Skip to content
This repository was archived by the owner on Dec 2, 2024. It is now read-only.

Commit 6bd2d7d

Browse files
author
Derek Lee
committed
github-actions: Add cargo-deny
Adds cargo-deny to scan for vulnerabilities and license issues regarding rust crates. Some modifications were required for the repo to pass the tests: Updates ttrpc to avoid using nix 0.16.0 https://rustsec.org/advisories/RUSTSEC-2021-0119 Updates slog-json to avoid MLP license (copyleft) Updates crossbeam-channel due to yanked package Ignores https://rustsec.org/advisories/RUSTSEC-2020-0071 because chrono is dependent on that version of time. chronotope/chrono#578 Allow multiple versions of the same package (package dependencies require this) Adds "oci" to src/libs workplace Adds Apache-2.0 license to workplace modules that did not have them because cargo-deny complains about them not having licenses. Notes GitHub Actions does not have an obvious way to loop over each of the Cargo.toml files, so they have been hardcoded as separate steps. An alternative that works is to use a matrix variable to run each directory in a separate job. I opted not to do that because it uses a bunch of runners and generates a lot of jobs, but open to feedback. Signed-off-by: Derek Lee <[email protected]>
1 parent 0a9c8ca commit 6bd2d7d

File tree

21 files changed

+401
-212
lines changed

21 files changed

+401
-212
lines changed

‎.github/cargo-deny-composite-action/action.yaml

+86
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: 'Cargo Crates Check'
2+
description: 'Checks every Cargo.toml file using cargo-deny'
3+
inputs:
4+
command:
5+
description: Either 'advisories' or 'bans licenses sources'
6+
required: true
7+
8+
runs:
9+
using: "composite"
10+
steps:
11+
- uses: actions/checkout@v3
12+
with:
13+
path: ${{ github.repository }}
14+
# https://github.com/actions/runner/issues/1300
15+
16+
- name: src/agent/Cargo.toml
17+
uses: EmbarkStudios/cargo-deny-action@v1
18+
with:
19+
arguments: --manifest-path "./cargo-deny-action-copy/src/agent/Cargo.toml"
20+
command: check ${{ inputs.command }}
21+
22+
- name: src/agent/rustjail/Cargo.toml
23+
uses: EmbarkStudios/cargo-deny-action@v1
24+
with:
25+
arguments: --manifest-path "./cargo-deny-action-copy/src/agent/rustjail/Cargo.toml"
26+
command: check ${{ inputs.command }}
27+
28+
- name: src/agent/vsock-exporter/Cargo.toml
29+
uses: EmbarkStudios/cargo-deny-action@v1
30+
with:
31+
arguments: --manifest-path "./cargo-deny-action-copy/src/agent/vsock-exporter/Cargo.toml"
32+
command: check ${{ inputs.command }}
33+
34+
- name: src/libs/logging/Cargo.toml
35+
uses: EmbarkStudios/cargo-deny-action@v1
36+
with:
37+
arguments: --manifest-path "./cargo-deny-action-copy/src/libs/logging/Cargo.toml"
38+
command: check ${{ inputs.command }}
39+
40+
- name: src/libs/oci/Cargo.toml
41+
uses: EmbarkStudios/cargo-deny-action@v1
42+
with:
43+
arguments: --manifest-path "./cargo-deny-action-copy/src/libs/oci/Cargo.toml"
44+
command: check ${{ inputs.command }}
45+
46+
- name: src/libs/protocols/Cargo.toml
47+
uses: EmbarkStudios/cargo-deny-action@v1
48+
with:
49+
arguments: --manifest-path "./cargo-deny-action-copy/src/libs/protocols/Cargo.toml"
50+
command: check ${{ inputs.command }}
51+
52+
- name: src/libs/safe-path/Cargo.toml
53+
uses: EmbarkStudios/cargo-deny-action@v1
54+
with:
55+
arguments: --manifest-path "./cargo-deny-action-copy/src/libs/safe-path/Cargo.toml"
56+
command: check ${{ inputs.command }}
57+
58+
- name: src/libs/Cargo.toml
59+
uses: EmbarkStudios/cargo-deny-action@v1
60+
with:
61+
arguments: --manifest-path "./cargo-deny-action-copy/src/libs/Cargo.toml"
62+
command: check ${{ inputs.command }}
63+
64+
- name: src/tools/agent-ctl/Cargo.toml
65+
uses: EmbarkStudios/cargo-deny-action@v1
66+
with:
67+
arguments: --manifest-path "./cargo-deny-action-copy/src/tools/agent-ctl/Cargo.toml"
68+
command: check ${{ inputs.command }}
69+
70+
- name: src/tools/runk/libcontainer/Cargo.toml
71+
uses: EmbarkStudios/cargo-deny-action@v1
72+
with:
73+
arguments: --manifest-path "./cargo-deny-action-copy/src/tools/runk/libcontainer/Cargo.toml"
74+
command: check ${{ inputs.command }}
75+
76+
- name: src/tools/runk/Cargo.toml
77+
uses: EmbarkStudios/cargo-deny-action@v1
78+
with:
79+
arguments: --manifest-path "./cargo-deny-action-copy/src/tools/runk/Cargo.toml"
80+
command: check ${{ inputs.command }}
81+
82+
- name: src/tools/trace-forwarder/Cargo.toml
83+
uses: EmbarkStudios/cargo-deny-action@v1
84+
with:
85+
arguments: --manifest-path "./cargo-deny-action-copy/src/tools/trace-forwarder/Cargo.toml"
86+
command: check ${{ inputs.command }}

