-
Notifications
You must be signed in to change notification settings - Fork 6
212 lines (192 loc) · 8.54 KB
/
veracode-analysis.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
# Veracode scans
on:
workflow_call:
inputs:
module_directory:
required: false
type: string
module_name:
required: true
type: string
major_version:
required: true
type: string
minor_version:
required: true
type: string
img_version:
required: true
type: string
secrets:
veracode_api_id:
required: true
veracode_api_key:
required: true
veracode_srcclr_token:
required: true
docker_registry_id:
required: true
docker_registry_passwd:
required: true
jobs:
routing:
name: Check before analysis
runs-on: ubuntu-24.04
outputs:
development_stage: ${{ steps.routing-mode.outputs.development_stage }}
skip_analysis: ${{ steps.routing-mode.outputs.skip_analysis }}
steps:
- name: Set routing mode
id: routing-mode
run: |
DEVELOPMENT_STAGE="Development"
ALLOWED_BRANCHES=(develop master dev-${{ inputs.major_version }}.x ${{ inputs.major_version }}.x)
for BRANCH in "${ALLOWED_BRANCHES[@]}"; do
if [[ "${{ github.ref_name }}" == "$BRANCH" ]] && [[ '${{ github.event_name }}' != 'pull_request' ]]; then
DEVELOPMENT_STAGE="Release"
fi
done
# skip analysis of draft PR and analysis on development branches using workflow dispatch
SKIP_ANALYSIS="true"
if [[ "${{ github.event_name }}" == "pull_request" && -n "${{ github.event.pull_request.number }}" && -n "${{ github.event.pull_request.draft }}" && "${{ github.event.pull_request.draft }}" == "false" ]] || [[ "$DEVELOPMENT_STAGE" != "Development" ]]; then
SKIP_ANALYSIS="false"
fi
echo "development_stage=$DEVELOPMENT_STAGE" >> $GITHUB_OUTPUT
echo "skip_analysis=$SKIP_ANALYSIS" >> $GITHUB_OUTPUT
cat $GITHUB_OUTPUT
build:
name: Binary preparation
runs-on: [self-hosted, collect]
needs: [routing]
if: needs.routing.outputs.skip_analysis == 'false'
container:
image: ${{ vars.DOCKER_INTERNAL_REGISTRY_URL }}/centreon-collect-alma9:${{ inputs.img_version }}
credentials:
username: ${{ secrets.docker_registry_id }}
password: ${{ secrets.docker_registry_passwd }}
steps:
- uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
- if: ${{ inputs.module_name == 'centreon-collect' }}
name: Compiling Cpp sources
run: |
mv /root/.cache /github/home
export VCPKG_ROOT=/vcpkg
export PATH=$VCPKG_ROOT:$PATH
rm -rf build
cmake \
-B build \
-DVCPKG_OVERLAY_TRIPLETS=/custom-triplets \
-DVCPKG_TARGET_TRIPLET=x64-linux-release \
-DVCPKG_OVERLAY_PORTS=/overlays \
-S . \
-GNinja \
-DCMAKE_CXX_FLAGS="-gdwarf-2 -g3 -O0 -fno-builtin" \
-DDEBUG_ROBOT=OFF \
-DWITH_TESTING=OFF \
-DWITH_BENCH=OFF \
-DWITH_MODULE_SIMU=OFF \
-DCMAKE_INSTALL_PREFIX=/usr \
-DWITH_STARTUP_SCRIPT=systemd \
-DWITH_ENGINE_LOGROTATE_SCRIPT=ON \
-DWITH_USER_BROKER=centreon-broker \
-DWITH_GROUP_BROKER=centreon-broker \
-DWITH_USER_ENGINE=centreon-engine \
-DWITH_GROUP_ENGINE=centreon-engine \
-DWITH_VAR_DIR=/var/log/centreon-engine \
-DWITH_DAEMONS=ON \
-DWITH_CREATE_FILES=OFF \
-DWITH_CONFIG_FILES=ON \
-DNG=ON
ninja -Cbuild
echo "[DEBUG] - Find compiled files"
find build/{broker,engine,clib,connectors,common} -name "*.so" -type f
echo "[DEBUG] - Build size"
du -sh $(find build/{broker,engine,clib,connectors,common} -name "*.so" -type f) | sort -rh
- if: ${{ inputs.module_name == 'centreon-collect' }}
name: Preserve centreon-collect binaries from cleaning
run: |
echo "[INFO] - Keeping only compiled files"
