1295c6ac63
## Description Update name of the workflow for each search and visibility. Tested on my forked repository: <img width="724" alt="Screenshot 2024-11-26 at 11 17 55 AM" src="https://github.com/user-attachments/assets/856191b5-274b-4f7a-b043-55c2b9490c93"> Fixes # [`Issue Number` ](https://app.zenhub.com/workspaces/stability-pod-6690c4814e31602e25cab7fd/issues/gh/appsmithorg/appsmith/37695) ## Automation /ok-to-test tags="" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR. <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No
87 lines
3.1 KiB
YAML
87 lines
3.1 KiB
YAML
name: Run Vulnerability
|
|
|
|
run-name: >
|
|
On Branch: ${{ github.ref_name }} with Image: ${{ inputs.image_name || 'appsmith/appsmith-ce:release' }}
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
image_name:
|
|
description: 'Docker image name to scan'
|
|
required: true
|
|
default: 'appsmith/appsmith-ce:release'
|
|
|
|
jobs:
|
|
run-and-update-pr:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v3
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v3
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Login to DockerHub
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKER_HUB_USERNAME }}
|
|
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
|
|
|
|
- name: Install pg
|
|
run: npm install pg
|
|
|
|
# Run Scout vulnerability data script
|
|
- name: Run Scout vulnerability data script
|
|
if: always()
|
|
env:
|
|
DB_HOST: ${{ secrets.CYPRESS_DB_HOST }}
|
|
DB_NAME: ${{ secrets.CYPRESS_DB_NAME }}
|
|
DB_USER: ${{ secrets.CYPRESS_DB_USER }}
|
|
DB_PWD: ${{ secrets.CYPRESS_DB_PWD }}
|
|
run: |
|
|
chmod +x scripts/scout_vulnerabilities_data.sh
|
|
./scripts/scout_vulnerabilities_data.sh \
|
|
"${{ inputs.image_name }}" \
|
|
"${{ github.event.pull_request.number }}" \
|
|
"${{ github.event.pull_request.html_url }}" \
|
|
"${{ github.run_id }}"
|
|
|
|
- name: Run Trivy vulnerability data script
|
|
if: always()
|
|
env:
|
|
DB_HOST: ${{ secrets.CYPRESS_DB_HOST }}
|
|
DB_NAME: ${{ secrets.CYPRESS_DB_NAME }}
|
|
DB_USER: ${{ secrets.CYPRESS_DB_USER }}
|
|
DB_PWD: ${{ secrets.CYPRESS_DB_PWD }}
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
run: |
|
|
echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
|
|
chmod +x scripts/trivy_vulnerabilities_data.sh
|
|
./scripts/trivy_vulnerabilities_data.sh \
|
|
"${{ inputs.image_name }}" \
|
|
"${{ github.event.pull_request.number }}" \
|
|
"${{ github.event.pull_request.html_url }}" \
|
|
"${{ github.run_id }}"
|
|
|
|
- name: Check for new vulnerabilities in Scout and Trivy files
|
|
if: always()
|
|
run: |
|
|
# Check if Scout vulnerabilities file has data after the header
|
|
if [ $(tail -n +2 scout_new_vulnerabilities.csv | wc -l) -gt 0 ]; then
|
|
echo "Scout vulnerabilities detected."
|
|
cat scout_new_vulnerabilities.csv
|
|
exit 1 # Fail the job if data exists
|
|
else
|
|
echo "No new Scout vulnerabilities detected."
|
|
fi
|
|
|
|
# Check if Trivy vulnerabilities file has data after the header
|
|
if [ $(tail -n +2 trivy_new_vulnerabilities.csv | wc -l) -gt 0 ]; then
|
|
echo "Trivy vulnerabilities detected."
|
|
cat trivy_new_vulnerabilities.csv
|
|
exit 1 # Fail the job if data exists
|
|
else
|
|
echo "No new Trivy vulnerabilities detected."
|
|
fi |