sync

2026-03-24 21:15:45 +01:00
parent 83a7cef9f1
commit d746e98f30
15 changed files with 381 additions and 210 deletions
@@ -0,0 +1,67 @@
+# Setup OSV offline DB Action
+
+A reusable Gitea Action that restores or populates the [OSV-Scanner local vulnerability cache](https://google.github.io/osv-scanner/usage/offline-mode/) used with `--offline-vulnerabilities`.
+
+Databases are fetched with **curl** from `https://osv-vulnerabilities.storage.googleapis.com/` as described under [Manual database download](https://google.github.io/osv-scanner/usage/offline-mode/#manual-database-download): for each requested ecosystem, download `…/<ecosystem>/all.zip` into `osv-scanner/<ecosystem>/all.zip`. **OSV-Scanner is not invoked** for downloads.
+
+**Requires:** `curl`, `bash` 4+ (associative arrays), `python3` (URL-encoding paths).
+
+**Note:** This action only prepares the local DB directory. Install the scanner separately (e.g. with the `setup-osv-scanner` action).
+
+## Ecosystems input
+
+Use **`ecosystems`**: a comma-separated list (spaces around commas are trimmed). Each token is matched to an entry from [ecosystems.txt](https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt) by:
+
+- **Slug match:** lowercased, spaces → `-`, brackets removed (e.g. `GitHub Actions` and `github-actions` both match).
+- **Special case:** `docker` is not an OSV ecosystem; it is treated as **`Linux`** (useful as a default when scanning image-related data). Override with `Alpine`, `Debian`, etc. if you prefer.
+
+The **`actions/cache` key includes** the sorted, slugified list of resolved ecosystems (e.g. `github-actions,go,linux,npm`) plus the hour bucket settings, so different ecosystem sets never share a cache entry.
+
+## Usage
+
+```yaml
+uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
+with:
+  ecosystems: PyPI,npm,Go
+```
+
+## Example workflow
+
+```yaml
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Setup OSV-Scanner
+        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-scanner@0.0.1
+      - name: Setup offline DB
+        id: setup-db
+        uses: https://gitea.example/your-user/osv-scanner-actions/setup-osv-db@0.0.1
+        with:
+          cache-bucket-hours: 6
+          ecosystems: github-actions,npm,go,Alpine
+      - name: Scan (offline vulnerabilities only)
+        env:
+          OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY: ${{ steps.setup-db.outputs.cache-dir }}
+        run: osv-scanner scan source --offline-vulnerabilities -r .
+```
+
+## Inputs
+
+| Name                 | Description                                                                                                                                 | Required | Default                             |
+| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | -------- | ----------------------------------- |
+| `cache-dir`          | Directory for `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY`                                                                                        | No       | `${{ runner.temp }}/osv-scanner`   |
+| `cache-bucket-hours` | `actions/cache` primary key includes `floor(UTC unix time / (3600 × N))`.                                                                   | No       | `24`                                |
+| `ecosystems`         | Comma-separated tokens (names/slugs; `docker` → `Linux`).                                                                                     | No       | `github-actions,npm,go,docker`      |
+
+## Outputs
+
+| Name        | Description        |
+| ----------- | ------------------ |
+| `cache-dir` | Same as input path |
+
+## Behavior
+
+- **Cache:** Key pattern `osv-scanner-db-{hours}h-eco-{sorted-slugs}-{bucket}`. `restore-keys` reuse the newest cache for the same hours + ecosystem set when the current time bucket misses.
+- **Populate:** On cache miss, `${cache-dir}/osv-scanner` is recreated and only the requested ecosystems are downloaded.
@@ -0,0 +1,143 @@
+name: "Setup OSV offline vulnerability DB"
+description: "Populate or restore the OSV-Scanner local vulnerability database cache (offline mode)"
+author: "Timo Behrendt <t.behrendt@t00n.de>"
+branding:
+  icon: "database"
+  color: "blue"
+
+inputs:
+  cache-dir:
+    description: "Directory for OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{ runner.temp }}/osv-scanner)"
+    required: false
+    default: "${{ runner.temp }}/osv-scanner"
+  cache-bucket-hours:
+    description: "actions/cache key advances every this many full hours (UTC, since epoch). Example: 24 ≈ daily bucket; 1 = new key each hour."
+    required: false
+    default: "24"
+  ecosystems:
+    description: "Comma-separated ecosystem tokens (slug or official name, see README). OSV has no Docker Hub bucket; token `docker` installs the `Linux` ecosystem as a practical default for image-style data."
