Skip to content

Commit 678343c

Browse files
brianLoomisbrianLoomis
committed
Update cd-download-grype-scan.yml
adding Windows
1 parent 6be2c91 commit 678343c

1 file changed

Lines changed: 167 additions & 80 deletions

File tree

‎.github/workflows/cd-download-grype-scan.yml‎

Lines changed: 167 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -203,34 +203,9 @@ jobs:
203203
echo " OS Platform Version: ${{ inputs.os-platform-version }}"
204204
echo " Test runner: ${{ inputs.test-runner }}"
205205
echo "*************************************************************"
206-
generate-filename-slug:
207-
name: Generate a slug based on repo and date for use in any output artifacts and set download location
208-
runs-on: ubuntu-latest
209-
steps:
210-
- name: Generate Filename Prefix and full JSON file name as environment variables for later steps
211-
run: |
212-
FILE_PREFIX=$(echo "${{ inputs.product }}${{ env.DEFAULT_SEPARATOR }}${{ inputs.product-version }}${{ env.DEFAULT_SEPARATOR }}" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
213-
echo "FILE_PREFIX=${FILE_PREFIX}" >> $GITHUB_ENV
214-
echo "Generated FILE_PREFIX: ${FILE_PREFIX}"
215-
216-
DOWNLOAD_URL="https://chefdownload-commercial.chef.io"
217-
if [ ${{ inputs.download-site }} = "community" ]; then
218-
DOWNLOAD_URL="https://chefdownload-community.chef.io"
219-
fi
220-
echo "DOWNLOAD_URL=${DOWNLOAD_URL}" >> $GITHUB_ENV
221-
echo "DOWNLOAD_URL is set to ${DOWNLOAD_URL}"
222-
223-
# get the license_id from input or secret
224-
LICENSE_ID="${{ inputs.license-id }}"
225-
if [ -z "${LICENSE_ID}" ]; then
226-
LICENSE_ID="${{ secrets.GA_DOWNLOAD_GRYPE_LICENSE_ID }}"
227-
echo "Using license ID from repository secret"
228-
else
229-
echo "Using license ID from workflow input"
230-
fi
231-
206+
232207
grype-scan-linux:
233-
name: 'Grype scan of Habitat packages'
208+
name: 'Grype scan of customer-downloadable packages'
234209
runs-on: ubuntu-latest # TODO: make this a versioned OS strategy later
235210
if: ${{ success() && (inputs.test-runner == 'ubuntu-latest' || inputs.test-runner == 'both') }}
236211
steps:
@@ -249,6 +224,27 @@ jobs:
249224
# # Create the necessary directory structure for license file
250225
# sudo mkdir -p /hab/accepted-licenses/
251226
# sudo touch /hab/accepted-licenses/habitat
227+
- name: Generate filename prefix, download URL and license-id as environment variables for later steps
228+
run: |
229+
FILE_PREFIX=$(echo "${{ inputs.product }}${{ env.DEFAULT_SEPARATOR }}${{ inputs.product-version }}${{ env.DEFAULT_SEPARATOR }}ubuntu" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
230+
echo "FILE_PREFIX=${FILE_PREFIX}" >> $GITHUB_ENV
231+
echo "Generated FILE_PREFIX: ${FILE_PREFIX}"
232+
233+
DOWNLOAD_URL="https://chefdownload-commercial.chef.io"
234+
if [ ${{ inputs.download-site }} = "community" ]; then
235+
DOWNLOAD_URL="https://chefdownload-community.chef.io"
236+
fi
237+
echo "DOWNLOAD_URL=${DOWNLOAD_URL}" >> $GITHUB_ENV
238+
echo "DOWNLOAD_URL is set to ${DOWNLOAD_URL}"
239+
240+
# get the license_id from input or secret
241+
LICENSE_ID="${{ inputs.license-id }}"
242+
if [ -z "${LICENSE_ID}" ]; then
243+
LICENSE_ID="${{ secrets.GA_DOWNLOAD_GRYPE_LICENSE_ID }}"
244+
echo "Using license ID from repository secret"
245+
else
246+
echo "Using license ID from workflow input"
247+
fi
252248
253249
- name: Install Grype (ubuntu-latest)
254250
continue-on-error: true
@@ -281,7 +277,7 @@ jobs:
281277
mkdir -p /tmp/extracted_packages
282278
tar -xzf /tmp/package_downloaded -C /tmp/extracted_packages
283279
echo "Package downloaded and extracted to /tmp/extracted_packages"
284-
280+
285281
ls -l /tmp/extracted_packages
286282
287283
# - name: Install Habitat Package under test (example core/nginx on MacOS and Linux)
@@ -349,16 +345,149 @@ jobs:
349345
name: ${{ env.OUTPUT_FILE }}
350346
path: ${{ env.OUTPUT_FILE }}
351347

