t.behrendt
368e1be8dd
CD / Release (push) Successful in 3s
Reviewed-on: #51 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
105 lines
3.4 KiB
YAML
105 lines
3.4 KiB
YAML
name: "Setup OSV Scanner"
|
|
description: "Download and setup osv-scanner binary for vulnerability scanning"
|
|
author: "Gitea Actions"
|
|
branding:
|
|
icon: "shield"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
version:
|
|
description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
|
|
required: true
|
|
amd64-digest:
|
|
description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
|
|
required: true
|
|
arm64-digest:
|
|
description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
|
|
required: true
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Resolve architecture and digest
|
|
shell: bash
|
|
id: arch
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
VERSION="${{ inputs.version }}"
|
|
if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
|
|
echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
|
|
exit 1
|
|
fi
|
|
|
|
case "$(uname -m)" in
|
|
x86_64)
|
|
ARCH="amd64"
|
|
DIGEST="${{ inputs.amd64-digest }}"
|
|
;;
|
|
aarch64)
|
|
ARCH="arm64"
|
|
DIGEST="${{ inputs.arm64-digest }}"
|
|
;;
|
|
*)
|
|
echo "Unsupported architecture: $(uname -m)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
if [ -z "${DIGEST}" ]; then
|
|
echo "Missing digest for architecture ${ARCH}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Normalize sha256:<hex> / SHA256:<hex> to bare hex
|
|
DIGEST="${DIGEST#sha256:}"
|
|
DIGEST="${DIGEST#SHA256:}"
|
|
|
|
if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
|
|
echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
|
|
echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
|
|
echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
|
|
- name: Cache osv-scanner binary
|
|
id: cache-osv
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: /usr/local/bin/osv-scanner
|
|
key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
|
|
restore-keys: |
|
|
osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
|
|
- name: Download and install osv-scanner
|
|
if: steps.cache-osv.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
VERSION="${{ steps.arch.outputs.version }}"
|
|
ARCH="${{ steps.arch.outputs.arch }}"
|
|
EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
|
|
DEST="/usr/local/bin/osv-scanner"
|
|
|
|
mkdir -p /usr/local/bin
|
|
|
|
curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"
|
|
|
|
ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
|
|
if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
|
|
echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
|
|
echo " expected: ${EXPECTED_DIGEST}" >&2
|
|
echo " actual: ${ACTUAL_DIGEST}" >&2
|
|
rm -f "${DEST}"
|
|
exit 1
|
|
fi
|
|
|
|
chmod +x "${DEST}"
|
|
echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"
|
|
|
|
- name: Add osv-scanner to PATH
|
|
shell: bash
|
|
run: |
|
|
echo "/usr/local/bin" >> "$GITHUB_PATH"
|