Skip to content

Commit 5436687

Browse files
bleggettbleggett
authored
Add CI actions (#5)
* ad actions * lints * fixup
1 parent 46eee7a commit 5436687

15 files changed

Lines changed: 206 additions & 36 deletions

File tree

‎.github/actions/install-llvm/action.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: 'Install LLVM Dependencies'
2+
description: 'Install LLVM and Clang dependencies'
3+
runs:
4+
using: composite
5+
steps:
6+
- name: Install llvm deps
7+
shell: bash
8+
run: |
9+
sudo apt-get update
10+
sudo apt-get install -y clang cmake build-essential llvm-dev libclang-dev

‎.github/dependabot.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
version: 2
2+
updates:
3+
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
cooldown:
9+
default-days: 7
10+
groups:
11+
actions-updates:
12+
dependency-type: "production"
13+
applies-to: "version-updates"
14+
actions-dev-updates:
15+
dependency-type: "development"
16+
applies-to: "version-updates"
17+
18+
- package-ecosystem: "cargo"
19+
directory: "/"
20+
schedule:
21+
interval: "daily"
22+
cooldown:
23+
default-days: 7
24+
groups:
25+
cargo-updates:
26+
dependency-type: "production"
27+
applies-to: "version-updates"
28+
cargo-dev-updates:
29+
dependency-type: "development"
30+
applies-to: "version-updates"

‎.github/workflows/ci-actions.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions:
10+
contents: read # Default token to read
11+
12+
jobs:
13+
zizmor:
14+
name: zizmor latest via PyPI
15+
runs-on: ubuntu-latest
16+
permissions:
17+
security-events: write # Needed to write security events to github
18+
contents: read # Needed to read clone repo
19+
actions: read # Needed to read actions
20+
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout repository
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
persist-credentials: false
30+
31+
- name: Install the latest version of uv
32+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
33+
34+
- name: Run zizmor
35+
run: uvx zizmor --pedantic --format sarif . > results.sarif
36+
env:
37+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
39+
- name: Upload SARIF file
40+
uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
41+
with:
42+
sarif_file: results.sarif
43+
category: zizmor

‎.github/workflows/ci-code.yaml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Lint and Test Code
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- src/**
9+
- Cargo.*
10+
- rust-toolchain.toml
11+
- .github/workflows/ci-code.yaml
12+
13+
permissions:
14+
contents: read # Default token to read
15+
16+
jobs:
17+
rustfmt:
18+
name: rustfmt
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: harden runner
22+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
23+
with:
24+
egress-policy: audit
25+
26+
- name: checkout repository
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
submodules: recursive
30+
persist-credentials: false
31+
32+
- name: Install llvm deps
33+
uses: ./.github/actions/install-llvm
34+
35+
- name: 'cargo fmt'
36+
run: cargo fmt --all -- --check
37+
38+
full-build:
39+
runs-on: ubuntu-latest
40+
strategy:
41+
fail-fast: false
42+
matrix:
43+
arch:
44+
- x86_64
45+
env:
46+
TARGET_ARCH: "${{ matrix.arch }}"
47+
name: 'Full build linux-${{ matrix.arch }}'
48+
steps:
49+
- name: harden runner
50+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
51+
with:
52+
egress-policy: audit
53+
54+
- name: checkout repository
55+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
56+
with:
57+
submodules: recursive
58+
persist-credentials: false
59+
60+
- name: Install llvm deps
61+
uses: ./.github/actions/install-llvm
62+
63+
- name: cargo build
64+
run: cargo build
65+
66+
clippy:
67+
runs-on: ubuntu-latest
68+
strategy:
69+
matrix:
70+
arch:
71+
- x86_64
72+
env:
73+
TARGET_ARCH: "${{ matrix.arch }}"
74+
name: 'Full clippy linux-${{ matrix.arch }}'
75+
steps:
76+
- name: harden runner
77+
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
78+
with:
79+
egress-policy: audit
80+
81+
- name: checkout repository
82+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
83+
with:
84+
submodules: recursive
85+
persist-credentials: false
86+
87+
- name: Install llvm deps
88+
uses: ./.github/actions/install-llvm
89+
90+
- name: 'cargo clippy'
91+
run: cargo clippy

