VulnerabilitiesLab/.github/workflows/docker_publish.yml at master · ForAllSecure/VulnerabilitiesLab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Published on Dockerhub

on:
  push:
    branches: [ master ]
  pull_request:
    branches: [ master ]

jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      # By disabling fail-fast, we can see the result of all projects rather than
      # stopping everything if one project fails.
      fail-fast: false

      # This can help limit the number of jobs queued in Mayhem if the
      # GH Actions workflow is cancelled before completion.
      max-parallel: 8

      matrix:
        #
        # These values map to each sub-folder under the repository
        # root that contains a runnable project. This list needs to be
        # maintained whenever a target is added/removed.
        #
        # It may be possible for this list to be dynamic using fromJson().
        # See https://github.blog/changelog/2020-04-15-github-actions-new-workflow-features/
        #
        project:
          - libm-cve-2020-10029
          - cereal-cve-2020-11104-11105
          - jq-defect-2020
          - matio-cve-2019-13107
          - netflix-cve-2019-10028
          - objdump-cve-2017-124xx
          - oniguruma-cve-2019-13224-13225
          - openssl-cve-2014-0160
          - stb-cve-2019-132xx
          - sthttpd-cve-2017-10671
          - uboot-cve-2019-13103-13106
          - sixlibrary-defect-2020
          - ncsahttpd-cve-1999-0067
    steps:
    - name: Install tools
      run: sudo apt-get install jq

    - name: Checkout
      uses: actions/checkout@v2

    - name: Set docker registry (master)
      if: github.ref == 'refs/heads/master'
      run: |
        echo "IMAGE_TAG=forallsecure/${{ matrix.project }}:latest" >> $GITHUB_ENV

    - name: Set docker registry (pull request)
      if: github.ref != 'refs/heads/master'
      run: |
        echo 'DOCKER_REGISTRY<<EOF' >> $GITHUB_ENV
        echo "${{ secrets.MAYHEM_URL }}":5000 |sed -e "s|^https://||" >> $GITHUB_ENV
        echo 'EOF' >> $GITHUB_ENV

        echo 'IMAGE_TAG<<EOF' >> $GITHUB_ENV
        echo $(echo "${{ secrets.MAYHEM_URL }}":5000 |sed -e "s|^https://||")/${{ matrix.project }}:${{ github.head_ref}} >> $GITHUB_ENV
        echo 'EOF' >> $GITHUB_ENV

    - name: Fetch the Mayhem CLI
      run: |
        mkdir -p $GITHUB_WORKSPACE/bin
        wget -q -O $GITHUB_WORKSPACE/bin/mayhem "${{ secrets.MAYHEM_URL }}/cli/Linux/mayhem"
        echo $GITHUB_WORKSPACE/bin >> $GITHUB_PATH
        chmod a+x $GITHUB_WORKSPACE/bin/mayhem

    - name: Sanity Check
      run: ./mayhemit.sh --sanity ${{ matrix.project }}

    - name: Log in to Mayhem
      run: mayhem login "${{ secrets.MAYHEM_URL }}" "${{ secrets.MAYHEM_TOKEN }}"

    - name: Log into DockerHub (master)
      if: github.ref == 'refs/heads/master'
      run: ./.github/docker-login.sh "${{ secrets.DOCKER_USERNAME }}" "${{ secrets.DOCKER_PASSWORD }}"

    - name: Log into Mayhem Docker Registry (pull request)
      if: github.ref != 'refs/heads/master'
      run: docker login -u mayhem -p "${{ secrets.MAYHEM_TOKEN }}" $DOCKER_REGISTRY

    - name: Build the Docker image
      run: ./mayhemit.sh --rewrite $IMAGE_TAG --build ${{ matrix.project }}

    - name: Push the docker image
      run: docker push $IMAGE_TAG

    - name: Run Mayhem (master)
      if: github.ref == 'refs/heads/master'
      run: ./mayhemit.sh --run --copy-poc ${{ matrix.project }}

    - name: Run Mayhem (pull request)
      if: github.ref != 'refs/heads/master'
      run: ./mayhemit.sh --run --copy-poc --min-crashes 1 --target "${{ github.sha }}" ${{ matrix.project }}