Run Vulnerability Data Script with Parameters and Update PR #9
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run Vulnerability Data Script with Parameters and Update PR | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| image_name: | |
| description: 'Docker image name to scan' | |
| required: true | |
| default: 'appsmith/appsmith-ce:release' | |
| jobs: | |
| run-and-update-pr: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: '20' | |
| - name: Login to DockerHub | |
| uses: docker/login-action@v3 | |
| with: | |
| username: ${{ secrets.DOCKER_HUB_USERNAME }} | |
| password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }} | |
| - name: Install pg | |
| run: npm install pg | |
| # Run Scout vulnerability data script | |
| - name: Run Scout vulnerability data script | |
| if: always() | |
| env: | |
| DB_HOST: ${{ secrets.CYPRESS_DB_HOST }} | |
| DB_NAME: ${{ secrets.CYPRESS_DB_NAME }} | |
| DB_USER: ${{ secrets.CYPRESS_DB_USER }} | |
| DB_PWD: ${{ secrets.CYPRESS_DB_PWD }} | |
| run: | | |
| chmod +x scripts/scout_vulnerabilities_data.sh | |
| ./scripts/scout_vulnerabilities_data.sh \ | |
| "${{ inputs.image_name }}" \ | |
| "${{ github.event.pull_request.number }}" \ | |
| "${{ github.event.pull_request.html_url }}" \ | |
| "${{ github.run_id }}" | |
| - name: Run Trivy vulnerability data script | |
| if: always() | |
| env: | |
| DB_HOST: ${{ secrets.CYPRESS_DB_HOST }} | |
| DB_NAME: ${{ secrets.CYPRESS_DB_NAME }} | |
| DB_USER: ${{ secrets.CYPRESS_DB_USER }} | |
| DB_PWD: ${{ secrets.CYPRESS_DB_PWD }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin | |
| chmod +x scripts/trivy_vulnerabilities_data.sh | |
| ./scripts/trivy_vulnerabilities_data.sh \ | |
| "${{ inputs.image_name }}" \ | |
| "${{ github.event.pull_request.number }}" \ | |
| "${{ github.event.pull_request.html_url }}" \ | |
| "${{ github.run_id }}" | |
| - name: Check for new vulnerabilities in Scout and Trivy files | |
| if: always() | |
| run: | | |
| # Check if Scout vulnerabilities file is not empty | |
| if [ -s "scout_new_vulnerabilities.csv" ]; then | |
| echo "Scout vulnerabilities detected." | |
| cat scout_new_vulnerabilities.csv | |
| exit 1 # Fail the job if data exists | |
| fi | |
| # Check if Trivy vulnerabilities file is not empty | |
| if [ -s "trivy_new_vulnerabilities.csv" ]; then | |
| echo "Trivy vulnerabilities detected." | |
| cat trivy_new_vulnerabilities.csv | |
| exit 1 # Fail the job if data exists | |
| fi |