Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Build Github worfklow with OSV scanner #1107

Closed
bossenti opened this issue Jan 16, 2023 · 7 comments · Fixed by #1438
Closed

Build Github worfklow with OSV scanner #1107

bossenti opened this issue Jan 16, 2023 · 7 comments · Fixed by #1438
Assignees
@Kshitiz-Mhto
Labels
enhancement New feature or request gh-actions Pull requests that update GitHub Actions code good first issue Good for newcomers
Milestone
0.92.0

Comments

@bossenti
Copy link
Contributor

Body

Build a GitHub wofkflow that applies Google's OSV scanner on a monthly(?) schedule on our repository.
This tool scans dependencies for vulnerabilities.
Open for discussion is how the output of the scan can be reported or displayed.

Mentoring

As this ticket is marked as good first issue: one of @dominikriemer, @tenthe, or @bossenti are happy to provide help for getting started, just tag (one of) them if you want to start working on this issue and need some help.

StreamPipes Committer

I acknowledge that I am a maintainer/committer of the Apache StreamPipes project.
@bossenti bossenti added enhancement New feature or request good first issue Good for newcomers gh-actions Pull requests that update GitHub Actions code labels Jan 16, 2023
@bossenti bossenti added this to the 1.0.0 milestone Jan 16, 2023
@Kshitiz-Mhto
Copy link
Contributor

@bossenti could you review it ? i just gave it a try, am i on the right track?
osv-scanner

@Kshitiz-Mhto
Copy link
Contributor

Kshitiz-Mhto commented Mar 18, 2023 •
edited
Loading

output:

osv-op

further, we could auto-commit the scan-result in maybe VULNERABILITY.md file throught gh-action also.

@bossenti
Copy link
Contributor Author

Hi @Kshitiz-Mhto,

thanks for working on this topic. I'll assign you to the issue to make it transparent.
In general, it looks good I guess.
The osv scanner should also be available as a Github Action, so no need to download it manually.

We've not yet thought about how to handle the findings of the scanner, but I think your idea of a VULNERABILITY.md sounds good to me. However, it should not directly get committed but a PR would be fine to raise the proper awareness

@bossenti
Copy link
Contributor Author

PS: It's more convenient for us to review code snippets if you just open an WIP PR.
Screenshots are not ideal to share code, especially when the changes affect more than one file 🙂

@Kshitiz-Mhto
Copy link
Contributor

Kshitiz-Mhto commented Mar 21, 2023 •
edited
Loading

i searched on the github market place i got only one result ie
check-with-osv-detector

there is no any official github action present in marketplace yet.

as from official github repo, it is still experimental
https://github.com/google/osv-scanner/blob/main/action.yml

OR,
we can go with using docker image of ghcr.io/google/osv-scanner:latest in gh-action

@Kshitiz-Mhto
Copy link
Contributor

Demo using docker image hcr.io/google/osv-scanner:latest (https://github.com/Kshitiz-Mhto/EPL-data-board/actions/runs/4482978960/jobs/7881694486)

@bossenti
Copy link
Contributor Author

Alright, then let's go with the docker image 🙂

@Kshitiz-Mhto Kshitiz-Mhto mentioned this issue Mar 22, 2023
Merged
bossenti pushed a commit that referenced this issue Apr 11, 2023
@Kshitiz-Mhto
#1107 Implementation of OSV-scanner with gh-action (#1438)
cb529cc 
* osv-scanner workflow is added

* added reviewer

* pull and specify the docker image

* undo the changes in pom.xml

* modified worflow not to include error in log file
flomickl pushed a commit that referenced this issue May 1, 2023
@Kshitiz-Mhto @flomickl
#1107 Implementation of OSV-scanner with gh-action (#1438)
fd3fbb7 
* osv-scanner workflow is added

* added reviewer

* pull and specify the docker image

* undo the changes in pom.xml

* modified worflow not to include error in log file
@bossenti bossenti modified the milestones: 1.0.0, 0.92.0 May 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@Kshitiz-Mhto Kshitiz-Mhto

Labels
enhancement New feature or request gh-actions Pull requests that update GitHub Actions code good first issue Good for newcomers
Projects
None yet
Milestone
0.92.0
Development

Successfully merging a pull request may close this issue.

#1107 Implementation of OSV-scanner with gh-action Kshitiz-Mhto/streampipes
2 participants
@bossenti @Kshitiz-Mhto