+    required: false
+    default: "github-actions,npm,go,docker"
+
+outputs:
+  cache-dir:
+    description: "Path passed to OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY"
+    value: ${{ inputs.cache-dir }}
+
+runs:
+  using: "composite"
+  steps:
+    - id: prepare
+      shell: bash
+      run: |
+        set -euo pipefail
+
+        slugify() {
+          local s="$1"
+          s=$(printf '%s' "$s" | tr '[:upper:]' '[:lower:]')
+          s=$(printf '%s' "$s" | sed 's/\[//g;s/\]//g')
+          s=$(printf '%s' "$s" | sed 's/[[:space:]]\+/-/g')
+          printf '%s' "$s"
+        }
+
+        HOURS="${{ inputs.cache-bucket-hours }}"
+        case "$HOURS" in
+          ''|*[!0-9]*) echo "cache-bucket-hours must be a positive integer, got: $HOURS" >&2; exit 1 ;;
+        esac
+        if [ "$HOURS" -lt 1 ]; then
+          echo "cache-bucket-hours must be >= 1" >&2
+          exit 1
+        fi
+        bucket=$(( $(date -u +%s) / (3600 * HOURS) ))
+        echo "hours=$HOURS" >> "$GITHUB_OUTPUT"
+        echo "bucket=$bucket" >> "$GITHUB_OUTPUT"
+
+        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
+        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
+        : > "$RESOLVED_FILE"
+
+        ecosystems_all="$(mktemp)"
+        curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt" -o "$ecosystems_all"
+
+        declare -A SLUG_TO_OFFICIAL=()
+        while IFS= read -r line || [ -n "$line" ]; do
+          line="${line//$'\r'/}"
+          [ -z "$line" ] && continue
+          slug=$(slugify "$line")
+          SLUG_TO_OFFICIAL["$slug"]="$line"
+        done < "$ecosystems_all"
+        rm -f "$ecosystems_all"
+
+        declare -A SEEN_CANONICAL=()
+        INPUT="${{ inputs.ecosystems }}"
+        INPUT="${INPUT//$'\r'/}"
+        if [ -z "${INPUT//[[:space:]]/}" ]; then
+          echo "ecosystems input is empty" >&2
+          exit 1
+        fi
+
+        IFS=',' read -ra PARTS <<< "$INPUT"
+        for raw in "${PARTS[@]}"; do
+          token=$(printf '%s' "$raw" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')
+          [ -z "$token" ] && continue
+          tslug=$(slugify "$token")
+          if [ "$tslug" = "docker" ]; then
+            official="Linux"
+          elif [ -n "${SLUG_TO_OFFICIAL[$tslug]+x}" ]; then
+            official="${SLUG_TO_OFFICIAL[$tslug]}"
+          else
+            echo "Unknown ecosystem token: ${token}. Valid names/slugs match https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt (token docker -> Linux)." >&2
+            exit 1
+          fi
+          if [ -z "${SEEN_CANONICAL[$official]+x}" ]; then
+            SEEN_CANONICAL[$official]=1
+            printf '%s\n' "$official" >> "$RESOLVED_FILE"
+          fi
+        done
+
+        if [ ! -s "$RESOLVED_FILE" ]; then
+          echo "No ecosystems resolved from input" >&2
+          exit 1
+        fi
+
+        slug_keys=()
+        while IFS= read -r official || [ -n "$official" ]; do
+          [ -z "$official" ] && continue
+          slug_keys+=("$(slugify "$official")")
+        done < "$RESOLVED_FILE"
+        ecosystems_key=$(printf '%s\n' "${slug_keys[@]}" | sort -u | paste -sd, -)
+        echo "ecosystems-key=$ecosystems_key" >> "$GITHUB_OUTPUT"
+    - id: restore-db
+      uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
+      with:
+        path: ${{ inputs.cache-dir }}
+        key: osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-${{ steps.prepare.outputs.bucket }}
+        restore-keys: |
+          osv-scanner-db-${{ steps.prepare.outputs.hours }}h-eco-${{ steps.prepare.outputs.ecosystems-key }}-
+    - if: steps.restore-db.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -euo pipefail
+        CACHE_DIR="${{ inputs.cache-dir }}"
+        ROOT="${CACHE_DIR}/osv-scanner"
+        BASE="https://osv-vulnerabilities.storage.googleapis.com"
+        RUN_TEMP="${RUNNER_TEMP:-${{ runner.temp }}}"
+        RESOLVED_FILE="${RUN_TEMP}/osv-db-ecosystems-resolved.txt"
+
+        rm -rf "$ROOT"
+        mkdir -p "$ROOT"
+
+        if [ ! -s "$RESOLVED_FILE" ]; then
+          echo "Missing resolved ecosystem list at $RESOLVED_FILE" >&2
+          exit 1
+        fi
+
+        while IFS= read -r ecosystem || [ -n "$ecosystem" ]; do
+          [ -z "$ecosystem" ] && continue
+          enc="$(python3 -c "import urllib.parse,sys; print(urllib.parse.quote(sys.argv[1], safe=''))" "$ecosystem")"
+          dest_dir="${ROOT}/${ecosystem}"
+          mkdir -p "$dest_dir"
+          tmp="$(mktemp)"
+          curl -fsSL "${BASE}/${enc}/all.zip" -o "$tmp"
+          mv "$tmp" "${dest_dir}/all.zip"
+        done < "$RESOLVED_FILE"