From 1c2046ce09faf481cd3c8f87e4128d5238355534 Mon Sep 17 00:00:00 2001 From: Noah Krause Date: Tue, 26 Mar 2024 17:28:42 -0400 Subject: [PATCH 1/3] fix: don't pass in a separate env. This makes it impossible to pass env vars via the action context to syft. Signed-off-by: Noah Krause --- src/github/SyftGithubAction.ts | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/github/SyftGithubAction.ts b/src/github/SyftGithubAction.ts index 45145c3b..14a51b22 100644 --- a/src/github/SyftGithubAction.ts +++ b/src/github/SyftGithubAction.ts @@ -108,17 +108,16 @@ async function executeSyft({ const cmd = await getSyftCommand(); - const env: { [key: string]: string } = { - SYFT_CHECK_FOR_APP_UPDATE: "false", - }; + + process.env.SYFT_CHECK_FOR_APP_UPDATE = "false" const registryUser = core.getInput("registry-username"); const registryPass = core.getInput("registry-password"); if (registryUser) { - env.SYFT_REGISTRY_AUTH_USERNAME = registryUser; + process.env.SYFT_REGISTRY_AUTH_USERNAME = registryUser; if (registryPass) { - env.SYFT_REGISTRY_AUTH_PASSWORD = registryPass; + process.env.SYFT_REGISTRY_AUTH_PASSWORD = registryPass; } else { core.warning( "WARNING: registry-username specified without registry-password" @@ -172,7 +171,6 @@ async function executeSyft({ const exitCode = await core.group("Executing Syft...", async () => execute(cmd, args, { - env, outStream, listeners: { stdout(buffer) { From e8909dca133291114aed52d1ea4ce4cc431218d3 Mon Sep 17 00:00:00 2001 From: Noah Krause Date: Wed, 27 Mar 2024 09:32:12 -0400 Subject: [PATCH 2/3] fix: pass current environment to the syft run Signed-off-by: Noah Krause --- dist/attachReleaseAssets/index.js | 4 +--- dist/downloadSyft/index.js | 4 +--- dist/runSyftAction/index.js | 4 +--- src/github/SyftGithubAction.ts | 11 +++++++---- 4 files changed, 10 insertions(+), 13 deletions(-) diff --git a/dist/attachReleaseAssets/index.js b/dist/attachReleaseAssets/index.js index abe221a6..674c47b5 100644 --- a/dist/attachReleaseAssets/index.js +++ b/dist/attachReleaseAssets/index.js @@ -24024,9 +24024,7 @@ function executeSyft(_a) { return __awaiter(this, void 0, void 0, function* () { let stdout = ""; const cmd = yield getSyftCommand(); - const env = { - SYFT_CHECK_FOR_APP_UPDATE: "false", - }; + const env = Object.assign(Object.assign({}, process.env), { SYFT_CHECK_FOR_APP_UPDATE: "false" }); const registryUser = core.getInput("registry-username"); const registryPass = core.getInput("registry-password"); if (registryUser) { diff --git a/dist/downloadSyft/index.js b/dist/downloadSyft/index.js index eaee8bd3..411f5feb 100644 --- a/dist/downloadSyft/index.js +++ b/dist/downloadSyft/index.js @@ -24072,9 +24072,7 @@ function executeSyft(_a) { return __awaiter(this, void 0, void 0, function* () { let stdout = ""; const cmd = yield getSyftCommand(); - const env = { - SYFT_CHECK_FOR_APP_UPDATE: "false", - }; + const env = Object.assign(Object.assign({}, process.env), { SYFT_CHECK_FOR_APP_UPDATE: "false" }); const registryUser = core.getInput("registry-username"); const registryPass = core.getInput("registry-password"); if (registryUser) { diff --git a/dist/runSyftAction/index.js b/dist/runSyftAction/index.js index b6936038..bdca9e0f 100644 --- a/dist/runSyftAction/index.js +++ b/dist/runSyftAction/index.js @@ -24024,9 +24024,7 @@ function executeSyft(_a) { return __awaiter(this, void 0, void 0, function* () { let stdout = ""; const cmd = yield getSyftCommand(); - const env = { - SYFT_CHECK_FOR_APP_UPDATE: "false", - }; + const env = Object.assign(Object.assign({}, process.env), { SYFT_CHECK_FOR_APP_UPDATE: "false" }); const registryUser = core.getInput("registry-username"); const registryPass = core.getInput("registry-password"); if (registryUser) { diff --git a/src/github/SyftGithubAction.ts b/src/github/SyftGithubAction.ts index 14a51b22..9c2daa40 100644 --- a/src/github/SyftGithubAction.ts +++ b/src/github/SyftGithubAction.ts @@ -108,16 +108,18 @@ async function executeSyft({ const cmd = await getSyftCommand(); - - process.env.SYFT_CHECK_FOR_APP_UPDATE = "false" + const env: { [key: string]: string } = { + ...process.env, + SYFT_CHECK_FOR_APP_UPDATE: "false", + }; const registryUser = core.getInput("registry-username"); const registryPass = core.getInput("registry-password"); if (registryUser) { - process.env.SYFT_REGISTRY_AUTH_USERNAME = registryUser; + env.SYFT_REGISTRY_AUTH_USERNAME = registryUser; if (registryPass) { - process.env.SYFT_REGISTRY_AUTH_PASSWORD = registryPass; + env.SYFT_REGISTRY_AUTH_PASSWORD = registryPass; } else { core.warning( "WARNING: registry-username specified without registry-password" @@ -171,6 +173,7 @@ async function executeSyft({ const exitCode = await core.group("Executing Syft...", async () => execute(cmd, args, { + env, outStream, listeners: { stdout(buffer) { From 529273392ded4017e95051317beaebae2ea4e77b Mon Sep 17 00:00:00 2001 From: Noah Krause Date: Wed, 27 Mar 2024 09:36:56 -0400 Subject: [PATCH 3/3] chore: add a small note about updating `dist/` Signed-off-by: Noah Krause --- DEVELOPING.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/DEVELOPING.md b/DEVELOPING.md index 91a3b33c..ba6a44ef 100644 --- a/DEVELOPING.md +++ b/DEVELOPING.md @@ -8,6 +8,10 @@ If you would like to get more extensive debug logging, it is possible to enable this as [described here](https://github.com/actions/toolkit/blob/master/docs/action-debugging.md) by setting a secret in your repository of `ACTIONS_STEP_DEBUG` to `true`. +## Update `dist/` + +Updates to `dist/` and handled via a commit hook. Install the hook by running `npm install`. + ## Tests To run tests locally, you will need a local docker instance and registry along with a few