ROX-21124: Move non-e2e testing OSCI jobs to GitHub Actions #1
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| types: | |
| - opened | |
| - reopened | |
| - synchronize | |
| jobs: | |
| scanner-build: | |
| runs-on: ubuntu-latest | |
| container: | |
| image: quay.io/stackrox-io/apollo-ci:scanner-test-0.3.61 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: genesis-dump | |
| run: | | |
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| info() { echo "INFO: $(date): $*" } | |
| generate_genesis_dump() { | |
| info "Building updater" | |
| make build-updater | |
| info "Generating genesis dump" | |
| mkdir -p /tmp/genesis-dump | |
| "$ROOT/bin/updater" generate-dump --out-file /tmp/genesis-dump/genesis-dump.zip | |
| ls -lrt /tmp/genesis-dump | |
| info "Printing some stats" | |
| "$ROOT/bin/updater" print-stats /tmp/genesis-dump/genesis-dump.zip | |
| info "Extracting dumps" | |
| mkdir -p /tmp/vuln-dump | |
| zip /tmp/genesis-dump/genesis-dump.zip 'nvd/*' --copy --out /tmp/vuln-dump/nvd-definitions.zip | |
| zip /tmp/genesis-dump/genesis-dump.zip 'k8s/*' --copy --out /tmp/vuln-dump/k8s-definitions.zip | |
| zip /tmp/genesis-dump/genesis-dump.zip 'istio/*' --copy --out /tmp/vuln-dump/istio-definitions.zip | |
| zip /tmp/genesis-dump/genesis-dump.zip 'rhelv2/repository-to-cpe.json' --copy --out /tmp/vuln-dump/repo2cpe.zip | |
| } | |
| generate_genesis_dump | |
| - name: build-bundle | |
| run: | | |
| #!/usr/bin/env bash | |
| set -euo pipefail | |
| info() { echo "INFO: $(date): $*" } | |
| cleanup_image() { | |
| info "Reducing the image size" | |
| set +e | |
| rm -rf /go/{bin,pkg} | |
| rm -rf /root/{.cache,.npm} | |
| rm -rf /usr/local/share/.cache | |
| rm -rf .git | |
| rm -rf "$ROOT/image/scanner/bin" | |
| rm -rf "$ROOT/image/scanner/rhel/THIRD_PARTY_NOTICES" | |
| set -e | |
| } | |
| get_genesis_dump() { | |
| info "Retrieving Genesis dump" | |
| ls -lrt /tmp/vuln-dump || info "No local genesis dump" | |
| if is_in_PR_context && ! pr_has_label "generate-dumps-on-pr"; then | |
| info "Label generate-dumps-on-pr not set. Pulling dumps from GCS bucket" | |
| mkdir -p /tmp/vuln-dump | |
| gsutil cp gs://stackrox-scanner-ci-vuln-dump/nvd-definitions.zip /tmp/vuln-dump/nvd-definitions.zip | |
| gsutil cp gs://stackrox-scanner-ci-vuln-dump/k8s-definitions.zip /tmp/vuln-dump/k8s-definitions.zip | |
| gsutil cp gs://stackrox-scanner-ci-vuln-dump/istio-definitions.zip /tmp/vuln-dump/istio-definitions.zip | |
| gsutil cp gs://stackrox-scanner-ci-vuln-dump/repo2cpe.zip /tmp/vuln-dump/repo2cpe.zip | |
| fi | |
| unzip -d "$ROOT/image/scanner/dump" /tmp/vuln-dump/nvd-definitions.zip | |
| unzip -d "$ROOT/image/scanner/dump" /tmp/vuln-dump/k8s-definitions.zip | |
| unzip -d "$ROOT/image/scanner/dump" /tmp/vuln-dump/istio-definitions.zip | |
| unzip -d "$ROOT/image/scanner/dump" /tmp/vuln-dump/repo2cpe.zip | |
| } | |
| build_bundle() { | |
| # avoid a -dirty tag | |
| info "Reset to remove Dockerfile modification by OpenShift CI" | |
| git restore . | |
| git status | |
| info "Building Scanner binary" | |
| make scanner-build-nodeps | |
| info "Making THIRD_PARTY_NOTICES" | |
| make ossls-notice | |
| get_genesis_dump | |
| info "Creating Scanner bundle" | |
| "$ROOT/image/scanner/rhel/create-bundle.sh" "$ROOT/image/scanner" "$ROOT/image/scanner/rhel" | |
| cleanup_image | |
| } | |
| build_bundle |