‎src/base_plugin/mod.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
use crate::proto::generated::protect::control::v1::{
2+
ZoneKernelFdInfo, ZoneKernelSyscallEvent, ZoneKernelThreadInfo,
3+
zone_kernel_fd_info_data::InfoType,
4+
};
15
use anyhow::{Error, Result, anyhow};
26
use dns_lookup::lookup_addr;
37
use falco_event::events::Event;
@@ -14,10 +18,6 @@ use libscap_bindings::types::{
1418
};
1519
use log::info;
1620
use prost::Message;
17-
use crate::proto::generated::protect::control::v1::{
18-
ZoneKernelFdInfo, ZoneKernelSyscallEvent, ZoneKernelThreadInfo,
19-
zone_kernel_fd_info_data::InfoType,
20-
};
2121
use std::collections::{HashMap, HashSet};
2222
use std::ffi::{CStr, CString};
2323
use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};

‎src/lib.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ mod base_plugin;
22
mod extract_plugin;
33
mod parse_plugin;
44
mod parsers;
5+
mod proto;
56
mod source_plugin;
67
mod threadstate;
7-
mod proto;
88

99
use falco_plugin::{extract_plugin, parse_plugin, plugin, source_plugin};
1010

‎src/parse_plugin/mod.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1+
use crate::proto::generated::protect::control::v1::ZoneKernelSyscallEvent;
12
use anyhow::Result;
23
use falco_event::events::Event;
34
use falco_plugin::parse::{EventInput as ParseEventInput, ParseInput, ParsePlugin};
45
use falco_plugin::source::PluginEvent;
56
use log::{debug, error, warn};
67
use prost::Message;
7-
use crate::proto::generated::protect::control::v1::ZoneKernelSyscallEvent;
88

99
use crate::{EderaPlugin, threadstate};
1010

‎src/parsers.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1+
use crate::proto::generated::protect::control::v1::ZoneKernelFdInfo;
2+
use crate::proto::generated::protect::control::v1::{
3+
ZoneKernelSyscallEvent, ZoneKernelThreadInfo, zone_kernel_fd_info_data::InfoType,
4+
};
15
use anyhow::{Result, anyhow};
26
use libscap_bindings::consts as ppm_consts;
37
use libscap_bindings::types::{
48
ppm_event_code as event_codes, ppm_event_flags as event_flags, scap_l4_proto as l4_types,
59
};
610
use log::error;
7-
use crate::proto::generated::protect::control::v1::ZoneKernelFdInfo;
8-
use crate::proto::generated::protect::control::v1::{
9-
ZoneKernelSyscallEvent, ZoneKernelThreadInfo, zone_kernel_fd_info_data::InfoType,
10-
};
1111
use std::ffi::CStr;
1212
use std::fs::File;
1313
use std::io::{BufRead, BufReader};

‎src/source_plugin/client/edera_client/client.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
use super::dial::ControlDialAddress;
22
#[cfg(unix)]
33
use super::unix::HyperUnixConnector;
4-
use anyhow::{Result, bail};
4+
use crate::proto::generated::protect::control::v1::control_service_client::ControlServiceClient;
55
#[cfg(not(unix))]
66
use anyhow::anyhow;
7-
use crate::proto::generated::protect::control::v1::control_service_client::ControlServiceClient;
7+
use anyhow::{Result, bail};
88
use tonic::transport::{Channel, Endpoint};
99

1010
pub struct ControlClientProvider {}

‎src/source_plugin/client/edera_client/events.rs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
use std::{sync::Arc, time::Duration};
22

3-
use anyhow::Result;
4-
use log::{error, trace, warn};
53
use crate::proto::generated::protect::control::v1::{
64
WatchEventsReply, WatchEventsRequest, control_service_client::ControlServiceClient,
75
watch_events_reply::Event,
86
};
7+
use anyhow::Result;
8+
use log::{error, trace, warn};
99
use tokio::{sync::broadcast, task::JoinHandle, time::sleep};
1010
use tokio_stream::StreamExt;
1111
use tonic::{Streaming, transport::Channel};

0 commit comments

Comments
 (0)