Skip to content

Commit 2e2e248

Browse files
kishore7snehilkishore7snehil
authored
Adding Reversing Lab Scanner (#198)
1 parent 313e3b5 commit 2e2e248

File tree

12 files changed

+442
-23
lines changed

12 files changed

+442
-23
lines changed

‎.github/actions/get-prerelease/action.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Return a boolean indicating if the version contains prerelease identifiers
2+
3+
#
4+
# Returns a simple true/false boolean indicating whether the version indicates it's a prerelease or not.
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
9+
inputs:
10+
version:
11+
required: true
12+
13+
outputs:
14+
prerelease:
15+
value: ${{ steps.get_prerelease.outputs.PRERELEASE }}
16+
17+
runs:
18+
using: composite
19+
20+
steps:
21+
- id: get_prerelease
22+
shell: bash
23+
run: |
24+
if [[ "${VERSION}" == *"beta"* || "${VERSION}" == *"alpha"* ]]; then
25+
echo "PRERELEASE=true" >> $GITHUB_OUTPUT
26+
else
27+
echo "PRERELEASE=false" >> $GITHUB_OUTPUT
28+
fi
29+
env:
30+
VERSION: ${{ inputs.version }}

‎.github/actions/get-release-notes/action.yml

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Return the release notes extracted from the PR body
2+
3+
#
4+
# Returns the release notes from the content of a pull request linked to a release branch. It expects the branch name to be in the format release/vX.Y.Z, release/X.Y.Z, release/vX.Y.Z-beta.N. etc.
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
inputs:
9+
version:
10+
required: true
11+
repo_name:
12+
required: false
13+
repo_owner:
14+
required: true
15+
token:
16+
required: true
17+
18+
outputs:
19+
release-notes:
20+
value: ${{ steps.get_release_notes.outputs.RELEASE_NOTES }}
21+
22+
runs:
23+
using: composite
24+
25+
steps:
26+
- uses: actions/github-script@v7
27+
id: get_release_notes
28+
with:
29+
result-encoding: string
30+
script: |
31+
const { data: pulls } = await github.rest.pulls.list({
32+
owner: process.env.REPO_OWNER,
33+
repo: process.env.REPO_NAME,
34+
state: 'all',
35+
head: `${process.env.REPO_OWNER}:release/${process.env.VERSION}`,
36+
});
37+
core.setOutput('RELEASE_NOTES', pulls[0].body);
38+
env:
39+
GITHUB_TOKEN: ${{ inputs.token }}
40+
REPO_OWNER: ${{ inputs.repo_owner }}
41+
REPO_NAME: ${{ inputs.repo_name }}
42+
VERSION: ${{ inputs.version }}

‎.github/actions/get-version/action.yml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Return the version extracted from the branch name
2+
3+
#
4+
# Returns the version from the .version file.
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
9+
outputs:
10+
version:
11+
value: ${{ steps.get_version.outputs.VERSION }}
12+
13+
runs:
14+
using: composite
15+
16+
steps:
17+
- id: get_version
18+
shell: bash
19+
run: |
20+
VERSION=$(head -1 .version)
21+
echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT

‎.github/actions/release-create/action.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Create a GitHub release
2+
3+
#
4+
# Creates a GitHub release with the given version.
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
9+
inputs:
10+
token:
11+
required: true
12+
files:
13+
required: false
14+
name:
15+
required: true
16+
body:
17+
required: true
18+
tag:
19+
required: true
20+
commit:
21+
required: true
22+
draft:
23+
default: false
24+
required: false
25+
prerelease:
26+
default: false
27+
required: false
28+
fail_on_unmatched_files:
29+
default: true
30+
required: false
31+
32+
runs:
33+
using: composite
34+
35+
steps:
36+
- uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
37+
with:
38+
body: ${{ inputs.body }}
39+
name: ${{ inputs.name }}
40+
tag_name: ${{ inputs.tag }}
41+
target_commitish: ${{ inputs.commit }}
42+
draft: ${{ inputs.draft }}
43+
prerelease: ${{ inputs.prerelease }}
44+
fail_on_unmatched_files: ${{ inputs.fail_on_unmatched_files }}
45+
files: ${{ inputs.files }}
46+
env:
47+
GITHUB_TOKEN: ${{ inputs.token }}

