grails-core/.github/workflows/vulnerability-scan.yml at d1e8460ca0713af30170218e455188df47f3158c · apache/grails-core · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements.  See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License.  You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: "Vulnerability Scan"
on:
  push:
    branches:
      - '7.0.x'
      - '7.1.x'
      - '8.0.x'
  schedule:
    # Run every Monday at 03:00 UTC
    - cron: '0 3 * * 1'
  workflow_dispatch:
# Do not scan concurrently; OSS Index has per-account rate limits
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false
jobs:
  scan-grails-core:
    name: "OSS Index Scan - grails-core"
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      security-events: write
    steps:
      - name: "📥 Checkout repository"
        uses: actions/checkout@v6
      - name: "☕️ Setup JDK"
        uses: actions/setup-java@v4
        with:
          distribution: liberica
          java-version: 17
      - name: "🐘 Setup Gradle"
        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
        with:
          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      - name: "🔍 Run OSS Index Vulnerability Scan"
        env:
          SONATYPE_GUIDE_USERNAME: ${{ secrets.SONATYPE_GUIDE_USERNAME }}
          SONATYPE_GUIDE_TOKEN: ${{ secrets.SONATYPE_GUIDE_TOKEN }}
        continue-on-error: true
        id: scan
        run: ./gradlew ossIndexAudit --continue --info 2>&1 | tee /tmp/ossindex-scan.log; exit ${PIPESTATUS[0]}
      - name: "📋 Publish Vulnerability Summary"
        if: always()
        run: |
          echo "## 🔍 OSS Index Vulnerability Scan — grails-core" >> $GITHUB_STEP_SUMMARY
          if [ "${{ steps.scan.outcome }}" = "success" ]; then
            echo "✅ No vulnerabilities found." >> $GITHUB_STEP_SUMMARY
          else
            echo "❌ Vulnerabilities detected." >> $GITHUB_STEP_SUMMARY
            echo "" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
            awk '
              BEGIN { in_section=0; in_vuln=0 }
              { gsub(/\033\[[0-9;]*m/, "") }
              /^##\[ossIndexAudit:begin\]/ { in_section=1; next }
              /^##\[ossIndexAudit:end\]/ { in_section=0; in_vuln=0; next }
              !in_section { next }
              /^\[[0-9]+\/[0-9]+\] - pkg:maven\// {
                sub(/^\[[0-9]+\/[0-9]+\] - /, "")
                if (!seen_coord[$0]++) { print ""; print }
                next
              }
              /^   Vulnerability Title:/ { in_vuln=1; block=$0 "\n"; cve_id=""; next }
              in_vuln && /^   CVE:/ { match($0,/CVE-[0-9-]+/); if (RSTART) cve_id=substr($0,RSTART,RLENGTH); block=block $0 "\n"; next }
              in_vuln && /^   Reference:/ { block=block $0 "\n"; if (cve_id && !seen_cve[cve_id]++) printf "%s",block; in_vuln=0; next }
              in_vuln { block=block $0 "\n" }
            ' /tmp/ossindex-scan.log >> $GITHUB_STEP_SUMMARY \
              || echo "(no scan output captured — check the full log)" >> $GITHUB_STEP_SUMMARY
            echo '```' >> $GITHUB_STEP_SUMMARY
          fi