workflows: Add clippy, nancy, and binskim release checks #319
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| # By default, all files require review by members of these teams | ||
| * @microsoft/kata-cc-devs @microsoft/kata-cc-admins | ||
|
|
||
| # Modifications to this file require admin approval | ||
| /.github/CODEOWNERS @microsoft/kata-cc-admins |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| ###### Merge Checklist <!-- REQUIRED --> | ||
| - [ ] Followed patch format from upstream recommendation: https://github.com/kata-containers/community/blob/main/CONTRIBUTING.md#patch-format | ||
| - [ ] Included a single commit in a given PR - at least unless there are related commits and each makes sense as a change on its own. | ||
| - [ ] Aware about the PR to be merged using "create a merge commit" rather than "squash and merge" (or similar) | ||
| - [ ] The `upstream/missing` label (or `upstream/not-needed`) has been set on the PR. | ||
|
|
||
| ###### Summary <!-- REQUIRED --> | ||
| <!-- Quick explanation of WHAT changed and WHY. --> | ||
|
|
||
| ###### Test Methodology | ||
| <!-- How was this test validated? i.e. local build, pipeline build etc. --> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,128 @@ | ||
| name: Release Binary Hardening checks | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: | ||
| - msft-main | ||
|
|
||
| jobs: | ||
| binskim: | ||
| name: Run BinSkim on Compiled Binaries | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Dependencies | ||
| run: | | ||
| echo "Installing dependencies..." | ||
| sudo apt-get update | ||
| sudo apt-get install -y git golang rustc cargo build-essential protobuf-compiler libprotobuf-dev expect libssl-dev clang libseccomp-dev btrfs-progs libdevmapper-dev cmake libfuse-dev | ||
| sudo add-apt-repository ppa:dotnet/backports | ||
| sudo apt-get install -y dotnet-sdk-9.0 aspnetcore-runtime-9.0 dotnet-runtime-9.0 zlib1g | ||
|
|
||
| - name: Set up BinSkim | ||
| run: | | ||
| dotnet new console -n TempConsoleApp | ||
| cd TempConsoleApp | ||
| echo "Installing BinSkim version 1.9.5" | ||
|
There was a problem hiding this comment. is there a pattern to install the latest stable version? |
||
| dotnet add package Microsoft.CodeAnalysis.BinSkim --version 1.9.5 | ||
| ls ~/.nuget/packages/microsoft.codeanalysis.binskim/ | ||
| sudo mv ~/.nuget/packages/microsoft.codeanalysis.binskim/ $GITHUB_WORKSPACE | ||
| sudo ln -sf "$GITHUB_WORKSPACE/microsoft.codeanalysis.binskim/1.9.5/tools/netcoreapp3.1/linux-x64/BinSkim" /usr/local/bin/binskim | ||
|
|
||
|
|
||
| - name: Build kata/kata-cc artifacts | ||
| run: | | ||
| echo "Building kata pod sandboxing binaries" | ||
| pushd tools/osbuilder/node-builder/azure-linux | ||
| # Adapt build script for ubuntu environment | ||
| sed -i 's|^OS_VERSION=.*|OS_VERSION="3.0"|' common.sh | ||
|
There was a problem hiding this comment. we don't need this. If you code doesn't work for Ubuntu, we can pass OS_VERSION as a variable for make package |
||
| make package | ||
| popd | ||
|
|
||
| # Prepare go binaries for binskim | ||
| pushd src/runtime | ||
| strip --strip-unneeded containerd-shim-kata-v2 | ||
| popd | ||
|
|
||
| mkdir -p artifacts/vanilla artifacts/confpods | ||
| KATA_AGENT_PATH=$(find src/agent/ -type f -name "kata-agent" | head -n 1) | ||
| KATA_SHIM_PATH=$(find src/runtime/ -type f -name "containerd-shim-kata-v2" | head -n 1) | ||
|
|
||
| echo "agent: ${KATA_AGENT_PATH}" | ||
| echo "shim: ${KATA_SHIM_PATH}" | ||
|
|
||
| # Move kata pod sandboxing binaries to artifacts/vanilla | ||
| mv "${KATA_AGENT_PATH}" "${KATA_SHIM_PATH}" artifacts/vanilla/ | ||
|
|
||
| echo "Building kata confpod binaries" | ||
| pushd tools/osbuilder/node-builder/azure-linux | ||
| make clean | ||
| make package-confpods | ||
| popd | ||
|
|
||
| TARDEV_SNAPSHOTTER_PATH=$(find src/tardev-snapshotter/ -type f -name "tardev-snapshotter" | head -n 1) | ||
| OVERLAY_PATH=$(find src/overlay/ -type f -name "kata-overlay" | head -n 1) | ||
| echo "tardev: ${TARDEV_SNAPSHOTTER_PATH}" | ||
