Skip to content
Checks

Test that a failing scan can still be merged (rule is in evaluate mode) #3

Sign in to view logs

Test that a failing scan can still be merged (rule is in evaluate mode)

Test that a failing scan can still be merged (rule is in evaluate mode) #3

Workflow file for this run

google/osv-scanner/.github/workflows/checks.yml at b32306c3ef9c4fdb3249746982723c7dcd10c2b8
# Copyright 2021 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Checks
on:
push:
branches: ["main", "v1", "mcp"]
pull_request:
# The branches below must be a subset of the branches above
branches: ["main", "v1", "mcp"]
workflow_dispatch:
concurrency:
# Pushing new changes to a branch will cancel any in-progress CI runs
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
# Restrict jobs in this workflow to have no permissions by default; permissions
# should be granted per job as needed using a dedicated `permissions` block
permissions: {}
jobs:
ensure_snapshots_are_being_cleaned:
permissions:
contents: read # to fetch code (actions/checkout)
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- run: scripts/report_uncleaned_snapshots.py
filenames:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- run: |
find . -mindepth 1 ! -regex '.*/[#@A-Za-z0-9._-]*' -print0 \
| xargs -0 -I{} bash -c \
'printf "::error file=%q::This filename contains undesired characters\n" "$1" && false' _ {}
format:
permissions:
contents: read # to fetch code (actions/checkout)
name: prettier
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Run format action
uses: ./.github/workflows/format-action
tidy:
permissions:
contents: read # to fetch code (actions/checkout)
name: go mod tidy
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
with:
go-version: stable
check-latest: true
- run: go mod tidy -diff
lint:
permissions:
contents: read # to fetch code (actions/checkout)
name: golangci-lint
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
with:
go-version: stable
check-latest: true
- name: Run lint action
uses: ./.github/workflows/lint-action
prepare_test_image_testdata:
permissions:
contents: read # to fetch code (actions/checkout)
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- run: scripts/build_test_images.sh
- uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
with:
name: image-testdata-${{ github.run_number }}-${{ github.run_attempt }}
path: cmd/osv-scanner/scan/image/testdata/*.tar
retention-days: 1
tests:
permissions:
contents: read # to fetch code (actions/checkout)
needs:
- prepare_test_image_testdata
name: Run unit tests
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, macos-latest, windows-latest]
runs-on: ${{ matrix.os }}
steps:
- name: Check out code
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
- uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
with:
name: image-testdata-${{ github.run_number }}-${{ github.run_attempt }}
path: cmd/osv-scanner/scan/image/testdata/
- name: Set up Go
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
with:
go-version: stable
check-latest: true
- name: Run test action
uses: ./.github/workflows/test-action
with:
codecov_token: ${{ secrets.CODECOV_TOKEN }}
docker:
permissions:
contents: read # to fetch code (actions/checkout)
runs-on: ubuntu-latest
env:
# Required for buildx on docker 19.x
DOCKER_CLI_EXPERIMENTAL: "enabled"
steps:
- name: Checkout
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
fetch-depth: 0
- name: Set up Go
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
with:
go-version: stable
check-latest: true
- uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
- name: Run GoReleaser
id: run-goreleaser
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
with:
distribution: goreleaser
version: "~> v2"
args: release --clean --snapshot
- run: |
echo '${{ steps.run-goreleaser.outputs.artifacts }}' > output.json
jq -r '.[] | select(
.type == "Docker Image" and
.goarch == "amd64" and
.goos == "linux" and
.extra.DockerConfig.dockerfile == "goreleaser.dockerfile"
) | .name' output.json | while read -r image; do
echo "Testing image $image"
exit_code=0
docker run -v ${PWD}:/src $image -L /src/go.mod || exit_code=$?
# fail if we get a non-zero exit code other than "vulnerabilities were found"
if [[ $exit_code -ne 0 && $exit_code -ne 1 ]]; then
exit $exit_code
fi
done