352-
# grype-scan-windows:
353-
354-
# checkout:
355-
# name: 'Checkout repository'
356-
# runs-on: ubuntu-latest
357-
# steps:
358-
# - name: Checkout repository
359-
# uses: actions/checkout@v6
360-
# with:
361-
# fetch-depth: 0
348+
grype-scan-windows:
349+
name: 'Grype scan of customer-downloadable packages'
350+
runs-on: windows-latest # TODO: make this a versioned OS strategy later
351+
if: ${{ success() && (inputs.test-runner == 'windows-latest' || inputs.test-runner == 'both') }}
352+
steps:
353+
- name: Generate filename prefix, download URL and license-id as environment variables for later steps
354+
# shell: bash || pwsh
355+
run: |
356+
FILE_PREFIX=$(echo "${{ inputs.product }}${{ env.DEFAULT_SEPARATOR }}${{ inputs.product-version }}${{ env.DEFAULT_SEPARATOR }}windows" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
357+
echo "FILE_PREFIX=${FILE_PREFIX}" >> $GITHUB_ENV
358+
echo "Generated FILE_PREFIX: ${FILE_PREFIX}"
359+
360+
DOWNLOAD_URL="https://chefdownload-commercial.chef.io"
361+
if [ ${{ inputs.download-site }} = "community" ]; then
362+
DOWNLOAD_URL="https://chefdownload-community.chef.io"
363+
fi
364+
echo "DOWNLOAD_URL=${DOWNLOAD_URL}" >> $GITHUB_ENV
365+
echo "DOWNLOAD_URL is set to ${DOWNLOAD_URL}"
366+
367+
# get the license_id from input or secret
368+
LICENSE_ID="${{ inputs.license-id }}"
369+
if [ -z "${LICENSE_ID}" ]; then
370+
LICENSE_ID="${{ secrets.GA_DOWNLOAD_GRYPE_LICENSE_ID }}"
371+
echo "Using license ID from repository secret"
372+
else
373+
echo "Using license ID from workflow input"
374+
fi
375+
376+
- name: Install Grype (windows-latest)
377+
continue-on-error: true
378+
run: |
379+
$ErrorActionPreference = 'Stop'
380+
# Download and install Grype for Windows
381+
$grypeVersion = (Invoke-RestMethod -Uri "https://api.github.com/repos/anchore/grype/releases/latest").tag_name
382+
$grypeUrl = "https://github.com/anchore/grype/releases/download/$grypeVersion/grype_$($grypeVersion.TrimStart('v'))_windows_amd64.zip"
383+
$grypeZip = "$env:TEMP\grype.zip"
384+
$grypeDir = "$env:TEMP\grype"
385+
386+
# Download Grype
387+
Invoke-WebRequest -Uri $grypeUrl -OutFile $grypeZip
388+
389+
# Extract Grype
390+
Expand-Archive -Path $grypeZip -DestinationPath $grypeDir -Force
391+
392+
# Add Grype to PATH for subsequent steps
393+
echo "$grypeDir" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
394+
395+
# Verify installation
396+
& "$grypeDir\grype.exe" version
397+
398+
- name: Download package under test (windows-latest)
399+
run: |
400+
# Example download URL construction
401+
$DownloadUrl = "${{ env.DOWNLOAD_URL }}/${{ inputs.channel }}/${{ inputs.product }}/download?p=${{ inputs.os-platform }}&pv=${{ inputs.os-platform-version }}&m=${{ inputs.architecture }}"
402+
if ("${{ inputs.product-version }}" -ne "") {
403+
$DownloadUrl = "${DownloadUrl}&v=${{ inputs.product-version }}"
404+
}
405+
Write-Host "Downloading package from: ${DownloadUrl}"
406+
if ("${{ inputs.download-site }}" -eq "commercial") {
407+
$LicenseId = "${{ env.LICENSE_ID }}"
408+
if (-not [string]::IsNullOrEmpty($LicenseId)) {
409+
$DownloadUrl = "${DownloadUrl}&license_id=${LicenseId}"
410+
Write-Host "Using license ID in download URL"
411+
}
412+
}
413+
414+
# Download the package
415+
Invoke-WebRequest -Uri $DownloadUrl -OutFile "$env:TEMP\package_downloaded" -FollowRelLink
416+
417+
