Collate scan results in add-on metadata #6411
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -234,15 +234,16 @@ jobs: | |
| VT_API_LIMIT: ${{ vars.VT_API_LIMIT }} | ||
| outputs: | ||
| vtScanUrl: ${{ steps.setVirusTotalAnalysisStatus.outputs.vtScanUrl }} | ||
| vtResultsJSON: ${{ steps.setVirusTotalAnalysisStatus.outputs.vtResults }} | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ env.branchName }} | ||
| - name: Install Node.js | ||
| uses: actions/setup-node@v4 | ||
| - name: Install npm dependencies | ||
| run: npm install uuid | ||
| - name: Install virusTotal | ||
| run: choco install vt-cli | ||
| - name: Set Virus Total analysis status | ||
|
|
@@ -252,22 +253,6 @@ jobs: | |
| script: | | ||
| const setVirusTotalAnalysisStatus = require('./.github/workflows/virusTotalAnalysis.js') | ||
| setVirusTotalAnalysisStatus({core}, ["${{ needs.getAddonId.outputs.addonFileName }}"]) | ||
| - name: Warn if analysis fails | ||
| if: failure() | ||
| uses: peter-evans/create-or-update-comment@v4 | ||
|
|
@@ -286,47 +271,53 @@ jobs: | |
| addonFileName: ${{ needs.getAddonId.outputs.addonFileName }} | ||
| branchName: ${{ inputs.issueAuthorName }}${{ inputs.issueNumber }} | ||
|
|
||
| commitScanResults: | ||
| needs: [getAddonId, virusTotal-analysis, codeQL-analysis] | ||
| if: ${{ always() }} | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ env.branchName }} | ||
| - name: Collate analysis results into add-on metadata | ||
| run: | | ||
| jq --argjson codeQLWarnings '${{ needs.codeQL-analysis.outputs.warningsJSON }}' \ | ||
| --argjson codeQLErrors '${{ needs.codeQL-analysis.outputs.errorsJSON }}' \ | ||
| --argjson vtResults '${{ needs.virusTotal-analysis.outputs.vtResultsJSON }}' \ | ||
| --arg vtScanUrl '${{ needs.virusTotal-analysis.outputs.vtScanUrl }}' \ | ||
| '. + { | ||
| vtScanUrl: $vtScanUrl, | ||
| scanResults: { | ||
| "codeQL-warnings": $codeQLWarnings, | ||
| "codeQL-errors": $codeQLErrors, | ||
| "virusTotal": $vtResults | ||
| } | ||
| }' \ | ||
| ${{ needs.getAddonId.outputs.addonFileName }} > tmp.json | ||
| mv tmp.json ${{ needs.getAddonId.outputs.addonFileName }} | ||
| - name: Commit add-on metadata | ||
| run: | | ||
| git add ${{ needs.getAddonId.outputs.addonFileName }} | ||
| git config user.name "github-actions" | ||
| git config user.email "[email protected]" | ||
| git commit -m "Add code analysis results" | ||
| git push --set-upstream origin ${{ env.branchName }} | ||
|
|
||
| requireManualApproval: | ||
| needs: [commitScanResults, virusTotal-analysis, codeQL-analysis] | ||
| if: ${{ always() && (needs.virusTotal-analysis.result == 'failure' || needs.codeQL-analysis.result == 'failure') }} | ||
| runs-on: ubuntu-latest | ||
| environment: | ||
| # Require a manual deployment approval if security analysis fails | ||
| name: securityReview | ||
| steps: | ||
| - name: Confirm approval | ||
| run: echo "Manual approval performed" | ||
|
|
||
| mergeToMaster: | ||
| needs: [getAddonId, commitScanResults, createPullRequest, requireManualApproval] | ||
| if: ${{ always() && needs.commitScanResults.result == 'success' && (needs.requireManualApproval.result == 'success' || needs.requireManualApproval.result == 'skipped') }} | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
|
|
@@ -445,7 +436,6 @@ jobs: | |