‎.github/actions/rl-scanner/action.yml

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
name: 'Reversing Labs Scanner'
2+
description: 'Runs the Reversing Labs scanner on a specified artifact.'
3+
inputs:
4+
artifact-path:
5+
description: 'Path to the artifact to be scanned.'
6+
required: true
7+
version:
8+
description: 'Version of the artifact.'
9+
required: true
10+
11+
runs:
12+
using: 'composite'
13+
steps:
14+
- name: Set up Python
15+
uses: actions/setup-python@v4
16+
with:
17+
python-version: '3.10'
18+
19+
- name: Install Python dependencies
20+
shell: bash
21+
run: |
22+
pip install boto3 requests
23+
24+
- name: Configure AWS credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
28+
aws-region: us-east-1
29+
mask-aws-account-id: true
30+
31+
- name: Install RL Wrapper
32+
shell: bash
33+
run: |
34+
pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
35+
36+
- name: Run RL Scanner
37+
shell: bash
38+
env:
39+
RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
40+
RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
41+
SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
42+
PYTHONUNBUFFERED: 1
43+
run: |
44+
if [ ! -f "${{ inputs.artifact-path }}" ]; then
45+
echo "Artifact not found: ${{ inputs.artifact-path }}"
46+
exit 1
47+
fi
48+
49+
rl-wrapper \
50+
--artifact "${{ inputs.artifact-path }}" \
51+
--name "${{ github.event.repository.name }}" \
52+
--version "${{ inputs.version }}" \
53+
--repository "${{ github.repository }}" \
54+
--commit "${{ github.sha }}" \
55+
--build-env "github_actions" \
56+
--suppress_output
57+
58+
# Check the outcome of the scanner
59+
if [ $? -ne 0 ]; then
60+
echo "RL Scanner failed."
61+
echo "scan-status=failed" >> $GITHUB_ENV
62+
exit 1
63+
else
64+
echo "RL Scanner passed."
65+
echo "scan-status=success" >> $GITHUB_ENV
66+
fi
67+
68+
outputs:
69+
scan-status:
70+
description: 'The outcome of the scan process.'
71+
value: ${{ env.scan-status }}

‎.github/actions/rubygems-publish/action.yml

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Publishes to RubyGems
2+
3+
#
4+
# Publishes to RubyGems
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
9+
inputs:
10+
rubygems-token:
11+
required: true
12+
ruby-version:
13+
required: true
14+
15+
runs:
16+
using: composite
17+
18+
steps:
19+
- name: Configure Ruby
20+
uses: ./.github/actions/setup
21+
with:
22+
ruby: ${{ inputs.ruby-version }}
23+
24+
- name: Publish to RubyGems
25+
shell: bash
26+
run: |
27+
gem build *.gemspec
28+
gem push *.gem
29+
env:
30+
GEM_HOST_API_KEY: ${{ inputs.rubygems-token }}

‎.github/actions/tag-exists/action.yml

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Return a boolean indicating if a tag already exists for the repository
2+
3+
#
4+
# Returns a simple true/false boolean indicating whether the tag exists or not.
5+
#
6+
# TODO: Remove once the common repo is public.
7+
#
8+
9+
inputs:
10+
token:
11+
required: true
12+
tag:
13+
required: true
14+
15+
outputs:
16+
exists:
17+
description: 'Whether the tag exists or not'
18+
value: ${{ steps.tag-exists.outputs.EXISTS }}
19+
20+
runs:
21+
using: composite
22+
23+
steps:
24+
- id: tag-exists
25+
shell: bash
26+
run: |
27+
GET_API_URL="https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG_NAME}"
28+
http_status_code=$(curl -LI $GET_API_URL -o /dev/null -w '%{http_code}\n' -s -H "Authorization: token ${GITHUB_TOKEN}")
29+
if [ "$http_status_code" -ne "404" ] ; then
30+
echo "EXISTS=true" >> $GITHUB_OUTPUT
31+
else
32+
echo "EXISTS=false" >> $GITHUB_OUTPUT
33+
fi
34+
env:
35+
TAG_NAME: ${{ inputs.tag }}
36+
GITHUB_TOKEN: ${{ inputs.token }}

‎.github/workflows/publish.yml

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -8,30 +8,29 @@ on:
88
required: true
99
default: master
1010

11+
1112
permissions:
1213
contents: read
14+
id-token: write # This is required for requesting the JWT
1315

1416
jobs:
15-
publish:
16-
name: Publish to RubyGems
17-
runs-on: ubuntu-latest
18-
environment: release
19-
20-
steps:
21-
- name: Checkout code
22-
uses: actions/checkout@v4
23-
with:
24-
fetch-depth: 0
25-
ref: ${{ github.event.inputs.branch }}
17+
rl-scanner:
18+
uses: ./.github/workflows/rl-scanner.yml
19+
with:
20+
ruby-version: 3.2
21+
secrets:
22+
RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
23+
RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
24+
SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
25+
PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
26+
PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
27+
PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
2628

27-
- name: Configure Ruby
28-
uses: ./.github/actions/setup
29-
with:
30-
ruby: 3.2
31-
32-
- name: Publish to RubyGems
33-
run: |
34-
gem build *.gemspec
35-
gem push *.gem
36-
env:
37-
GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}}
29+
publish:
30+
uses: ./.github/workflows/ruby-release.yml
31+
needs: rl-scanner
32+
with:
33+
ruby-version: 3.2
34+
secrets:
35+
github-token: ${{ secrets.GITHUB_TOKEN }}
36+
rubygems-token: ${{ secrets.RUBYGEMS_AUTH_TOKEN }}

0 commit comments

Comments
 (0)