dash0-lambda-extension/.github/workflows/security.yml at master · dash0hq/dash0-lambda-extension · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
name: Security Scan

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  scan-rust:
    name: Scan Rust (extension binary)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    env:
      CARGO_TERM_COLOR: always
    steps:
      - uses: actions/checkout@v5
      - uses: dtolnay/rust-toolchain@stable
        with:
          targets: x86_64-unknown-linux-musl
      - uses: Swatinem/rust-cache@v2
      - name: Install musl tools and cargo-auditable
        run: |
          sudo apt-get install -y musl-tools
          cargo install cargo-auditable
      - name: Build shipped binary with auditable metadata
        run: cargo auditable build --release --target x86_64-unknown-linux-musl
      - name: Install Grype
        run: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
      - name: Scan and annotate
        id: scan
        run: |
          TARGET=target/x86_64-unknown-linux-musl/release/aws-lambda-runtime-api-proxy-rs
          grype "$TARGET" --output sarif=results.sarif --output json=grype.json || true
          .github/scripts/grype-annotate.sh grype.json "Rust (extension binary)"
          grype "$TARGET" --fail-on high --quiet 2>/dev/null
#      - name: Upload SARIF
#        if: always()
#        uses: github/codeql-action/upload-sarif@v4
#        with:
#          sarif_file: results.sarif
#          category: rust

  scan-python:
    name: Scan Python distro (installed packages)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
      - name: Build Python deps image and extract installed packages
        run: |
          docker build -t dash0-python-deps -f opt/python/Dockerfile .
          cid=$(docker create dash0-python-deps)
          mkdir -p build
          docker cp "$cid":/asset-output/python build/python
          docker rm "$cid"
      - name: Install Grype
        run: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
      - name: Scan and annotate
        id: scan
        run: |
          grype build/python --output sarif=results.sarif --output json=grype.json || true
          .github/scripts/grype-annotate.sh grype.json "Python distro"
          grype build/python --fail-on high --quiet 2>/dev/null
#      - name: Upload SARIF
#        if: always()
#        uses: github/codeql-action/upload-sarif@v4
#        with:
#          sarif_file: results.sarif
#          category: python

  scan-node:
    name: Scan Node.js distro (shipped modules)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - name: Build AWS SDK tarball
        run: bash opt/node/scripts/build-aws-sdk-tarball.sh
      - name: Install dependencies and build bundle
        working-directory: opt/node
        run: npm install && npm run build
      - name: Assemble shipped node_modules (mirrors Makefile)
        run: |
          mkdir -p build/stage-node/node_modules
          for pkg in \
            require-in-the-middle \
            import-in-the-middle \
            module-details-from-path \
            debug \
            ms \
            acorn \
            cjs-module-lexer; do
            cp -r "opt/node/node_modules/$pkg" build/stage-node/node_modules/
          done
          cp -r opt/node/node_modules/acorn-import-attributes build/stage-node/node_modules/ 2>/dev/null || true
          cp opt/node/dist/init.mjs build/stage-node/
      - name: Install Grype
        run: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
      - name: Scan and annotate
        id: scan
        run: |
          grype build/stage-node --output sarif=results.sarif --output json=grype.json || true
          .github/scripts/grype-annotate.sh grype.json "Node.js distro"
          grype build/stage-node --fail-on high --quiet 2>/dev/null
#      - name: Upload SARIF
#        if: always()
#        uses: github/codeql-action/upload-sarif@v4
#        with:
#          sarif_file: results.sarif
#          category: node

  scan-java:
    name: Scan Java distro (assembled JAR)
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'
      - name: Build Java distro JAR
        working-directory: opt/java/opentelemetry-java-distro
        run: ./gradlew clean -Pversion=1.0.0-SNAPSHOT assemble -x javadoc
      - name: Install Grype
        run: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
      - name: Scan and annotate
        id: scan
        run: |
          LIBS=opt/java/opentelemetry-java-distro/agent/build/libs
          grype "$LIBS" --output sarif=results.sarif --output json=grype.json || true
          .github/scripts/grype-annotate.sh grype.json "Java distro"
          grype "$LIBS" --fail-on high --quiet 2>/dev/null
#      - name: Upload SARIF
#        if: always()
#        uses: github/codeql-action/upload-sarif@v4
#        with:
#          sarif_file: results.sarif
#          category: java