| echo "overlay: ${OVERLAY_PATH}" | ||
|
|
||
| # Prepare go binaries for binskim | ||
| pushd src/runtime | ||
| strip --strip-unneeded containerd-shim-kata-v2 | ||
|
There was a problem hiding this comment. should stripping be something we should generally be doing when we build? There was a problem hiding this comment. It might remove information needed when debugging, no? |
||
| popd | ||
|
|
||
| # Move kata confpod binaries to artifacts/confpods | ||
| mv "${KATA_AGENT_PATH}" "${KATA_SHIM_PATH}" "${TARDEV_SNAPSHOTTER_PATH}" "${OVERLAY_PATH}" artifacts/confpods/ | ||
|
|
||
| - name: Run BinSkim on kata pod sandboxing binaries | ||
| run: | | ||
| for binary in artifacts/vanilla/*; do | ||
| echo "Running BinSkim on $binary" | ||
| binskim analyze "$binary" --level Error --kind "Pass;Fail" > "${binary}_binskim_result" | ||
| done | ||
|
|
||
| - name: Run BinSkim on kata confpod binaries | ||
| run: | | ||
| for binary in artifacts/confpods/*; do | ||
| echo "Running BinSkim on $binary" | ||
| binskim analyze "$binary" --level Error --kind "Pass;Fail" > "${binary}_binskim_result" | ||
| done | ||
|
|
||
| - name: Validate BinSkim results | ||
| run: | | ||
| # Validate pod sandboxing binaries | ||
| for result in artifacts/vanilla/*_binskim_result; do | ||
| if [ ! -f "$result" ]; then | ||
| echo "❌ Error: $result was not generated." | ||
| exit 1 | ||
| fi | ||
| echo "Validating: pod sandboxing ${result}" | ||
| cat "$result" | ||
|
|
||
| if grep -qi "fail" "$result"; then | ||
| echo "❌ Error: Failures detected in pod sandboxing binary: $result" | ||
| exit 1 | ||
| fi | ||
| echo "--------------------------- End-------------------------" | ||
| done | ||
| echo "✅ All pod sandboxing binaries passed BinSkim." | ||
|
|
||
| # Validate confpod binaries | ||
| for result in artifacts/confpods/*_binskim_result; do | ||
| if [ ! -f "$result" ]; then | ||
| echo "❌ Error: $result was not generated." | ||
| exit 1 | ||
| fi | ||
| echo "Validating: conf pod ${result}" | ||
| cat "$result" | ||
|
|
||
| if grep -qi "fail" "$result"; then | ||
| echo "❌ Error: Failures detected in Confidential Pod binary: $result" | ||
| exit 1 | ||
| fi | ||
| echo "--------------------------- End-------------------------" | ||
| done | ||
| echo "✅ All confpod binaries passed BinSkim." | ||
|
Comment on lines
+93
to
+127
There was a problem hiding this comment. These should be independent steps so one binary failing doesn't block other results. We should probably rework this step using |
||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| # Copyright (c) Microsoft Corporation. | ||
|
|
||
| name: Check policy samples | ||
|
|
||
| on: | ||
| pull_request: | ||
|
|
||
| jobs: | ||
| check-policy-samples: | ||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
|
|
||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install yq | ||
| env: | ||
| INSTALL_IN_GOPATH: false | ||
| run: | | ||
| ./ci/install_yq.sh | ||
|
|
||
| - name: Install Rust | ||
| run: | | ||
| ./tests/install_rust.sh | ||
| echo "${HOME}/.cargo/bin" >> $GITHUB_PATH | ||
|
|
||
| - name: Install protobuf-compiler | ||
| run: | | ||
| sudo apt-get -y install protobuf-compiler | ||
|
|
||
| - name: Configure containerd | ||
| run: | | ||
| sudo containerd config default | sudo dd of=/etc/containerd/config.toml | ||
| sudo systemctl restart containerd | ||
| sudo systemctl is-active containerd | ||
|
|
||
| - name: Update policy samples | ||
| working-directory: ./src/tools/genpolicy | ||
| run: | | ||
| python3 update_policy_samples.py | ||
|
|
||
| - name: Show diff | ||
| run: | | ||
| git diff | ||
|
|
||
| - name: Check policy samples | ||
| run: | | ||
| git diff-files --exit-code |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| name: Release Static Checks | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: | ||
| - msft-main | ||
|
|
||
| jobs: | ||
| clippy: | ||
| name: Run Clippy on Rust Components | ||
|
