/google/osv-scanner) binary for vulnerability scanning. - -The release tag is **always explicit** (defaults are pinned to a specific version). Each download is verified with **SHA256** against the expected digest for `linux_amd64` or `linux_arm64`. - -When you bump `version`, update `sha256_linux_amd64` and `sha256_linux_arm64` from the matching release asset `osv-scanner_SHA256SUMS` on GitHub. - -## Usage - -```yaml -- name: Setup OSV-Scanner - uses: your-username/osv-scanner-actions@main/setup-osv-scanner - with: - version: "v2.3.3" - # Optional: override defaults when you change version - # sha256_linux_amd64: "..." - # sha256_linux_arm64: "..." -``` - -## Example workflow - -```yaml -jobs: - scan: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - name: Setup OSV-Scanner - uses: your-username/osv-scanner-actions@main/setup-osv-scanner - - name: Scan - run: osv-scanner scan source -r . -``` - -## Inputs - -| Name | Description | Required | Default (for `v2.3.3`) | -| --------------------- | --------------------------------------------------------------------------- | -------- | ------------------------ | -| `version` | Git tag of the release to install | No | `v2.3.3` | -| `sha256_linux_amd64` | Expected SHA256 (hex) of `osv-scanner_linux_amd64` for that tag | No | `777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033` | -| `sha256_linux_arm64` | Expected SHA256 (hex) of `osv-scanner_linux_arm64` for that tag | No | `0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616` | - -## Notes - -- Linux runners only (`linux_amd64` / `linux_arm64` release assets). -- The binary is cached with `actions/cache` by version and architecture. -- Downloads use `curl -f` so missing releases fail fast. diff --git a/setup-osv-scanner/action.yaml b/setup-osv-scanner/action.yaml deleted file mode 100644 index 152c391..0000000 --- a/setup-osv-scanner/action.yaml +++ /dev/null @@ -1,78 +0,0 @@ -name: "Setup OSV-Scanner" -description: "Download and setup the OSV-Scanner binary for vulnerability scanning" -author: "Gitea Actions" -branding: - icon: "shield" - color: "blue" - -inputs: - version: - description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs." - required: false - default: "v2.3.3" - sha256_linux_amd64: - description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version" - required: false - default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033" - sha256_linux_arm64: - description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version" - required: false - default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616" - -runs: - using: "composite" - steps: - - shell: bash - id: arch - run: | - set -e - case "$(uname -m)" in - x86_64) - ARCH="amd64" - ;; - aarch64) - ARCH="arm64" - ;; - *) - echo "Unsupported architecture: $(uname -m)" >&2 - exit 1 - ;; - esac - echo "ARCH=$ARCH" >> $GITHUB_OUTPUT - - name: Cache OSV-Scanner binary - id: cache-osv - uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5 - with: - path: /usr/local/bin/osv-scanner - key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }} - restore-keys: | - osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }} - - name: Download and install OSV-Scanner - if: steps.cache-osv.outputs.cache-hit != 'true' - shell: bash - run: | - set -e - VERSION="${{ inputs.version }}" - ARCH="${{ steps.arch.outputs.arch }}" - case "$ARCH" in - amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;; - arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;; - *) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;; - esac - EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]') - mkdir -p /usr/local/bin - tmp="$(mktemp)" - trap 'rm -f "$tmp"' EXIT - curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp" - ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]') - if [ "$ACTUAL" != "$EXPECTED" ]; then - echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2 - exit 1 - fi - mv "$tmp" /usr/local/bin/osv-scanner - chmod +x /usr/local/bin/osv-scanner - - - name: Add OSV-Scanner to PATH - shell: bash - run: | - echo "/usr/local/bin" >> $GITHUB_PATH