| git add . | ||
| git commit -m "update discussion URL" | ||
| git branch -u origin/master | ||
| git push | ||
|
|
||
| call-workflow: | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,28 +1,13 @@ | ||
| module.exports = ({core}, resultsPath) => { | ||
| const fs = require('fs'); | ||
| const contents = fs.readFileSync(resultsPath); | ||
| const data = JSON.parse(contents); | ||
| const runs = data.runs[0]; | ||
| const results = runs.results; | ||
| core.setOutput("codeQLResults", results); | ||
| if (results.length === 0) { | ||
| core.info("Security analysis succeeded"); | ||
| } else { | ||
| core.setFailed("Security analysis failed"); | ||
| } | ||
| }; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| name: Scan a batch of add-ons | ||
|
|
||
| on: | ||
| # Every day at 6pm UTC. | ||
|
|
@@ -11,20 +11,19 @@ on: | |
| - cron: '0 18 * * *' | ||
| workflow_dispatch: | ||
|
|
||
| env: | ||
| BRANCH_NAME: addScanResults${{ github.run_number }} | ||
|
|
||
| jobs: | ||
| virusTotal-analysis: | ||
| runs-on: windows-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| env: | ||
| VT_API_KEY: ${{ secrets.VT_API_KEY }} | ||
| VT_API_LIMIT: ${{ vars.VT_API_LIMIT }} | ||
| BATCH_SIZE: 10 | ||
|
There was a problem hiding this comment. temporarily adjusted for testing, we can probably up this to 300 once testing is complete |
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
|
|
@@ -38,16 +37,16 @@ jobs: | |
| - name: Install Node.js | ||
| uses: actions/setup-node@v4 | ||
| - name: Install npm dependencies | ||
| run: npm install uuid | ||
| - name: Get add-on filenames without scan results | ||
| shell: bash | ||
| run: | | ||
| for file in ./addons/*/*.json; do | ||
| if (jq -r '.scanResults.virusTotal' "$file" | grep -q '^null\|""$'); then | ||
| echo "$file" >> addonsWithoutVT.txt | ||
| fi | ||
| done | ||
| wc -l addonsWithoutVT.txt | awk '{print "Total add-ons without scan results: " $1}' | ||
| - name: Set Virus Total analysis status | ||
| id: setVirusTotalAnalysisStatus | ||
| uses: actions/github-script@v7 | ||
|
|
@@ -57,35 +56,36 @@ jobs: | |
| const fs = require('fs') | ||
| const addonsWithoutVT = fs.readFileSync('addonsWithoutVT.txt', 'utf-8').split('\n').filter(Boolean) | ||
| setVirusTotalAnalysisStatus({core}, addonsWithoutVT.slice(0, ${{ env.BATCH_SIZE }})) | ||
| - name: Push updated VT urls | ||
| shell: bash | ||
| run: | | ||
| git add addons | ||
| git config user.name "github-actions" | ||
| git config user.email "[email protected]" | ||
| git commit -m "Add VirusTotal results" | ||
| git push --set-upstream origin ${{ env.BRANCH_NAME }} | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
|
|
||
| pull-request: | ||
| needs: virusTotal-analysis | ||
| runs-on: windows-latest | ||
| permissions: | ||
| contents: write | ||
| pull-requests: write | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v5 | ||
| with: | ||
| ref: ${{ env.BRANCH_NAME }} | ||
| - name: Open pr and merge | ||
| shell: bash | ||
| run: | | ||
| gh pr create \ | ||
| --title "Add scanning results" \ | ||
| --base ${{ github.ref }} \ | ||
| --head ${{ env.BRANCH_NAME }} \ | ||
| --body "Add scanning results to add-ons" | ||
| gh pr merge --merge "${{ env.BRANCH_NAME }}" | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.