There was a problem hiding this comment. The upstream static checks (static-checks.yaml) already run clippy - we should leverage those? |
||
| runs-on: ubuntu-latest | ||
|
|
||
| steps: | ||
| - name: Checkout Repository | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Install Dependencies | ||
| run: | | ||
| sudo apt-get update | ||
| sudo apt-get install -y libdevmapper-dev clang llvm | ||
|
|
||
| - name: Install Rust Toolchain | ||
| uses: dtolnay/rust-toolchain@stable | ||
| with: | ||
| components: clippy | ||
|
Comment on lines
+22
to
+25
There was a problem hiding this comment. We should install Rust the way that upstream does it (install_rust.sh). Regardless, we might not want to pick up Rust's latest version here, as it could break us. We should probably fetch the version from versions.yaml (and ensure the version that's there is the one we want). |
||
|
|
||
| - name: Run Clippy on agent | ||
| working-directory: src/agent | ||
| run: | | ||
| echo "Running Clippy on kata agent..." | ||
| if ! cargo clippy -- -D warnings; then | ||
| echo "❌ Clippy check failed for kata agent." | ||
| exit 1 | ||
| fi | ||
| echo "✅ Clippy check passed for kata agent." | ||
|
|
||
| - name: Run Clippy on overlay | ||
| working-directory: src/overlay | ||
| run: | | ||
| echo "Running Clippy on kata overlay..." | ||
| if ! cargo clippy -- -D warnings; then | ||
| echo "❌ Clippy check failed for kata overlay." | ||
| exit 1 | ||
| fi | ||
| echo "✅ Clippy check passed for kata overlay." | ||
|
|
||
| - name: Run Clippy on tardev-snapshotter | ||
| working-directory: src/tardev-snapshotter | ||
|
|
||
| run: | | ||
| echo "Running Clippy on tardev-snapshotter..." | ||
| if ! cargo clippy -- -D warnings; then | ||
| echo "❌ Clippy check failed for tardev-snapshotter." | ||
| exit 1 | ||
| fi | ||
| echo "✅ Clippy check passed for tardev-snapshotter." | ||
|
Comment on lines
+27
to
+55
There was a problem hiding this comment. These steps should be independent too. And no need for the output complexity, simply running |
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -86,17 +86,6 @@ jobs: | |
| error: 'Body line too long (max 150)' | ||
| post_error: ${{ env.error_msg }} | ||
|
|
||
| - name: Check Subsystem | ||
| if: ${{ !contains(github.event.pull_request.labels.*.name, 'force-skip-ci') && ( success() || failure() ) }} | ||
| uses: tim-actions/[email protected] | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,37 @@ | ||||||||||
| name: Release Static Checks | ||||||||||
|
|
||||||||||
| on: | ||||||||||
| pull_request: | ||||||||||
| branches: | ||||||||||
| - msft-main | ||||||||||
|
|
||||||||||
| jobs: | ||||||||||
| nancy: | ||||||||||
| name: Run Nancy on Go Dependencies | ||||||||||
| runs-on: ubuntu-latest | ||||||||||
|
|
||||||||||
| steps: | ||||||||||
| - name: Checkout Repository | ||||||||||
| uses: actions/checkout@v4 | ||||||||||
|
|
||||||||||
| - name: Set up Go | ||||||||||
| uses: actions/setup-go@v5 | ||||||||||
| with: | ||||||||||
| go-version: stable # Use latest stable Go version | ||||||||||
|
|
||||||||||
| - name: Install Nancy via Go | ||||||||||
| run: | | ||||||||||
| echo "Installing Nancy..." | ||||||||||
| go install github.com/sonatype-nexus-community/nancy@latest | ||||||||||
| echo "$HOME/go/bin" >> $GITHUB_PATH | ||||||||||
|
|
||||||||||
| - name: Verify Nancy Installation | ||||||||||
| run: | | ||||||||||
| echo "Checking Nancy installation..." | ||||||||||
| nancy --help || echo "Nancy installed successfully!" | ||||||||||
|
|
||||||||||
|
Comment on lines
+28
to
+32
There was a problem hiding this comment. Redundant
Suggested change
|
||||||||||
| - name: Run Nancy on `src/runtime` | ||||||||||
| working-directory: src/runtime | ||||||||||
| run: | | ||||||||||
| echo "Running Nancy vulnerability scan on Go dependencies..." | ||||||||||
| go list -m all | nancy sleuth | ||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
should we add a codeql file as well for the tarfs module, similar to https://github.com/kata-containers/kata-containers/pull/10930/files ?