Add the GitHub Actions workflow that will process the YAML files that contain cisagov controlled software information and generate a final Markdown file. The required template and Python requirements are included as well.pull/433/head
parent
6e7cf1024b
commit
3e78ba6c4c
@ -0,0 +1,113 @@ |
|||||||
|
--- |
||||||
|
name: Update the software list |
||||||
|
|
||||||
|
on: |
||||||
|
push: |
||||||
|
branches: |
||||||
|
- develop |
||||||
|
|
||||||
|
env: |
||||||
|
PIP_CACHE_DIR: ~/.cache/pip |
||||||
|
TESTING_BRANCH_BASE: testing/update_software_list |
||||||
|
|
||||||
|
jobs: |
||||||
|
setup: |
||||||
|
runs-on: ubuntu-latest |
||||||
|
outputs: |
||||||
|
# Commit author information for git |
||||||
|
git_author: ${{ steps.git-config.outputs.author }} |
||||||
|
git_email: ${{ steps.git-config.outputs.email }} |
||||||
|
git_user: ${{ steps.git-config.outputs.user }} |
||||||
|
# The name of the branch used for testing |
||||||
|
testing_branch: ${{ steps.testing-branch.outputs.name }} |
||||||
|
steps: |
||||||
|
- id: git-config |
||||||
|
run: | |
||||||
|
echo "::set-output name=author::$GIT_USER <$GIT_EMAIL>" |
||||||
|
echo "::set-output name=email::$GIT_EMAIL" |
||||||
|
echo "::set-output name=user::$GIT_USER" |
||||||
|
env: |
||||||
|
GIT_EMAIL: ${{ fromJson(secrets.GIT_AUTHOR_INFORMATION).user.email }} |
||||||
|
GIT_USER: ${{ fromJson(secrets.GIT_AUTHOR_INFORMATION).user.name }} |
||||||
|
- id: testing-branch |
||||||
|
run: echo "::set-output name=name::$BASE_BRANCH/$COMMIT_SHA" |
||||||
|
env: |
||||||
|
BASE_BRANCH: ${{ env.TESTING_BRANCH_BASE }} |
||||||
|
COMMIT_SHA: ${{ github.sha }} |
||||||
|
generate_list_update: |
||||||
|
runs-on: ubuntu-latest |
||||||
|
needs: setup |
||||||
|
outputs: |
||||||
|
# If changes are detected then a commit will have been pushed |
||||||
|
updated_list: ${{ steps.commit-for-testing.outputs.changes_detected }} |
||||||
|
# Don't run if we're seeing an update push |
||||||
|
if: github.actor != needs.setup.outputs.git_user |
||||||
|
steps: |
||||||
|
- uses: actions/checkout@v2 |
||||||
|
with: |
||||||
|
token: ${{ secrets.CISAGOVBOT_PAT }} |
||||||
|
- id: setup-python |
||||||
|
uses: actions/setup-python@v2 |
||||||
|
with: |
||||||
|
python-version: "3.10" |
||||||
|
- uses: actions/cache@v2 |
||||||
|
env: |
||||||
|
BASE_CACHE_KEY: "${{ github.job }}-${{ runner.os }}-\ |
||||||
|
py${{ steps.setup-python.outputs.python-version }}-" |
||||||
|
with: |
||||||
|
path: | |
||||||
|
${{ env.PIP_CACHE_DIR }} |
||||||
|
key: "${{ env.BASE_CACHE_KEY }}\ |
||||||
|
${{ hashFiles('.github/workflows/update_software_list.yml') }}-\ |
||||||
|
${{ hashFiles('config/requirements.txt') }}" |
||||||
|
restore-keys: | |
||||||
|
${{ env.BASE_CACHE_KEY }} |
||||||
|
- name: Update Python base packages |
||||||
|
run: python -m pip install --upgrade pip setuptools wheel |
||||||
|
- name: Install dependencies |
||||||
|
run: pip install --upgrade --requirement config/requirements.txt |
||||||
|
- name: Create the branch for test validation |
||||||
|
run: git switch --create ${{ needs.setup.outputs.testing_branch }} |
