Skip to content

Commit 4706b68

Browse files
miz060miz060
committed
Add clippy, nancy, and binskim release checks
1 parent 4779365 commit 4706b68

File tree

3 files changed

+220
-0
lines changed

3 files changed

+220
-0
lines changed

‎.github/workflows/binskim.yaml‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
name: Release Binary Hardening checks / BinSkim Scan
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- msft-main
7+
8+
jobs:
9+
binskim:
10+
name: Run BinSkim on Compiled Binaries
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout Repository
15+
uses: actions/checkout@v4
16+
17+
- name: Install Dependencies
18+
run: |
19+
echo "Installing dependencies..."
20+
sudo apt-get update
21+
sudo apt-get install -y git golang rustc cargo build-essential protobuf-compiler libprotobuf-dev expect libssl-dev clang libseccomp-dev btrfs-progs libdevmapper-dev cmake libfuse-dev
22+
sudo add-apt-repository ppa:dotnet/backports
23+
sudo apt-get install -y dotnet-sdk-9.0 aspnetcore-runtime-9.0 dotnet-runtime-9.0 zlib1g
24+
25+
- name: Set up BinSkim
26+
run: |
27+
dotnet new console -n TempConsoleApp
28+
cd TempConsoleApp
29+
echo "Installing BinSkim version 1.9.5"
30+
dotnet add package Microsoft.CodeAnalysis.BinSkim --version 1.9.5
31+
ls ~/.nuget/packages/microsoft.codeanalysis.binskim/
32+
sudo mv ~/.nuget/packages/microsoft.codeanalysis.binskim/ $GITHUB_WORKSPACE
33+
sudo ln -sf "$GITHUB_WORKSPACE/microsoft.codeanalysis.binskim/1.9.5/tools/netcoreapp3.1/linux-x64/BinSkim" /usr/local/bin/binskim
34+
35+
36+
- name: Build kata/kata-cc artifacts
37+
run: |
38+
echo "Building kata pod sandboxing binaries"
39+
pushd tools/osbuilder/node-builder/azure-linux
40+
# Adapt build script for ubuntu environment
41+
sed -i 's|^OS_VERSION=.*|OS_VERSION="3.0"|' common.sh
42+
make package
43+
popd
44+
45+
# Prepare go binaries for binskim
46+
pushd src/runtime
47+
strip --strip-unneeded containerd-shim-kata-v2
48+
popd
49+
50+
mkdir -p artifacts/vanilla artifacts/confpods
51+
KATA_AGENT_PATH=$(find src/agent/ -type f -name "kata-agent" | head -n 1)
52+
KATA_SHIM_PATH=$(find src/runtime/ -type f -name "containerd-shim-kata-v2" | head -n 1)
53+
54+
echo "agent: ${KATA_AGENT_PATH}"
55+
echo "shim: ${KATA_SHIM_PATH}"
56+
57+
# Move kata pod sandboxing binaries to artifacts/vanilla
58+
mv "${KATA_AGENT_PATH}" "${KATA_SHIM_PATH}" artifacts/vanilla/
59+
60+
echo "Building kata confpod binaries"
61+
pushd tools/osbuilder/node-builder/azure-linux
62+
make clean
63+
make package-confpods
64+
popd
65+
66+
TARDEV_SNAPSHOTTER_PATH=$(find src/tardev-snapshotter/ -type f -name "tardev-snapshotter" | head -n 1)
67+
OVERLAY_PATH=$(find src/overlay/ -type f -name "kata-overlay" | head -n 1)
68+
echo "tardev: ${TARDEV_SNAPSHOTTER_PATH}"
69+
echo "overlay: ${OVERLAY_PATH}"
70+
71+
# Prepare go binaries for binskim
72+
pushd src/runtime
73+
strip --strip-unneeded containerd-shim-kata-v2
74+
popd
75+
76+
# Move kata confpod binaries to artifacts/confpods
77+
mv "${KATA_AGENT_PATH}" "${KATA_SHIM_PATH}" "${TARDEV_SNAPSHOTTER_PATH}" "${OVERLAY_PATH}" artifacts/confpods/
78+
79+
- name: Run BinSkim on kata pod sandboxing binaries
80+
run: |
81+
for binary in artifacts/vanilla/*; do
82+
echo "Running BinSkim on $binary"
83+
binskim analyze "$binary" --level Error --kind "Pass;Fail" > "${binary}_binskim_result"
84+
done
85+
86+
- name: Run BinSkim on kata confpod binaries
87+
run: |
88+
for binary in artifacts/confpods/*; do
89+
echo "Running BinSkim on $binary"
90+
binskim analyze "$binary" --level Error --kind "Pass;Fail" > "${binary}_binskim_result"
91+
done
92+
93+
- name: Validate BinSkim results
94+
run: |
95+
# Validate pod sandboxing binaries
96+
for result in artifacts/vanilla/*_binskim_result; do
97+
if [ ! -f "$result" ]; then
98+
echo "❌ Error: $result was not generated."
99+
exit 1
100+
fi
101+
echo "Validating: pod sandboxing ${result}"
102+
cat "$result"
103+
104+
if grep -qi "fail" "$result"; then
105+
echo "❌ Error: Failures detected in pod sandboxing binary: $result"
106+
exit 1
107+
fi
108+
echo "--------------------------- End-------------------------"
109+
done
110+
echo "✅ All pod sandboxing binaries passed BinSkim."
111+
112+
# Validate confpod binaries
113+
for result in artifacts/confpods/*_binskim_result; do
114+
if [ ! -f "$result" ]; then
115+
echo "❌ Error: $result was not generated."
116+
exit 1
117+
fi
118+
echo "Validating: conf pod ${result}"
119+
cat "$result"
120+
121+
if grep -qi "fail" "$result"; then
122+
echo "❌ Error: Failures detected in Confidential Pod binary: $result"
123+
exit 1
124+
fi
125+
echo "--------------------------- End-------------------------"
126+
done
127+
echo "✅ All confpod binaries passed BinSkim."
128+

