Skip to content

CVE scanning enhancement #8437

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
stutiibm wants to merge 7 commits into
base: master
Choose a base branch
from
Open

CVE scanning enhancement #8437

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
da6d749
feat: add generalised CVE scanner for wheels with bundled .so files
stutiibm Jul 19, 2026
424ef2d
feat: invoke CVE scanner after auditwheel repair in create_wheel_wrap…
stutiibm Jul 19, 2026
b2b9893
feat: upload CVE report to COS after each wheel build
stutiibm Jul 19, 2026
f1750dc
Update create_wheel_wrapper.sh
stutiibm Jul 19, 2026
272782a
Fix exit command formatting in create_wheel_wrapper.sh
stutiibm Jul 19, 2026
a8059a7
Refactor CVE scanner path handling in script
stutiibm Jul 19, 2026
66b3262
Implement CVE report renaming after wheel processing
stutiibm Jul 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
104 changes: 102 additions & 2 deletions .github/workflows/currency-build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -253,6 +253,26 @@ jobs:
exit 1
fi

- name: Upload CVE report to COS
env:
GHA_CURRENCY_SERVICE_ID_API_KEY: ${{ secrets.GHA_CURRENCY_SERVICE_ID_API_KEY }}
run: |
WHEEL_FILE=$(ls *.whl 2>/dev/null | head -n 1)
if [ -n "$WHEEL_FILE" ]; then
CVE_REPORT="${WHEEL_FILE%.whl}_cve_report.json"
if [ -f "$CVE_REPORT" ]; then
echo "Uploading CVE report: $CVE_REPORT"
source package-cache/variable.sh
source package-cache/scanner-env.sh
chmod +x ./gha-script/upload-scripts/upload_file.sh
bash ./gha-script/upload-scripts/upload_file.sh "$CVE_REPORT"
else
echo "WARNING: CVE report not found: $CVE_REPORT — skipping upload."
fi
else
echo "WARNING: No wheel found — skipping CVE report upload."
fi

wheel_build_py311:
needs: build_info
if: ${{ inputs.wheel_build == 'true' }}
Expand Down Expand Up @@ -340,6 +360,26 @@ jobs:
exit 1
fi

- name: Upload CVE report to COS
env:
GHA_CURRENCY_SERVICE_ID_API_KEY: ${{ secrets.GHA_CURRENCY_SERVICE_ID_API_KEY }}
run: |
WHEEL_FILE=$(ls *.whl 2>/dev/null | head -n 1)
if [ -n "$WHEEL_FILE" ]; then
CVE_REPORT="${WHEEL_FILE%.whl}_cve_report.json"
if [ -f "$CVE_REPORT" ]; then
echo "Uploading CVE report: $CVE_REPORT"
source package-cache/variable.sh
source package-cache/scanner-env.sh
chmod +x ./gha-script/upload-scripts/upload_file.sh
bash ./gha-script/upload-scripts/upload_file.sh "$CVE_REPORT"
else
echo "WARNING: CVE report not found: $CVE_REPORT — skipping upload."
fi
else
echo "WARNING: No wheel found — skipping CVE report upload."
fi

wheel_build_py312:
needs: build_info
if: ${{ inputs.wheel_build == 'true' }}
Expand Down Expand Up @@ -426,7 +466,27 @@ jobs:
echo "No wheel file found!"
exit 1
fi


- name: Upload CVE report to COS
env:
GHA_CURRENCY_SERVICE_ID_API_KEY: ${{ secrets.GHA_CURRENCY_SERVICE_ID_API_KEY }}
run: |
WHEEL_FILE=$(ls *.whl 2>/dev/null | head -n 1)
if [ -n "$WHEEL_FILE" ]; then
CVE_REPORT="${WHEEL_FILE%.whl}_cve_report.json"
if [ -f "$CVE_REPORT" ]; then
echo "Uploading CVE report: $CVE_REPORT"
source package-cache/variable.sh
source package-cache/scanner-env.sh
chmod +x ./gha-script/upload-scripts/upload_file.sh
bash ./gha-script/upload-scripts/upload_file.sh "$CVE_REPORT"
else
echo "WARNING: CVE report not found: $CVE_REPORT — skipping upload."
fi
else
echo "WARNING: No wheel found — skipping CVE report upload."
fi

wheel_build_py313:
needs: build_info
if: ${{ inputs.wheel_build == 'true' }}
Expand Down Expand Up @@ -515,6 +575,26 @@ jobs:
exit 1
fi

