Repository navigation
fix(plugin): verify known release diagnostics without hiding failures #3225
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow uses a digest-pinned OSV-Scanner container published by Google. | |
| # It preserves differential pull-request reporting and scheduled SARIF uploads | |
| # without delegating authority to a reusable workflow from another repository. | |
| name: OSV-Scanner | |
| on: | |
| pull_request: | |
| branches: [ "main" ] | |
| merge_group: | |
| branches: [ "main" ] | |
| schedule: | |
| - cron: '27 19 * * 2' | |
| push: | |
| branches: [ "main" ] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| scan-scheduled: | |
| if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Scan dependency manifests | |
| uses: docker://ghcr.io/google/osv-scanner-action@sha256:48406c58197201fe55e56615ad9d414f85063da320e204d0b0ed460fb3908dba # v2.3.8 | |
| continue-on-error: true | |
| with: | |
| args: >- | |
| scan | |
| source | |
| --format=json | |
| --output-file=results.json | |
| -r | |
| --allow-no-lockfiles | |
| ./ | |
| - name: Build SARIF report | |
| uses: docker://ghcr.io/google/osv-scanner-action@sha256:48406c58197201fe55e56615ad9d414f85063da320e204d0b0ed460fb3908dba # v2.3.8 | |
| with: | |
| entrypoint: /root/osv-reporter | |
| args: >- | |
| --output-files=sarif:results.sarif | |
| --new=results.json | |
| --fail-on-vuln=true | |
| - name: Upload SARIF artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: OSV Scanner SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| if: ${{ !cancelled() }} | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| sarif_file: results.sarif | |
| scan-pr: | |
| if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Check out code | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Check out pull-request base commit | |
| if: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| if [[ ! "$BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then | |
| echo "invalid pull-request base SHA" >&2 | |
| exit 1 | |
| fi | |
| git checkout --detach "$BASE_SHA" | |
| - name: Check out merge-group base commit | |
| if: ${{ github.event_name == 'merge_group' }} | |
| env: | |
| BASE_SHA: ${{ github.event.merge_group.base_sha }} | |
| run: | | |
| if [[ ! "$BASE_SHA" =~ ^[0-9a-f]{40}$ ]]; then | |
| echo "invalid merge-group base SHA" >&2 | |
| exit 1 | |
| fi | |
| git checkout --detach "$BASE_SHA" | |
| - name: Scan existing dependency manifests | |
| uses: docker://ghcr.io/google/osv-scanner-action@sha256:48406c58197201fe55e56615ad9d414f85063da320e204d0b0ed460fb3908dba # v2.3.8 | |
| continue-on-error: true | |
| with: | |
| args: >- | |
| scan | |
| source | |
| --format=json | |
| --output-file=old-results.json | |
| -r | |
| --allow-no-lockfiles | |
| ./ | |
| - name: Restore candidate commit | |
| run: git checkout --force "$GITHUB_SHA" | |
| - name: Scan candidate dependency manifests | |
| uses: docker://ghcr.io/google/osv-scanner-action@sha256:48406c58197201fe55e56615ad9d414f85063da320e204d0b0ed460fb3908dba # v2.3.8 | |
| continue-on-error: true | |
| with: | |
| args: >- | |
| scan | |
| source | |
| --format=json | |
| --output-file=new-results.json | |
| -r | |
| --allow-no-lockfiles | |
| ./ | |
| - name: Build differential SARIF report | |
| uses: docker://ghcr.io/google/osv-scanner-action@sha256:48406c58197201fe55e56615ad9d414f85063da320e204d0b0ed460fb3908dba # v2.3.8 | |
| with: | |
| entrypoint: /root/osv-reporter | |
| args: >- | |
| --output-files=sarif:results.sarif,gh-annotations:#stderr | |
| --old=old-results.json | |
| --new=new-results.json | |
| --fail-on-vuln=true | |
| - name: Upload SARIF artifact | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: OSV Scanner PR SARIF file | |
| path: results.sarif | |
| retention-days: 5 | |
| - name: Upload old scan JSON | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: OSV Scanner old JSON results | |
| path: old-results.json | |
| retention-days: 5 | |
| - name: Upload new scan JSON | |
| if: ${{ !cancelled() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: OSV Scanner new JSON results | |
| path: new-results.json | |
| retention-days: 5 | |
| - name: Upload to code scanning | |
| if: ${{ !cancelled() }} | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| sarif_file: results.sarif |