diff --git a/.forgejo/workflows/nyxscanner.yml b/.forgejo/workflows/nyxscanner.yml index c508ca4..2ee672c 100644 --- a/.forgejo/workflows/nyxscanner.yml +++ b/.forgejo/workflows/nyxscanner.yml @@ -17,59 +17,16 @@ jobs: git fetch --depth=1 origin ${{ github.sha }} git checkout ${{ github.sha }} - - name: Clone nyx from Forgejo mirror + - name: Fetch action source run: | git clone --depth=1 --branch master \ - "https://oauth2:${{ github.token }}@bitfreedom.net/code/apunkt/nyx.git" \ - .nyx-src + "https://oauth2:${{ github.token }}@bitfreedom.net/code/nomyo-ai/actions.git" \ + ./.nyx-action - - name: Install Rust - run: | - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable - echo "$HOME/.cargo/bin" >> $GITHUB_PATH - - - name: Build nyx from source - run: | - cd .nyx-src - cargo build --release - - - name: Run NYX scan - id: nyx - run: | - .nyx-src/target/release/nyx scan --format sarif --fail-on LOW > nyx-results.sarif 2>&1 - continue-on-error: true - - - name: Post findings as PR comment - if: steps.nyx.outcome == 'failure' - run: | - FINDINGS=$(python3 -c " - import json, sys - - with open('nyx-results.sarif') as f: - data = json.load(f) - - results = data.get('runs', [{}])[0].get('results', []) - - lines = [f'## 🔴 NYX found {len(results)} issue(s)\n'] - for r in results: - level = r.get('level', '?') - msg = r.get('message', {}).get('text', '?') - rule = r.get('ruleId', '?') - loc = r.get('locations', [{}])[0].get('physicalLocation', {}) - path = loc.get('artifactLocation', {}).get('uri', '?') - line = loc.get('region', {}).get('startLine', '?') - col = loc.get('region', {}).get('startColumn', '?') - lines.append(f'- **{level.upper()}** \`{path}:{line}:{col}\` [{rule}] — {msg}') - - print('\n'.join(lines)) - ") - - curl -sf -X POST \ - -H "Authorization: token ${{ secrets.FORGEJO_PUSH_TOKEN }}" \ - -H "Content-Type: application/json" \ - "https://bitfreedom.net/code/api/v1/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ - -d "{\"body\": $(python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))' <<< "$FINDINGS")}" - - - name: Fail if HIGH or above findings found - if: steps.nyx.outcome == 'failure' - run: exit 1 \ No newline at end of file + - uses: ./.nyx-action/nyx-scan + with: + forgejo_push_token: ${{ secrets.FORGEJO_PUSH_TOKEN }} + repository: ${{ github.repository }} + pr_number: ${{ github.event.pull_request.number }} + sha: ${{ github.sha }} + fail_on: HIGH \ No newline at end of file