Skip to content

Commit f7f778d

Browse files
capachinocapachino
authored
chore: download/package OSV scanner and add as MCP server (#105)
1 parent 46b3eb0 commit f7f778d

File tree

2 files changed

+149
-15
lines changed

2 files changed

+149
-15
lines changed

‎.github/workflows/package-and-upload-assets.yml‎

Lines changed: 143 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
name: Package and Upload Release Assets
22

3+
# Global variables
4+
env:
5+
FILES_TO_PACKAGE: "gemini-extension.json GEMINI.md LICENSE commands/ mcp-server/"
6+
37
on:
48
release:
59
types: [created]
@@ -12,12 +16,9 @@ on:
1216
required: true
1317
type: string
1418

15-
permissions:
16-
# This permission is required for the action to create a GitHub Release
17-
contents: write
18-
1919
jobs:
20-
build-and-package:
20+
# Build the MCP server and uploads the entire workspace as an artifact for the next job
21+
build:
2122
runs-on: ubuntu-latest
2223
steps:
2324
# 1. Checks out your repository's code
@@ -36,22 +37,149 @@ jobs:
3637
# 3. Install MCP server dependencies
3738
# The MCP server needs its dependencies bundled in the release
3839
- name: Install MCP server dependencies
39-
run: cd mcp-server && npm ci
40+
working-directory: ./mcp-server
41+
run: npm ci
4042