# Extract the package based on its type (assuming .zip for Windows)
418+
$ExtractPath = "$env:TEMP\extracted_packages"
419+
New-Item -ItemType Directory -Force -Path $ExtractPath
420+
Expand-Archive -Path "$env:TEMP\package_downloaded" -DestinationPath $ExtractPath -Force
421+
Write-Host "Package downloaded and extracted to $ExtractPath"
422+
423+
Get-ChildItem -Path $ExtractPath
424+
425+
# - name: Install Habitat Package under test (example core/nginx on MacOS and Linux)
426+
# run: |
427+
# PACKAGE="${{ inputs.publish-habitat-hab_package }}"
428+
# if [ -n "${{ inputs.publish-habitat-hab_version }}" ]; then
429+
# PACKAGE="${PACKAGE}/${{ inputs.publish-habitat-hab_version }}"
430+
# fi
431+
# if [ -n "${{ inputs.publish-habitat-hab_release }}" ]; then
432+
# PACKAGE="${PACKAGE}/${{ inputs.publish-habitat-hab_release }}"
433+
# fi
434+
435+
# INSTALL_CMD="sudo hab pkg install ${PACKAGE}"
436+
437+
# if [ -n "${{ inputs.publish-habitat-hab_channel }}" ]; then
438+
# INSTALL_CMD="${INSTALL_CMD} --channel ${{ inputs.publish-habitat-hab_channel }}"
439+
# fi
440+
441+
# AUTH_TOKEN="${{ inputs.publish-habitat-hab_auth_token }}"
442+
# if [ -z "${AUTH_TOKEN}" ]; then
443+
# AUTH_TOKEN="${{ secrets.HAB_PUBLIC_BLDR_PAT }}"
444+
# echo "Using token from repository secret"
445+
# else
446+
# echo "Using token from workflow input"
447+
# fi
448+
# # if [ -n "${AUTH_TOKEN}" ]; then
449+
# # INSTALL_CMD="${INSTALL_CMD} --auth ${AUTH_TOKEN}"
450+
# # fi
451+
452+
# echo "Installing: ${INSTALL_CMD}"
453+
# eval ${INSTALL_CMD}
454+
455+
- name: Run Grype scan on extracted directory
456+
timeout-minutes: 15 # Sets a 15-minute timeout for this specific step
457+
run: |
458+
$ExtractPath = "$env:TEMP\extracted_packages"
459+
460+
# run grype in runner
461+
grype dir:$ExtractPath --name ${{ inputs.product }}
462+
463+
# run grype to output to file (which is uploaded to the job as an artifact)
464+
$OutputFile = "grype-results-windows-${{ env.FILE_PREFIX }}.txt"
465+
$OutputFile = $OutputFile -replace '/', '-'
466+
Write-Host $OutputFile
467+
grype dir:$ExtractPath --name ${{ inputs.product }} | Out-File -FilePath $OutputFile -Encoding utf8
468+
echo "OUTPUT_FILE=$OutputFile" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
469+
470+
# - name: Run Grype Scan on Habitat Package (Windows)
471+
# timeout-minutes: 15 # Sets a 15-minute timeout for this specific step
472+
# run: |
473+
# # Find the installed package path. 'hab pkg path' returns the path to the latest installed version.
474+
# $PkgPath = hab pkg path ${{ inputs.publish-habitat-hab_package }}
475+
# # run grype in runner
476+
# grype dir:$PkgPath --name ${{ inputs.publish-habitat-hab_package }}
477+
# # run grype to output to file (which is uploaded to the job as an artifact)
478+
# $OutputFile = "grype-results-windows-${{ inputs.publish-habitat-hab_package }}.txt"
479+
# $OutputFile = $OutputFile -replace '/', '-'
480+
# Write-Host $OutputFile
481+
# grype dir:$PkgPath --name ${{ inputs.publish-habitat-hab_package }} | Out-File -FilePath $OutputFile -Encoding utf8
482+
# echo "OUTPUT_FILE=$OutputFile" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
483+
484+
- name: Upload Grype Scan Results
485+
uses: actions/upload-artifact@v4
486+
with:
487+
name: ${{ env.OUTPUT_FILE }}
488+
path: ${{ env.OUTPUT_FILE }}
489+
490+
# --- IGNORE ---
362491

