|
| 1 | +name: Build Alpine Binaries |
| 2 | + |
| 3 | +on: |
| 4 | + push: |
| 5 | + workflow_dispatch: |
| 6 | + |
| 7 | +jobs: |
| 8 | + Depscan-Alpine-Build: |
| 9 | + runs-on: ubuntu-latest |
| 10 | + container: python:3.10-alpine |
| 11 | + steps: |
| 12 | + - uses: actions/checkout@v3 |
| 13 | + - name: Install packages |
| 14 | + run: | |
| 15 | + apk update |
| 16 | + apk add py3-pip python3-dev curl wget jq tree cmake make gcc git g++ musl-dev libffi-dev openssl-dev py3-cffi py3-twine py3-wheel py3-setuptools ca-certificates zlib-dev xz nodejs npm bash tar gcompat |
| 17 | + - name: Checkout dep-scan |
| 18 | + uses: actions/checkout@v3 |
| 19 | + with: |
| 20 | + repository: AppThreat/dep-scan |
| 21 | + path: dep-scan |
| 22 | + - name: Checkout cdxgen |
| 23 | + uses: actions/checkout@v3 |
| 24 | + with: |
| 25 | + repository: AppThreat/cdxgen |
| 26 | + path: cdxgen |
| 27 | + - name: Checkout cdxgen |
| 28 | + uses: actions/checkout@v3 |
| 29 | + with: |
| 30 | + repository: ngcloudsec/cdxgen-plugins-bin |
| 31 | + path: cdxgen-plugins-bin |
| 32 | + - name: Install go |
| 33 | + run: | |
| 34 | + wget https://go.dev/dl/go1.19.3.linux-amd64.tar.gz |
| 35 | + tar -xvf go1.19.3.linux-amd64.tar.gz |
| 36 | + mv go /usr/local/ |
| 37 | + - uses: actions/cache@v3 |
| 38 | + with: |
| 39 | + path: | |
| 40 | + ~/.cache/go-build |
| 41 | + ~/go/pkg/mod |
| 42 | + key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} |
| 43 | + restore-keys: | |
| 44 | + ${{ runner.os }}-go- |
| 45 | + - name: Install pyinstaller |
| 46 | + run: | |
| 47 | + python3 -m pip install twine setuptools wheel pyinstaller |
| 48 | + cd dep-scan |
| 49 | + pip3 install -r requirements.txt |
| 50 | + wget https://github.com/upx/upx/releases/download/v4.0.1/upx-4.0.1-amd64_linux.tar.xz |
| 51 | + tar -xvf upx-4.0.1-amd64_linux.tar.xz |
| 52 | + chmod +x upx-4.0.1-amd64_linux/upx |
| 53 | + cp upx-4.0.1-amd64_linux/upx /usr/local/bin/ |
| 54 | + - name: Produce cdxgen pkg |
| 55 | + run: | |
| 56 | + npm install -g pkg |
| 57 | + cd cdxgen |
| 58 | + npm install |
| 59 | + pkg -t node18-alpine --public package.json --out-path dist |
| 60 | + chmod +x dist/cdxgen |
| 61 | + ./dist/cdxgen --version |
| 62 | + - name: Build cdxgen plugins |
| 63 | + run: | |
| 64 | + echo "/usr/local/go/bin" >> $GITHUB_PATH |
| 65 | + cd cdxgen-plugins-bin |
| 66 | + chmod +x build.sh |
| 67 | + ls -lh /usr/local/go/bin |
| 68 | + ./build.sh |
| 69 | + - name: Binary alpine build |
| 70 | + run: | |
| 71 | + cd dep-scan |
| 72 | + pyinstaller depscan/cli.py --noconfirm --log-level=WARN --nowindow --onefile --name depscan-linux-musl --add-data="vendor:vendor" --add-binary="../cdxgen/dist/cdxgen:local_bin" --add-binary="../cdxgen-plugins-bin/plugins/osquery/osqueryi-linux-amd64:local_bin/osquery" --add-binary="../cdxgen-plugins-bin/plugins/goversion/goversion-linux-amd64:local_bin/goversion" --add-binary="../cdxgen-plugins-bin/plugins/trivy/trivy-cdxgen-linux-amd64:local_bin/trivy" --add-binary="../cdxgen-plugins-bin/plugins/cargo-auditable/cargo-auditable-cdxgen-linux-amd64:local_bin/cargo-auditable" --collect-submodules depscan --upx-dir /usr/local/bin |
| 73 | + sha256sum ./dist/depscan-linux-musl > ./dist/depscan-linux-musl.sha256 |
| 74 | + ./dist/depscan-linux-musl --help |
| 75 | + ./dist/depscan-linux-musl -i . -o /tmp/depscan.json |
| 76 | + - uses: actions/upload-artifact@v1 |
| 77 | + if: startsWith(github.ref, 'refs/tags/') != true |
| 78 | + with: |
| 79 | + path: ./dep-scan/dist |
| 80 | + name: depscan-linux-musl |
| 81 | + - name: Release |
| 82 | + uses: softprops/action-gh-release@v1 |
| 83 | + if: startsWith(github.ref, 'refs/tags/') |
| 84 | + with: |
| 85 | + files: | |
| 86 | + dep-scan/dist/depscan-linux-musl |
| 87 | + dep-scan/dist/depscan-linux-musl.sha256 |
0 commit comments