t.behrendt
a80903b16a
CI / Test Setup OSV Scanner amd64 (pull_request) Successful in 17s
CI / Test Get Images From Files (pull_request) Successful in 3s
CI / Test Setup DB (pull_request) Successful in 28s
CI / Test Merge SARIF Files (pull_request) Successful in 3s
CI / Test Setup OSV Scanner arm64 (pull_request) Successful in 3m20s
95 lines
3.1 KiB
YAML
95 lines
3.1 KiB
YAML
name: "Setup OSV Scanner DB"
|
|
description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
|
|
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
|
branding:
|
|
icon: "database"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
cache-dir:
|
|
description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
|
|
required: false
|
|
default: "${{ runner.temp }}/osv-scanner"
|
|
ecosystems:
|
|
description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
|
|
required: false
|
|
default: ""
|
|
|
|
outputs:
|
|
cache-dir:
|
|
description: "Path to the osv-scanner local DB cache directory"
|
|
value: ${{ inputs.cache-dir }}
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- id: current-date
|
|
shell: bash
|
|
run: |
|
|
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
|
|
- id: restore-db
|
|
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
|
|
with:
|
|
path: ${{ inputs.cache-dir }}
|
|
key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
|
|
restore-keys: |
|
|
osv-scanner-db-${{ steps.current-date.outputs.current-date }}
|
|
- name: Download offline databases
|
|
if: steps.restore-db.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
CACHE_DIR="${{ inputs.cache-dir }}"
|
|
DB_DIR="${CACHE_DIR}/osv-scanner"
|
|
mkdir -p "${DB_DIR}"
|
|
|
|
ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
|
|
if [ -n "${ECOSYSTEMS_INPUT}" ]; then
|
|
# shellcheck disable=SC2001
|
|
ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
|
|
else
|
|
ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
|
|
fi
|
|
|
|
if [ -z "${ECOSYSTEMS}" ]; then
|
|
echo "No ecosystems to download" >&2
|
|
exit 1
|
|
fi
|
|
|
|
download_one() {
|
|
local ecosystem="$1"
|
|
local encoded
|
|
encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
|
|
local dest="${DB_DIR}/${ecosystem}"
|
|
mkdir -p "${dest}"
|
|
echo "Downloading ${ecosystem}..."
|
|
curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
|
|
}
|
|
|
|
max_jobs=8
|
|
pids=()
|
|
while IFS= read -r ecosystem; do
|
|
[ -z "${ecosystem}" ] && continue
|
|
while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
|
|
sleep 0.2
|
|
done
|
|
download_one "${ecosystem}" &
|
|
pids+=("$!")
|
|
done <<< "${ECOSYSTEMS}"
|
|
|
|
fail=0
|
|
for pid in "${pids[@]}"; do
|
|
wait "${pid}" || fail=1
|
|
done
|
|
if [ "${fail}" -ne 0 ]; then
|
|
echo "One or more ecosystem database downloads failed" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
|
|
- name: Export DB cache directory
|
|
shell: bash
|
|
run: |
|
|
echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"
|