‎.github/cargo-deny-composite-action/cargo-deny-action.yaml

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Cargo Crates Check
2+
on: [pull_request]
3+
jobs:
4+
cargo-deny:
5+
runs-on: ubuntu-latest
6+
strategy:
7+
matrix:
8+
checks:
9+
- advisories
10+
- bans licenses sources
11+
12+
continue-on-error: true
13+
14+
steps:
15+
- uses: actions/checkout@v3
16+
17+
- name: src/agent/Cargo.toml
18+
uses: EmbarkStudios/cargo-deny-action@v1
19+
with:
20+
arguments: --manifest-path ./src/agent/Cargo.toml
21+
command: check ${{ matrix.checks }}
22+
23+
- name: src/agent/rustjail/Cargo.toml
24+
uses: EmbarkStudios/cargo-deny-action@v1
25+
with:
26+
arguments: --manifest-path ./src/agent/rustjail/Cargo.toml
27+
command: check ${{ matrix.checks }}
28+
29+
- name: src/agent/vsock-exporter/Cargo.toml
30+
uses: EmbarkStudios/cargo-deny-action@v1
31+
with:
32+
arguments: --manifest-path ./src/agent/vsock-exporter/Cargo.toml
33+
command: check ${{ matrix.checks }}
34+
35+
- name: src/libs/logging/Cargo.toml
36+
uses: EmbarkStudios/cargo-deny-action@v1
37+
with:
38+
arguments: --manifest-path ./src/libs/logging/Cargo.toml
39+
command: check ${{ matrix.checks }}
40+
41+
- name: src/libs/oci/Cargo.toml
42+
uses: EmbarkStudios/cargo-deny-action@v1
43+
with:
44+
arguments: --manifest-path ./src/libs/oci/Cargo.toml
45+
command: check ${{ matrix.checks }}
46+
47+
- name: src/libs/protocols/Cargo.toml
48+
uses: EmbarkStudios/cargo-deny-action@v1
49+
with:
50+
arguments: --manifest-path ./src/libs/protocols/Cargo.toml
51+
command: check ${{ matrix.checks }}
52+
53+
- name: src/libs/safe-path/Cargo.toml
54+
uses: EmbarkStudios/cargo-deny-action@v1
55+
with:
56+
arguments: --manifest-path ./src/libs/safe-path/Cargo.toml
57+
command: check ${{ matrix.checks }}
58+
59+
- name: src/libs/Cargo.toml
60+
uses: EmbarkStudios/cargo-deny-action@v1
61+
with:
62+
arguments: --manifest-path ./src/libs/Cargo.toml
63+
command: check ${{ matrix.checks }}
64+
65+
- name: src/tools/agent-ctl/Cargo.toml
66+
uses: EmbarkStudios/cargo-deny-action@v1
67+
with:
68+
arguments: --manifest-path ./src/tools/agent-ctl/Cargo.toml
69+
command: check ${{ matrix.checks }}
70+
71+
- name: src/tools/runk/libcontainer/Cargo.toml
72+
uses: EmbarkStudios/cargo-deny-action@v1
73+
with:
74+
arguments: --manifest-path ./src/tools/runk/libcontainer/Cargo.toml
75+
command: check ${{ matrix.checks }}
76+
77+
- name: src/tools/runk/Cargo.toml
78+
uses: EmbarkStudios/cargo-deny-action@v1
79+
with:
80+
arguments: --manifest-path ./src/tools/runk/Cargo.toml
81+
command: check ${{ matrix.checks }}
82+
83+
- name: src/tools/trace-forwarder/Cargo.toml
84+
uses: EmbarkStudios/cargo-deny-action@v1
85+
with:
86+
arguments: --manifest-path ./src/tools/trace-forwarder/Cargo.toml
87+
command: check ${{ matrix.checks }}