363492
# habitat-grype-scan-windows:
364493
# name: 'Grype scan of Habitat packages (Windows)'
@@ -395,28 +524,6 @@ jobs:
395524
# New-Item -ItemType Directory -Force -Path "C:\hab\accepted-licenses"
396525
# New-Item -ItemType File -Force -Path "C:\hab\accepted-licenses\habitat"
397526

398-
# - name: Install Grype (Windows)
399-
# continue-on-error: true
400-
# run: |
401-
# $ErrorActionPreference = 'Stop'
402-
# # Download and install Grype for Windows
403-
# $grypeVersion = (Invoke-RestMethod -Uri "https://api.github.com/repos/anchore/grype/releases/latest").tag_name
404-
# $grypeUrl = "https://github.com/anchore/grype/releases/download/$grypeVersion/grype_$($grypeVersion.TrimStart('v'))_windows_amd64.zip"
405-
# $grypeZip = "$env:TEMP\grype.zip"
406-
# $grypeDir = "$env:TEMP\grype"
407-
408-
# # Download Grype
409-
# Invoke-WebRequest -Uri $grypeUrl -OutFile $grypeZip
410-
411-
# # Extract Grype
412-
# Expand-Archive -Path $grypeZip -DestinationPath $grypeDir -Force
413-
414-
# # Add Grype to PATH for subsequent steps
415-
# echo "$grypeDir" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
416-
417-
# # Verify installation
418-
# & "$grypeDir\grype.exe" version
419-
420527
# - name: Install Habitat Package under test (Windows)
421528
# run: |
422529
# $Package = "${{ inputs.publish-habitat-hab_package }}"
@@ -446,23 +553,3 @@ jobs:
446553

447554
# Write-Host "Installing: ${InstallCmd}"
448555
# Invoke-Expression $InstallCmd
449-
450-
# - name: Run Grype Scan on Habitat Package (Windows)
451-
# timeout-minutes: 15 # Sets a 15-minute timeout for this specific step
452-
# run: |
453-
# # Find the installed package path. 'hab pkg path' returns the path to the latest installed version.
454-
# $PkgPath = hab pkg path ${{ inputs.publish-habitat-hab_package }}
455-
# # run grype in runner
456-
# grype dir:$PkgPath --name ${{ inputs.publish-habitat-hab_package }}
457-
# # run grype to output to file (which is uploaded to the job as an artifact)
458-
# $OutputFile = "grype-results-windows-${{ inputs.publish-habitat-hab_package }}.txt"
459-
# $OutputFile = $OutputFile -replace '/', '-'
460-
# Write-Host $OutputFile
461-
# grype dir:$PkgPath --name ${{ inputs.publish-habitat-hab_package }} | Out-File -FilePath $OutputFile -Encoding utf8
462-
# echo "OUTPUT_FILE=$OutputFile" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
463-
464-
# - name: Upload Grype Scan Results
465-
# uses: actions/upload-artifact@v4
466-
# with:
467-
# name: grype-results-windows-${{ env.OUTPUT_FILE }}
468-
# path: ${{ env.OUTPUT_FILE }}

0 commit comments

Comments
 (0)