4143
# 4. Runs your build script
4244
- name: Run build
43-
run: cd mcp-server && npm run build
45+
working-directory: ./mcp-server
46+
run: npm run build
47+
48+
# 5. Upload build artifacts
49+
- name: Upload build artifacts
50+
uses: actions/upload-artifact@v4
51+
with:
52+
name: build-output
53+
path: .
54+
55+
# Downloads OSV scanner and packages release archives.
56+
package:
57+
needs: build
58+
runs-on: ubuntu-latest
59+
60+
strategy:
61+
matrix:
62+
platform:
63+
- { os: "linux", archive_name: "linux.x64.security.tar.gz", source_binary: "osv-scanner_linux_amd64", output_binary: "osv-scanner" }
64+
- { os: "darwin", archive_name: "darwin.x64.security.tar.gz", source_binary: "osv-scanner_darwin_amd64", output_binary: "osv-scanner" }
65+
- { os: "darwin", archive_name: "darwin.arm64.security.tar.gz", source_binary: "osv-scanner_darwin_arm64", output_binary: "osv-scanner" }
66+
- { os: "win32", archive_name: "win32.x64.security.zip", source_binary: "osv-scanner_windows_amd64.exe", output_binary: "osv-scanner.exe" }
67+
68+
steps:
69+
- name: Download build artifacts
70+
uses: actions/download-artifact@v4
71+
with:
72+
name: build-output
73+
path: .
74+
75+
# Determine OSV scanner version and record it in `tag`
76+
- name: Get latest OSV scanner version
77+
id: osv_scanner_version
78+
run: |
79+
LATEST_TAG=$(curl -sSLf "https://api.github.com/repos/google/osv-scanner/releases/latest" | jq -r .tag_name)
80+
echo "tag=${LATEST_TAG}" >> $GITHUB_OUTPUT
81+
82+
- name: Download OSV scanner binary
83+
env:
84+
SOURCE_BINARY: ${{ matrix.platform.source_binary }}
85+
OSV_SCANNER_VERSION: ${{ steps.osv_scanner_version.outputs.tag }}
86+
run: |
87+
DOWNLOAD_URL="https://github.com/google/osv-scanner/releases/download/${OSV_SCANNER_VERSION}/${SOURCE_BINARY}"
88+
89+
echo "Downloading binary from: ${DOWNLOAD_URL}"
90+
curl -Lf -o "${SOURCE_BINARY}" "${DOWNLOAD_URL}"
91+
chmod +x ${SOURCE_BINARY}
92+
93+
echo "Binary downloaded and prepared."
94+
ls -l
95+
96+
- name: Install slsa-verifier
97+
uses: slsa-framework/slsa-verifier/actions/installer@v2.7.1
98+
99+
- name: Verify OSV scanner binary
100+
env:
101+
SOURCE_BINARY: ${{ matrix.platform.source_binary }}
102+
OSV_SCANNER_VERSION: ${{ steps.osv_scanner_version.outputs.tag }}
103+
run: |
104+
PROVENANCE_URL="https://github.com/google/osv-scanner/releases/download/${OSV_SCANNER_VERSION}/multiple.intoto.jsonl"
105+
106+
echo "Downloading provenance from: ${PROVENANCE_URL}"
107+
curl -Lf -o multiple.intoto.jsonl "${PROVENANCE_URL}"
44108
45-
# 5. Create TAR archive with MCP server dependencies
46-
# Exclude root node_modules but INCLUDE mcp-server/node_modules
47-
- name: Create TAR archive
48-
run: tar -cvzf ../security-release.tar.gz --exclude='.git' --exclude='.github' --exclude='./assets' . && mv ../security-release.tar.gz .
109+
echo "Verifying binary with slsa-verifier"
110+
slsa-verifier verify-artifact \
111+
"${SOURCE_BINARY}" \
112+
--provenance-path multiple.intoto.jsonl \
113+
--source-uri "github.com/google/osv-scanner" \
114+
--source-tag "${OSV_SCANNER_VERSION}"
115+
116+
- name: Create release archive
117+
id: create_archive
118+
env:
119+
ARCHIVE_NAME: ${{ matrix.platform.archive_name }}
120+
SOURCE_BINARY: ${{ matrix.platform.source_binary }}
121+
OS_PLATFORM: ${{ matrix.platform.os }}
122+
OUTPUT_BINARY: ${{ matrix.platform.output_binary }}
123+
run: |
124+
echo "Packaging ${SOURCE_BINARY} and extension contents into ${ARCHIVE_NAME}"
125+
126+
mkdir staging
127+
cp "${SOURCE_BINARY}" "staging/${OUTPUT_BINARY}"
128+
cp -r ${FILES_TO_PACKAGE} staging/
129+
130+
if [[ "${OS_PLATFORM}" == "win32" ]]; then
131+
echo "Modifying gemini-extension.json for Windows..."
132+
jq '.mcpServers.osvScanner.command += ".exe"' gemini-extension.json > staging/gemini-extension.json
133+
echo "Modification complete."
134+
fi
135+
136+
echo "All assets staged."
137+
ls -l staging
138+
139+
# Create archive
140+
if [[ "${OS_PLATFORM}" == "win32" ]]; then
141+
(cd staging && zip -r ../"${ARCHIVE_NAME}" *)
142+
else
143+
tar -czvf "${ARCHIVE_NAME}" -C staging .
144+
fi
145+
echo "Created archive: ${ARCHIVE_NAME}"
146+
echo "archive_path=${ARCHIVE_NAME}" >> $GITHUB_OUTPUT
147+
148+
- name: Upload archive as workflow artifact
149+
uses: actions/upload-artifact@v4
150+
with:
151+
name: release-archive-${{ matrix.platform.archive_name }}
152+
path: ${{ steps.create_archive.outputs.archive_path }}
153+
154+
# This job gathers all archives and uploads them to the GitHub Release.
155+
upload:
156+
name: Upload all assets to release
157+
runs-on: ubuntu-latest
158+
needs: package
159+
permissions:
160+
contents: write
161+
steps:
162+
- name: Checkout code
163+
uses: actions/checkout@v4
164+
165+
- name: Download all release archives
166+
uses: actions/download-artifact@v4
167+
with:
168+
path: release-archives
169+
pattern: release-archive-*
170+
merge-multiple: true
171+
172+
- name: List downloaded files
173+
run: |
174+
echo "--- Downloaded files ---"
175+
ls -R release-archives
176+
echo "------------------------"
49177
50-
# 6. Upload the TAR archive as a release asset
51-
- name: Upload archive to GitHub Release
178+
- name: Upload all assets to GitHub Release
52179
env:
53180
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
181+
TAG_NAME: ${{ github.event.release.tag_name || inputs.tag_name }}
54182
run: |
55183
gh release upload \
56-
${{ github.event.release.tag_name || inputs.tag_name }} \
57-
security-release.tar.gz
184+
${TAG_NAME} \
185+
release-archives/*

‎gemini-extension.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@
88
"args": [
99
"${extensionPath}/mcp-server/dist/index.js"
1010
]
11+
},
12+
"osvScanner": {
13+
"command": "${extensionPath}/osv-scanner",
14+
"args": [
15+
"experimental-mcp"
16+
]
1117
}
1218
}
1319
}

0 commit comments

Comments
 (0)