79 lines
2.7 KiB
YAML
79 lines
2.7 KiB
YAML
name: "Setup OSV-Scanner"
|
|
description: "Download and setup the OSV-Scanner binary for vulnerability scanning"
|
|
author: "Gitea Actions"
|
|
branding:
|
|
icon: "shield"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
version:
|
|
description: "OSV-Scanner release tag to download (e.g. v2.3.3). Must match the SHA256 inputs."
|
|
required: false
|
|
default: "v2.3.3"
|
|
sha256_linux_amd64:
|
|
description: "SHA256 (hex) of the osv-scanner_linux_amd64 binary for this version"
|
|
required: false
|
|
default: "777b4bb7ddd10bdcc8a1aa398d37d05e91e866e7586f9cff3fca2f72b8153033"
|
|
sha256_linux_arm64:
|
|
description: "SHA256 (hex) of the osv-scanner_linux_arm64 binary for this version"
|
|
required: false
|
|
default: "0a503893df39863edc65edef01fd6d82b45c6e47fa9132538593d5a2d33f2616"
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- shell: bash
|
|
id: arch
|
|
run: |
|
|
set -e
|
|
case "$(uname -m)" in
|
|
x86_64)
|
|
ARCH="amd64"
|
|
;;
|
|
aarch64)
|
|
ARCH="arm64"
|
|
;;
|
|
*)
|
|
echo "Unsupported architecture: $(uname -m)" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
echo "ARCH=$ARCH" >> $GITHUB_OUTPUT
|
|
- name: Cache OSV-Scanner binary
|
|
id: cache-osv
|
|
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
|
with:
|
|
path: /usr/local/bin/osv-scanner
|
|
key: osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
|
|
restore-keys: |
|
|
osv-scanner-${{ inputs.version }}-${{ steps.arch.outputs.arch }}
|
|
- name: Download and install OSV-Scanner
|
|
if: steps.cache-osv.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
set -e
|
|
VERSION="${{ inputs.version }}"
|
|
ARCH="${{ steps.arch.outputs.arch }}"
|
|
case "$ARCH" in
|
|
amd64) EXPECTED="${{ inputs.sha256_linux_amd64 }}" ;;
|
|
arm64) EXPECTED="${{ inputs.sha256_linux_arm64 }}" ;;
|
|
*) echo "internal error: bad ARCH=$ARCH" >&2; exit 1 ;;
|
|
esac
|
|
EXPECTED=$(echo "$EXPECTED" | tr '[:upper:]' '[:lower:]' | tr -d '[:space:]')
|
|
mkdir -p /usr/local/bin
|
|
tmp="$(mktemp)"
|
|
trap 'rm -f "$tmp"' EXIT
|
|
curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "$tmp"
|
|
ACTUAL=$(sha256sum "$tmp" | awk '{print $1}' | tr '[:upper:]' '[:lower:]')
|
|
if [ "$ACTUAL" != "$EXPECTED" ]; then
|
|
echo "SHA256 mismatch for osv-scanner_linux_${ARCH}: expected $EXPECTED, got $ACTUAL" >&2
|
|
exit 1
|
|
fi
|
|
mv "$tmp" /usr/local/bin/osv-scanner
|
|
chmod +x /usr/local/bin/osv-scanner
|
|
|
|
- name: Add OSV-Scanner to PATH
|
|
shell: bash
|
|
run: |
|
|
echo "/usr/local/bin" >> $GITHUB_PATH
|