mirror of
https://github.com/onyx-dot-app/onyx.git
synced 2026-10-22 19:32:55 -05:00
devin-ai-integration[bot]andnik
a0897a2205
Co-authored-by: nik <nik@onyx.app> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
94 lines
3.6 KiB
YAML
94 lines
3.6 KiB
YAML
### Records the CVE count per image every day, from the image audits the deploy
|
|
### gate uploads to the Security tab (categories image-audit-<component>): total,
|
|
### open, and resolved CVEs, open by severity, and the CVEs open 90 days or more.
|
|
### The history lives in S3 next to the audit allowlist. Mondays, and on a
|
|
### dispatch that asks, the latest counts post to #cve-reviews.
|
|
|
|
name: CVE Tracking
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "0 15 * * *"
|
|
workflow_dispatch:
|
|
inputs:
|
|
post-summary:
|
|
description: Post the summary to #cve-reviews
|
|
type: boolean
|
|
default: false
|
|
|
|
permissions: {}
|
|
|
|
concurrency:
|
|
group: cve-tracking
|
|
cancel-in-progress: false
|
|
|
|
env:
|
|
HISTORY_URL: s3://onyx-internal-tools/audit/cve-history.json
|
|
# #cve-reviews
|
|
CVE_REVIEWS_CHANNEL: C0C5SMAM4TT
|
|
|
|
jobs:
|
|
track:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
id-token: write # OIDC for the S3 history
|
|
security-events: read # the image audits' code scanning alerts
|
|
steps:
|
|
- name: Checkout ods source
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v6
|
|
with:
|
|
persist-credentials: false
|
|
ref: main
|
|
sparse-checkout: tools/ods
|
|
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # zizmor: ignore[cache-poisoning]
|
|
with:
|
|
go-version-file: tools/ods/go.mod
|
|
cache-dependency-path: tools/ods/go.sum
|
|
|
|
- name: Build ods-audit
|
|
working-directory: tools/ods
|
|
run: go build -o "${RUNNER_TEMP}/ods-audit" ./odsaudit
|
|
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # ratchet:aws-actions/configure-aws-credentials@v6.2.3
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
# Only a missing history starts a new one; any other failed download
|
|
# stops the run before it can overwrite the history.
|
|
- name: Record today's counts
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
gh api --paginate "repos/${GITHUB_REPOSITORY}/code-scanning/alerts?ref=refs/heads/main&per_page=100" > "${RUNNER_TEMP}/alerts.json"
|
|
history="${RUNNER_TEMP}/history.json"
|
|
if ! out="$(aws s3 cp "${HISTORY_URL}" "${history}" 2>&1)"; then
|
|
if ! grep -q '(404)' <<< "${out}"; then
|
|
echo "${out}"
|
|
exit 1
|
|
fi
|
|
echo "No history at ${HISTORY_URL} yet, starting one."
|
|
fi
|
|
"${RUNNER_TEMP}/ods-audit" track --alerts "${RUNNER_TEMP}/alerts.json" --history "${history}" --summary "${RUNNER_TEMP}/summary.md"
|
|
aws s3 cp "${history}" "${HISTORY_URL}"
|
|
cat "${RUNNER_TEMP}/summary.md" >> "$GITHUB_STEP_SUMMARY"
|
|
|
|
- name: Post the summary to #cve-reviews
|
|
if: github.event_name == 'schedule' || inputs.post-summary
|
|
env:
|
|
SLACK_BOT_TOKEN: ${{ secrets.CVE_REVIEWS_BOT_TOKEN }}
|
|
POST_SUMMARY: ${{ inputs.post-summary }}
|
|
run: |
|
|
if [ "${POST_SUMMARY}" != "true" ] && [ "$(date -u +%u)" != "1" ]; then
|
|
exit 0
|
|
fi
|
|
jq -cn --arg channel "${CVE_REVIEWS_CHANNEL}" --rawfile text "${RUNNER_TEMP}/summary.md" \
|
|
'{channel: $channel, text: $text, unfurl_links: false, unfurl_media: false}' \
|
|
| curl -sS --fail-with-body -X POST https://slack.com/api/chat.postMessage \
|
|
-H "Authorization: Bearer ${SLACK_BOT_TOKEN}" -H 'Content-type: application/json; charset=utf-8' --data-binary @- \
|
|
| jq -e '.ok' > /dev/null
|