- name: Upload CVE report to COS
env:
GHA_CURRENCY_SERVICE_ID_API_KEY: ${{ secrets.GHA_CURRENCY_SERVICE_ID_API_KEY }}
run: |
WHEEL_FILE=$(ls *.whl 2>/dev/null | head -n 1)
if [ -n "$WHEEL_FILE" ]; then
CVE_REPORT="${WHEEL_FILE%.whl}_cve_report.json"
if [ -f "$CVE_REPORT" ]; then
echo "Uploading CVE report: $CVE_REPORT"
source package-cache/variable.sh
source package-cache/scanner-env.sh
chmod +x ./gha-script/upload-scripts/upload_file.sh
bash ./gha-script/upload-scripts/upload_file.sh "$CVE_REPORT"
else
echo "WARNING: CVE report not found: $CVE_REPORT — skipping upload."
fi
else
echo "WARNING: No wheel found — skipping CVE report upload."
fi

wheel_build_py314:
needs: build_info
if: ${{ inputs.wheel_build == 'true' }}
Expand Down Expand Up @@ -601,7 +681,27 @@ jobs:
else
echo "No wheel file found!"
exit 1
fi
fi

- name: Upload CVE report to COS
env:
GHA_CURRENCY_SERVICE_ID_API_KEY: ${{ secrets.GHA_CURRENCY_SERVICE_ID_API_KEY }}
run: |
WHEEL_FILE=$(ls *.whl 2>/dev/null | head -n 1)
if [ -n "$WHEEL_FILE" ]; then
CVE_REPORT="${WHEEL_FILE%.whl}_cve_report.json"
if [ -f "$CVE_REPORT" ]; then
echo "Uploading CVE report: $CVE_REPORT"
source package-cache/variable.sh
source package-cache/scanner-env.sh
chmod +x ./gha-script/upload-scripts/upload_file.sh
bash ./gha-script/upload-scripts/upload_file.sh "$CVE_REPORT"
else
echo "WARNING: CVE report not found: $CVE_REPORT — skipping upload."
fi
else
echo "WARNING: No wheel found — skipping CVE report upload."
fi

wheel_licenses:
if: ${{ always() && inputs.wheel_build == 'true' }}
Expand Down
37 changes: 35 additions & 2 deletions gha-script/create_wheel_wrapper.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -321,6 +321,28 @@ fi
cd "$CURRENT_DIR"
wheel_final=(*.whl)

echo
echo "============== Running CVE scan on: ${wheel_final} =============="
echo

# Run CVE scanner — passes wheel + original build script so Lane 3 can parse
# git clone/checkout lines for source-built lib names and versions.
# Scanner is non-blocking — failure does not stop the build.
SCANNER_PATH="gha-script/generalized_wheel_scanner.py"
if [ -f "$SCANNER_PATH" ]; then
if python "$SCANNER_PATH" "${wheel_final}" "${BUILD_SCRIPT_PATH}"; then
echo
echo "===> CVE scan completed successfully."
echo
else
echo
echo "===> WARNING: CVE scan failed. Continuing build."
echo
fi
else
echo "===> WARNING: $SCANNER_PATH not found, skipping CVE scan."
fi

echo
echo "============== Generating sha for: ${wheel_final} =============="
echo
Expand All @@ -334,16 +356,27 @@ echo
echo "=== Post Processing wheel ${wheel_final} with SHA: ${SHA256_VALUE} ==="
echo

# Save CVE report name before post-processing renames the wheel
cve_report_old="${wheel_final%.whl}_cve_report.json"

# post processing of wheels (Suffix addition, license addition, metadata addition)
if python ${POST_PROCESS_SCRIPT_PATH} ${wheel_final} ${SHA256_VALUE}; then
echo
echo
echo "===> SUCCESS: Wheels post process successfully."
echo
else
echo
echo "===> ERROR: Failed to post process wheels."
echo
exit 1
exit 1
fi

# Rename CVE report to match the post-processed wheel filename
wheel_post_processed=(*.whl)
cve_report_new="${wheel_post_processed[0]%.whl}_cve_report.json"
if [ -f "$cve_report_old" ] && [ "$cve_report_old" != "$cve_report_new" ]; then
mv "$cve_report_old" "$cve_report_new"
echo "===> CVE report renamed: $cve_report_old → $cve_report_new"
fi

echo
Expand Down
Loading
Loading