find build -type f -not \( -name "*.so" -or -name "cbd" -or -name "centengine" -or -name "cbwd" -or -name "centreon_connector_*" \) -delete
- name: Binary preparation of ${{ inputs.module_name }}
run: |
if [ -n "${{ inputs.module_directory }}" ]; then
cd ${{ inputs.module_directory }}
fi
echo "[INFO] - Removing veracode exclusions"
if [[ -f ".veracode-exclusions" ]]; then
for LINE in $( cat .veracode-exclusions | sed 's/[^a-zA-Z0-9_./-]//g' | sed -r 's/\.\./\./g' ); do
if [[ -d "$LINE" ]]; then
rm -rf "$LINE"
echo "[INFO] - folder removed from analysis : '$LINE'"
elif [[ -e "$LINE" ]]; then
rm -f "$LINE"
echo "[INFO] - file removed from analysis : '$LINE'"
elif [[ -z "$LINE" ]]; then
echo "[INFO] - empty directive. Skipping this line"
else
echo "::warning::Target to exclude from analysis not found. Skipping: '$LINE'"
fi
done
else
echo "::warning::No '.veracode-exclusions' file found for this module. Skipping exclusion step"
fi
if [ "${{ inputs.module_name }}" = "centreon-collect" ]; then
echo "[INFO] - Keeping only build's non empty folders"
find build -empty -type d -delete
ls -la build
echo "[INFO] - Generating the tarball"
tar cvzf "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.tar.gz" build
else
echo "[INFO] - Generating the zip"
zip -rq "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.zip" *
if [ -n "${{ inputs.module_directory }}" ]; then
cd -
mv ${{ inputs.module_directory }}/${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.zip .
fi
fi
- name: Cache
uses: actions/cache/save@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.${{ inputs.module_name == 'centreon-collect' && 'tar.gz' || 'zip' }}"
key: "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary"
policy-scan:
name: Sandbox scan
needs: [routing, build]
if: needs.routing.outputs.development_stage != 'Development'
runs-on: ubuntu-24.04
steps:
- name: Promote latest scan
# only develop will be promoted to policy scan
if: github.ref_name == 'develop'
env:
VERACODE_API_ID: "${{ secrets.veracode_api_id }}"
VERACODE_API_SECRET: "${{ secrets.veracode_api_key }}"
# Action forked as API calls hardcoded '.com' route
uses: sc979/veracode-sandboxes-helper@cf67241c27cbe6405ad8705111121ece9a48c4ff # v0.2
# Promote should not fail to trigger following sandbox scan.
continue-on-error: true
with:
activity: "promote-latest-scan"
app-name: "${{ inputs.module_name }}"
sandbox-name: "${{ github.ref_name }}"
delete-on-promote: false
- name: Get build binary
uses: actions/cache/restore@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
with:
path: "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.${{ inputs.module_name == 'centreon-collect' && 'tar.gz' || 'zip' }}"
key: "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary"
- name: Sandbox scan
uses: veracode/veracode-uploadandscan-action@f7e1fbf02c5c899fba9f12e3f537b62f2f1230e1 # 0.2.7
continue-on-error: ${{ vars.VERACODE_CONTINUE_ON_ERROR == 'true' }}
with:
appname: "${{ inputs.module_name }}"
version: "${{ inputs.major_version }}.${{ inputs.minor_version }}_runId-${{ github.run_id }}_attempt-${{ github.run_attempt }}"
filepath: "${{ inputs.module_name }}-${{ github.sha }}-${{ github.run_id }}-veracode-binary.${{ inputs.module_name == 'centreon-collect' && 'tar.gz' || 'zip' }}"
vid: "vera01ei-${{ secrets.veracode_api_id }}"
vkey: "vera01es-${{ secrets.veracode_api_key }}"
createprofile: true
createsandbox: true
sandboxname: "${{ github.ref_name }}"
includenewmodules: true
scanallnonfataltoplevelmodules: true
deleteincompletescan: 1