diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml deleted file mode 100644 index 3b355007bf..0000000000 --- a/.github/workflows/govulncheck.yml +++ /dev/null @@ -1,39 +0,0 @@ -name: Nightly govulncheck -on: - push: - branches: - - 'shevchenko/govulncheck' -#on: -# push: -# branches: -# - main -# tags: -# - "**" -# schedule: -# - cron: '00 04 * * 2-6' -jobs: - govulncheck-tests: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - with: - repository: 'DataDog/dd-trace-go' - - name: Checkout Go - uses: actions/setup-go@v3 - with: - go-version: '1.18' - - name: Install and run govulncheck - run: | - go install golang.org/x/vuln/cmd/govulncheck@latest - govulncheck ./ddtrace/... - - name: Comment results - run: | - num=$(govulncheck ./ddtrace/... | grep "Vulnerability #" | wc -l) - if [ $num -gt 0 ]; then - echo "Found ${num} vulnerabilities" - exit 1 - fi - - - - diff --git a/.gitlab/govulncheck.yml b/.gitlab/govulncheck.yml new file mode 100644 index 0000000000..2c352b1b56 --- /dev/null +++ b/.gitlab/govulncheck.yml @@ -0,0 +1,60 @@ +#variables: +# # This base image is created here: https://gitlab.ddbuild.io/DataDog/apm-reliability/relenv-microbenchmarking-platform +# BASE_CI_IMAGE: 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/relenv-microbenchmarking-platform:dd-trace-go_knusbaum_test +# INDEX_FILE: index.txt +# +govulncheck: + stage: govulncheck + image: registry.ddbuild.io/images/mirror/golang:1.18 + cron: + only: + refs: + - shevchenko/govulncheck + script: + - ./.gitlab/scripts/run-govulncheck.sh +# artifacts: +# name: "reports" +# paths: +# - reports/ +# expire_in: 3 months +# +#name: Nightly govulncheck +#on: +# push: +# branches: +# - 'shevchenko/govulncheck' +#on: +# push: +# branches: +# - main +# tags: +# - "**" +# schedule: +# - cron: '00 04 * * 2-6' +#jobs: +# govulncheck-tests: +# runs-on: ubuntu-latest +# steps: +# - uses: actions/checkout@v3 +# with: +# repository: 'DataDog/dd-trace-go' +# - name: Checkout Go +# uses: actions/setup-go@v3 +# with: +# go-version: '1.18' +# - name: Install and run govulncheck +# run: | +# go install golang.org/x/vuln/cmd/govulncheck@latest +# govulncheck ./ddtrace/... +# - name: Comment results +# run: | +# govulncheck ./ddtrace/... >> results.txt +# num=$(cat results.txt | grep "Vulnerability #" | wc -l) +# if [ $num -gt 0 ]; then +# echo "Found ${num} vulnerabilities" +# exit 1 +# fi +# + + + diff --git a/.gitlab/scripts/run-govulncheck.sh b/.gitlab/scripts/run-govulncheck.sh new file mode 100644 index 0000000000..30fa841ef4 --- /dev/null +++ b/.gitlab/scripts/run-govulncheck.sh @@ -0,0 +1,11 @@ +#!/usr/bin/env bash +go install golang.org/x/vuln/cmd/govulncheck@latest + +govulncheck ./ddtrace/... >> results.txt +num=$(cat results.txt | grep "Vulnerability #" | wc -l) +if [ $num -gt 0 ]; then + echo "Found ${num} vulnerabilities" + exit 1 +fi + +echo "Found ${num} vulnerabilities" | /usr/local/bin/pr-commenter --for-repo="$CI_PROJECT_NAME" --for-pr="$CI_COMMIT_REF_NAME" --header="Vulnerability report"