‎.github/workflows/clippy.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: Release Static Checks / Rust Clippy Check
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- msft-main
7+
8+
jobs:
9+
clippy:
10+
name: Run Clippy on Rust Components
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout Repository
15+
uses: actions/checkout@v4
16+
17+
- name: Install Dependencies
18+
run: |
19+
sudo apt-get update
20+
sudo apt-get install -y libdevmapper-dev clang llvm
21+
22+
- name: Install Rust Toolchain
23+
uses: dtolnay/rust-toolchain@stable
24+
with:
25+
components: clippy
26+
27+
- name: Run Clippy on agent
28+
working-directory: src/agent
29+
run: |
30+
echo "Running Clippy on kata agent..."
31+
if ! cargo clippy -- -D warnings; then
32+
echo "❌ Clippy check failed for kata agent."
33+
exit 1
34+
fi
35+
echo "✅ Clippy check passed for kata agent."
36+
37+
- name: Run Clippy on overlay
38+
working-directory: src/overlay
39+
run: |
40+
echo "Running Clippy on kata overlay..."
41+
if ! cargo clippy -- -D warnings; then
42+
echo "❌ Clippy check failed for kata overlay."
43+
exit 1
44+
fi
45+
echo "✅ Clippy check passed for kata overlay."
46+
47+
- name: Run Clippy on tardev-snapshotter
48+
working-directory: src/tardev-snapshotter
49+
run: |
50+
echo "Running Clippy on tardev-snapshotter..."
51+
if ! cargo clippy -- -D warnings; then
52+
echo "❌ Clippy check failed for tardev-snapshotter."
53+
exit 1
54+
fi
55+
echo "✅ Clippy check passed for tardev-snapshotter."

‎.github/workflows/nancy.yaml‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Release Static Checks / Go Dependency Check (Nancy)
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- msft-main
7+
8+
jobs:
9+
nancy:
10+
name: Run Nancy SDL Check on Go Dependencies
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- name: Checkout Repository
15+
uses: actions/checkout@v4
16+
17+
- name: Set up Go
18+
uses: actions/setup-go@v5
19+
with:
20+
go-version: stable # Use latest stable Go version
21+
22+
- name: Install Nancy via Go
23+
run: |
24+
echo "Installing Nancy..."
25+
go install github.com/sonatype-nexus-community/nancy@latest
26+
echo "$HOME/go/bin" >> $GITHUB_PATH
27+
28+
- name: Verify Nancy Installation
29+
run: |
30+
echo "Checking Nancy installation..."
31+
nancy --help || echo "Nancy installed successfully!"
32+
33+
- name: Run Nancy on `src/runtime`
34+
working-directory: src/runtime
35+
run: |
36+
echo "Running Nancy vulnerability scan on Go dependencies..."
37+
go list -m all | nancy sleuth

0 commit comments

Comments
 (0)