f8f3edc8fc
## Description Minor improvement Fixes #`Issue Number` _or_ Fixes `Issue URL` > [!WARNING] > _If no issue exists, please create an issue first, and check with the maintainers if the issue is valid._ ## Automation /ok-to-test tags="@tag.IDE" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!IMPORTANT] > 🟣 🟣 🟣 Your tests are running. > Tests running at: <https://github.com/appsmithorg/appsmith/actions/runs/11810935173> > Commit: 56bd00f35c0e85710ee18958f1f85cbf73daf4d8 > Workflow: `PR Automation test suite` > Tags: `@tag.IDE` > Spec: `` > <hr>Wed, 13 Nov 2024 05:01:04 UTC <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Chores** - Enhanced checks for new vulnerabilities in the workflow, improving data validation. - Added feedback for cases when no new vulnerabilities are detected, enhancing output clarity. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
84 lines
3.0 KiB
YAML
84 lines
3.0 KiB
YAML
name: Run Vulnerability Data Script with Parameters and Update PR
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
image_name:
|
|
description: 'Docker image name to scan'
|
|
required: true
|
|
default: 'appsmith/appsmith-ce:release'
|
|
|
|
jobs:
|
|
run-and-update-pr:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
|
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
|
|
|
|
- name: Install pg
|
|
run: npm install pg
|
|
|
|
# Run Scout vulnerability data script
|
|
- name: Run Scout vulnerability data script
|
|
if: always()
|
|
env:
|
|
DB_HOST: ${{ secrets.CYPRESS_DB_HOST }}
|
|
DB_NAME: ${{ secrets.CYPRESS_DB_NAME }}
|
|
DB_USER: ${{ secrets.CYPRESS_DB_USER }}
|
|
DB_PWD: ${{ secrets.CYPRESS_DB_PWD }}
|
|
run: |
|
|
chmod +x scripts/scout_vulnerabilities_data.sh
|
|
./scripts/scout_vulnerabilities_data.sh \
|
|
"${{ inputs.image_name }}" \
|
|
"${{ github.event.pull_request.number }}" \
|
|
"${{ github.event.pull_request.html_url }}" \
|
|
"${{ github.run_id }}"
|
|
|
|
- name: Run Trivy vulnerability data script
|
|
if: always()
|
|
env:
|
|
DB_HOST: ${{ secrets.CYPRESS_DB_HOST }}
|
|
DB_NAME: ${{ secrets.CYPRESS_DB_NAME }}
|
|
DB_USER: ${{ secrets.CYPRESS_DB_USER }}
|
|
DB_PWD: ${{ secrets.CYPRESS_DB_PWD }}
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
|
|
chmod +x scripts/trivy_vulnerabilities_data.sh
|
|
./scripts/trivy_vulnerabilities_data.sh \
|
|
"${{ inputs.image_name }}" \
|
|
"${{ github.event.pull_request.number }}" \
|
|
"${{ github.event.pull_request.html_url }}" \
|
|
"${{ github.run_id }}"
|
|
|
|
- name: Check for new vulnerabilities in Scout and Trivy files
|
|
if: always()
|
|
run: |
|
|
# Check if Scout vulnerabilities file has data after the header
|
|
if [ $(tail -n +2 scout_new_vulnerabilities.csv | wc -l) -gt 0 ]; then
|
|
echo "Scout vulnerabilities detected."
|
|
cat scout_new_vulnerabilities.csv
|
|
exit 1 # Fail the job if data exists
|
|
else
|
|
echo "No new Scout vulnerabilities detected."
|
|
fi
|
|
|
|
# Check if Trivy vulnerabilities file has data after the header
|
|
if [ $(tail -n +2 trivy_new_vulnerabilities.csv | wc -l) -gt 0 ]; then
|
|
echo "Trivy vulnerabilities detected."
|
|
cat trivy_new_vulnerabilities.csv
|
|
exit 1 # Fail the job if data exists
|
|
else
|
|
echo "No new Trivy vulnerabilities detected."
|
|
fi |