@@ -11,13 +11,16 @@ jobs:
11
11
outputs :
12
12
report_contents : ${{ steps.save-output.outputs.report_contents }}
13
13
steps :
14
- - uses : actions/setup-python@v5
14
+ - name : Setup python
15
+ uses : actions/setup-python@v5
15
16
with :
16
17
python-version : ' 3.11'
17
- - uses : actions/checkout@v4
18
+ - name : Checkout code
19
+ uses : actions/checkout@v4
18
20
with :
19
21
ref : main
20
- -
uses :
robinraju/[email protected]
22
+ - name : Download latest release
23
+
21
24
with :
22
25
latest : true
23
26
fileName : ' aws-lambda-rie*'
@@ -26,19 +29,19 @@ jobs:
26
29
id : check-binaries
27
30
run : |
28
31
make check-binaries
29
- - if : always() && failure() # Failure means there are vulnerabilities
32
+ - if : always() && failure() # `always()` to run even if the previous step failed. Failure means that there are vulnerabilities
33
+ name : Save content of the vulnerabilities report as GitHub output
30
34
id : save-output
31
- name : Save output contents
32
35
run : |
33
36
report_csv="$(ls -tr output.cve-bin-*.csv 2>/dev/null | tail -n1)" # last file generated
34
37
echo "Vulnerabilities stored in $report_csv"
35
38
final_report="${report_csv}.txt"
36
39
awk -F',' '{n=split($10, path, "/"); print $2,$3,$4,$5,path[n]}' "$report_csv" | column -t > "$final_report" # make the CSV nicer
37
40
echo "report_contents<<EOF" >> "$GITHUB_OUTPUT"
38
- cat "$final_report" >> "$GITHUB_OUTPUT"
39
- echo "EOF" >> "$GITHUB_OUTPUT"
41
+ cat "$final_report" >> "$GITHUB_OUTPUT"
42
+ echo "EOF" >> "$GITHUB_OUTPUT"
40
43
- if : always() && steps.check-binaries.outcome == 'failure'
41
- name : Build new version and check
44
+ name : Build new binaries and check vulnerabilities again
42
45
id : check-new-version
43
46
run : |
44
47
mkdir ./bin2
@@ -48,18 +51,17 @@ jobs:
48
51
echo "latest_version=$latest_version" >> "$GITHUB_OUTPUT"
49
52
make check-binaries
50
53
- if : always() && steps.check-binaries.outcome == 'failure'
51
- name : Save output for new version
54
+ name : Save outputs for the check with the latest build
52
55
id : save-new-version
53
56
run : |
54
- exit_code=$?
55
57
if [ "${{ steps.check-new-version.outcome }}" == "failure" ]; then
56
58
fixed="No"
57
59
else
58
60
fixed="Yes"
59
61
fi
60
62
echo "fixed=$fixed" >> "$GITHUB_OUTPUT"
61
63
- if : always() && steps.check-binaries.outcome == 'failure'
62
- name : Create Issue
64
+ name : Create GitHub Issue indicating vulnerabilities
63
65
id : create-issue
64
66
uses : dacbd/create-issue-action@main
65
67
with :
0 commit comments