‎.github/cargo-deny-composite-action/cargo-deny-generator.sh

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
#!/bin/bash
2+
script_dir=$(dirname "$(readlink -f "$0")")
3+
parent_dir=$(realpath "${script_dir}/../..")
4+
cargo_tomls=$(find "${parent_dir}" -name Cargo.toml)
5+
6+
temp_checkout_dir="./cargo-deny-action-copy"
7+
8+
cargo_deny_file="${script_dir}/action.yaml"
9+
10+
cat cargo-deny-skeleton.yaml.in > "${cargo_deny_file}"
11+
12+
for path in $cargo_tomls
13+
do
14+
path=$(realpath --relative-to="${parent_dir}" "${path}")
15+
16+
cat >> "${cargo_deny_file}" << EOF
17+
18+
- name: ${path}
19+
uses: EmbarkStudios/cargo-deny-action@v1
20+
with:
21+
arguments: --manifest-path "${temp_checkout_dir}/${path}"
22+
command: check \${{ inputs.command }}
23+
EOF
24+
done

‎.github/cargo-deny-composite-action/cargo-deny-skeleton.yaml.in

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: 'Cargo Crates Check'
2+
description: 'Checks every Cargo.toml file using cargo-deny'
3+
inputs:
4+
command:
5+
description: Either 'advisories' or 'bans licenses sources'
6+
required: true
7+
8+
runs:
9+
using: "composite"
10+
steps:
11+
- uses: actions/checkout@v3
12+
path: ./cargo-deny-action-copy/
13+
# https://github.com/actions/runner/issues/1300
14+