||||||
|
- name: Update the comprehensive cisagov YAML file |
||||||
|
run: normalize-yml --cisagov-format data/cisagov_*.yml > data/cisagov.yml |
||||||
|
- name: Generate a normalized YAML file from all source YAML files |
||||||
|
run: normalize-yml data/cisagov.yml > normalized.yml |
||||||
|
- name: Generate a Markdown table from the normalized YAML file |
||||||
|
run: yml2md normalized.yml > table_data.md |
||||||
|
- name: Generate a new software list from the updated data |
||||||
|
run: md-from-template config/SOFTWARE-LIST.tpl.md table_data.md > SOFTWARE-LIST.md |
||||||
|
- id: commit-for-testing |
||||||
|
uses: stefanzweifel/git-auto-commit-action@v4 |
||||||
|
with: |
||||||
|
branch: ${{ needs.setup.outputs.testing_branch }} |
||||||
|
commit_message: Update the software list |
||||||
|
commit_user_name: ${{ needs.setup.outputs.git_user }} |
||||||
|
commit_user_email: ${{ needs.setup.outputs.git_email }} |
||||||
|
commit_author: ${{ needs.setup.outputs.git_author }} |
||||||
|
file_pattern: SOFTWARE-LIST.md data/cisagov.yml |
||||||
|
merge_list_update: |
||||||
|
runs-on: ubuntu-latest |
||||||
|
needs: |
||||||
|
- setup |
||||||
|
- generate_list_update |
||||||
|
if: needs.generate_list_update.outputs.updated_list == 'true' |
||||||
|
steps: |
||||||
|
- uses: actions/checkout@v2 |
||||||
|
with: |
||||||
|
token: ${{ secrets.CISAGOVBOT_PAT }} |
||||||
|
- name: Configure git |
||||||
|
run: | |
||||||
|
git config user.name "${{ needs.setup.outputs.git_user }}" |
||||||
|
git config user.email "${{ needs.setup.outputs.git_email }}" |
||||||
|
- uses: lewagon/wait-on-check-action@v1.0.0 |
||||||
|
with: |
||||||
|
check-name: lint |
||||||
|
ref: ${{ needs.setup.outputs.testing_branch }} |
||||||
|
repo-token: ${{ github.token }} |
||||||
|
- name: Merge the testing branch |
||||||
|
run: | |
||||||
|
git fetch |
||||||
|
git merge origin/${{ needs.setup.outputs.testing_branch }} |
||||||
|
git push |
||||||
|
- name: Cleanup testing branch |
||||||
|
run: git push --delete origin ${{ needs.setup.outputs.testing_branch }} |
@ -0,0 +1,20 @@ |
|||||||
|
# CISA Log4j (CVE-2021-44228) Affected Vendor & Software List # |
||||||
|
|
||||||
|
## Status Descriptions ## |
||||||
|
|
||||||
|
| Status | Description | |
||||||
|
| ------ | ----------- | |
||||||
|
| Unknown | Status unknown. Default choice. | |
||||||
|
| Affected | Reported to be affected by CVE-2021-44228. | |
||||||
|
| Not Affected | Reported to NOT be affected by CVE-2021-44228 and no further action necessary. | |
||||||
|
| Fixed | Patch and/or mitigations available (see provided links). | |
||||||
|
| Under Investigation | Vendor investigating status. | |
||||||
|
|
||||||
|
## Software List ## |
||||||
|
|
||||||
|
This list was initially populated using information from the following sources: |
||||||
|
|
||||||
|
- Kevin Beaumont |
||||||
|
- SwitHak |
||||||
|
|
||||||
|
{{software_markdown_table}} |
@ -0,0 +1 @@ |
|||||||
|
https://github.com/cisagov/log4j-md-yml/archive/v1.1.0.tar.gz |
Loading…
Reference in new issue