diff --git a/.github/workflows/apply-library-repo-templates.yml b/.github/workflows/apply-library-repo-templates.yml index cd241cbc..27cf91cd 100644 --- a/.github/workflows/apply-library-repo-templates.yml +++ b/.github/workflows/apply-library-repo-templates.yml @@ -62,7 +62,7 @@ jobs: token: ${{ secrets.BALLERINA_BOT_TOKEN }} - name: Setup Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: version: latest diff --git a/.github/workflows/build-connector-template.yml b/.github/workflows/build-connector-template.yml index fad1631d..84e91a19 100644 --- a/.github/workflows/build-connector-template.yml +++ b/.github/workflows/build-connector-template.yml @@ -41,7 +41,7 @@ jobs: echo "Ballerina Version: $BAL_VERSION" - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: version: ${{ env.BAL_VERSION }} diff --git a/.github/workflows/build-with-bal-test-graalvm-connector-template.yml b/.github/workflows/build-with-bal-test-graalvm-connector-template.yml index 895f2226..b703879b 100644 --- a/.github/workflows/build-with-bal-test-graalvm-connector-template.yml +++ b/.github/workflows/build-with-bal-test-graalvm-connector-template.yml @@ -22,9 +22,9 @@ jobs: uses: actions/checkout@v3 - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: - version: latest + version: nightly - name: Set up GraalVM uses: graalvm/setup-graalvm@v1 @@ -45,7 +45,7 @@ jobs: echo -e '${{ toJson(secrets) }}' | jq -r 'to_entries[] | .key + "=" + .value' >> $GITHUB_ENV - name: Build Package - run: ./gradlew build ${{ inputs.additional-build-flags }} + run: ./gradlew build ${{ inputs.additional-build-flags }} -PignoreVersionMismatch env: packageUser: ${{ github.actor }} packagePAT: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/daily-build-connector-template.yml b/.github/workflows/daily-build-connector-template.yml index ba77c7fb..2c483284 100644 --- a/.github/workflows/daily-build-connector-template.yml +++ b/.github/workflows/daily-build-connector-template.yml @@ -27,9 +27,9 @@ jobs: uses: actions/checkout@v3 - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: - version: latest + version: nightly - name: Set up JDK 21 uses: actions/setup-java@v3 @@ -46,14 +46,14 @@ jobs: packageUser: ${{ github.actor }} packagePAT: ${{ secrets.GITHUB_TOKEN }} run: | - ./gradlew build -x test ${{ inputs.additional-build-flags }} -PbuildUsingDocker=nightly + ./gradlew build -x test ${{ inputs.additional-build-flags }} -PignoreVersionMismatch - name: Test the Package env: packageUser: ${{ github.actor }} packagePAT: ${{ secrets.GITHUB_TOKEN }} run: | - ./gradlew test ${{ inputs.additional-test-flags }} -PbuildUsingDocker=nightly + ./gradlew test ${{ inputs.additional-test-flags }} -PignoreVersionMismatch # Send notification when build fails - name: Notify failure diff --git a/.github/workflows/dev-stage-central-publish-connector-template.yml b/.github/workflows/dev-stage-central-publish-connector-template.yml index 6b1cc7a3..4476259f 100644 --- a/.github/workflows/dev-stage-central-publish-connector-template.yml +++ b/.github/workflows/dev-stage-central-publish-connector-template.yml @@ -29,7 +29,7 @@ jobs: echo "Ballerina Version: $BAL_VERSION" - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: version: ${{ env.BAL_VERSION }} diff --git a/.github/workflows/pr-build-connector-template.yml b/.github/workflows/pr-build-connector-template.yml index 74b0be7b..16240327 100644 --- a/.github/workflows/pr-build-connector-template.yml +++ b/.github/workflows/pr-build-connector-template.yml @@ -34,7 +34,7 @@ jobs: echo "Ballerina Version: $BAL_VERSION" - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: version: ${{ env.BAL_VERSION }} diff --git a/.github/workflows/release-package-connector-template.yml b/.github/workflows/release-package-connector-template.yml index 74c62090..0ad0e7f0 100644 --- a/.github/workflows/release-package-connector-template.yml +++ b/.github/workflows/release-package-connector-template.yml @@ -41,7 +41,7 @@ jobs: echo "Ballerina Version: $BAL_VERSION" - name: Set Up Ballerina - uses: ballerina-platform/setup-ballerina@v1.1.0 + uses: ballerina-platform/setup-ballerina@v1.1.3 with: version: ${{ env.BAL_VERSION }} diff --git a/.github/workflows/trivy-scan-connector-template.yml b/.github/workflows/trivy-scan-connector-template.yml new file mode 100644 index 00000000..a480934b --- /dev/null +++ b/.github/workflows/trivy-scan-connector-template.yml @@ -0,0 +1,60 @@ +name: Trivy + +on: + workflow_call: + inputs: + additional-build-flags: + required: false + type: string + default: "" + +jobs: + ubuntu-build: + name: Build on Ubuntu + runs-on: ubuntu-latest + if: github.repository_owner == 'ballerina-platform' + steps: + - uses: actions/checkout@v3 + + - name: Get Ballerina Version + run: | + BAL_VERSION=$(grep -w 'ballerinaLangVersion' gradle.properties | cut -d= -f2 | rev | cut --complement -d- -f1 | rev) + if [ -z "$BAL_VERSION" ]; then + BAL_VERSION="latest" + fi + echo "BAL_VERSION=$BAL_VERSION" >> $GITHUB_ENV + echo "Ballerina Version: $BAL_VERSION" + + - name: Set Up Ballerina + uses: ballerina-platform/setup-ballerina@v1.1.3 + with: + version: ${{ env.BAL_VERSION }} + + - name: Set up JDK 21 + uses: actions/setup-java@v3 + with: + distribution: "temurin" + java-version: 21.0.3 + + - name: Build with Gradle + env: + packageUser: ${{ secrets.BALLERINA_BOT_USERNAME }} + packagePAT: ${{ secrets.BALLERINA_BOT_TOKEN }} + run: ./gradlew build -x test ${{ inputs.additional-build-flags }} + + - name: Create lib directory if not exists + run: mkdir -p ballerina/lib + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + env: + TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db + with: + scan-type: "rootfs" + scan-ref: "${{ github.workspace }}/ballerina/lib" + format: "table" + timeout: "10m0s" + exit-code: "1" + scanners: "vuln" + cache-dir: "/tmp/trivy-cache"