‎.github/workflows/.old-cargo-deny.yaml

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Cargo Crates Check
2+
on: [pull_request]
3+
jobs:
4+
cargo-deny:
5+
runs-on: ubuntu-latest
6+
strategy:
7+
matrix:
8+
checks:
9+
- advisories
10+
- bans licenses sources
11+
12+
continue-on-error: true
13+
14+
# Github Actions does not have a clean way of looping
15+
# Could use matrix, but leads to 12+ jobs being run separately
16+
17+
steps:
18+
- uses: actions/checkout@v2
19+
20+
- name: src/agent/Cargo.toml
21+
uses: EmbarkStudios/cargo-deny-action@v1
22+
with:
23+
arguments: --manifest-path ./src/agent/Cargo.toml
24+
command: check ${{ matrix.checks }}
25+
26+
- name: src/agent/rustjail/Cargo.toml
27+
uses: EmbarkStudios/cargo-deny-action@v1
28+
with:
29+
arguments: --manifest-path ./src/agent/rustjail/Cargo.toml
30+
command: check ${{ matrix.checks }}
31+
32+
- name: src/agent/vsock-exporter/Cargo.toml
33+
uses: EmbarkStudios/cargo-deny-action@v1
34+
with:
35+
arguments: --manifest-path ./src/agent/vsock-exporter/Cargo.toml
36+
command: check ${{ matrix.checks }}
37+
38+
- name: src/libs/logging/Cargo.toml
39+
uses: EmbarkStudios/cargo-deny-action@v1
40+
with:
41+
arguments: --manifest-path ./src/libs/logging/Cargo.toml
42+
command: check ${{ matrix.checks }}
43+
44+
- name: src/libs/oci/Cargo.toml
45+
uses: EmbarkStudios/cargo-deny-action@v1
46+
with:
47+
arguments: --manifest-path ./src/libs/oci/Cargo.toml
48+
command: check ${{ matrix.checks }}
49+
50+
- name: src/libs/protocols/Cargo.toml
51+
uses: EmbarkStudios/cargo-deny-action@v1
52+
with:
53+
arguments: --manifest-path ./src/libs/protocols/Cargo.toml
54+
command: check ${{ matrix.checks }}
55+
56+
- name: src/libs/safe-path/Cargo.toml
57+
uses: EmbarkStudios/cargo-deny-action@v1
58+
with:
59+
arguments: --manifest-path ./src/libs/safe-path/Cargo.toml
60+
command: check ${{ matrix.checks }}
61+
62+
- name: src/libs/Cargo.toml
63+
uses: EmbarkStudios/cargo-deny-action@v1
64+
with:
65+
arguments: --manifest-path ./src/libs/Cargo.toml
66+
command: check ${{ matrix.checks }}
67+
68+
- name: src/tools/agent-ctl/Cargo.toml
69+
uses: EmbarkStudios/cargo-deny-action@v1
70+
with:
71+
arguments: --manifest-path ./src/tools/agent-ctl/Cargo.toml
72+
command: check ${{ matrix.checks }}
73+
74+
- name: src/tools/runk/libcontainer/Cargo.toml
75+
uses: EmbarkStudios/cargo-deny-action@v1
76+
with:
77+
arguments: --manifest-path ./src/tools/runk/libcontainer/Cargo.toml
78+
command: check ${{ matrix.checks }}
79+
80+
- name: src/tools/runk/Cargo.toml
81+
uses: EmbarkStudios/cargo-deny-action@v1
82+
with:
83+
arguments: --manifest-path ./src/tools/runk/Cargo.toml
84+
command: check ${{ matrix.checks }}
85+
86+
- name: src/tools/trace-forwarder/Cargo.toml
87+
uses: EmbarkStudios/cargo-deny-action@v1
88+
with:
89+
arguments: --manifest-path ./src/tools/trace-forwarder/Cargo.toml
90+
command: check ${{ matrix.checks }}

‎.github/workflows/cargo-deny-master.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Cargo Crates Check
2+
on: [pull_request]
3+
jobs:
4+
cargo-deny-master:
5+
runs-on: ubuntu-latest
6+
strategy:
7+
matrix:
8+
checks:
9+
- advisories
10+
- bans licenses sources
11+
12+
# continue-on-error: ${{ matrix.checks = 'advisories' }}
13+
14+
steps:
15+
- uses: actions/checkout@v3
16+
with:
17+
path: ./.github/cargo-deny-action/
18+
- uses: ./.github/cargo-deny-action/
19+
with:
20+
command: ${{ matrix.checks }}

‎.github/workflows/cargo-deny.yaml

-34
This file was deleted.

0 commit comments

Comments
 (0)