Public Access
generated from Philipp/template-git
Philipp
77357f0c3f
CI Tests / JS Unit Tests (pull_request) Successful in 46s
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m54s
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Failing after 3m22s
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 2m38s
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Failing after 4m21s
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Failing after 5m36s
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Failing after 6m47s
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 2m59s
Extract ~450 lines of complex bash from action.yaml into modular, unit-tested Node.js scripts in lib/. All logic is covered by 26 native node:test unit tests (node --test, no external dependencies). Modules added: - lib/platforms.js - platform parsing and OCI manifest auto-discovery - lib/distro.js - SPDX PURL distro detection (os_name/os_version) - lib/verifier.js - Trivy arch mapping and SHA256 verification - lib/diagnostics.js - CI terminal diagnostic formatters - lib/install-trivy.js - Trivy install/verify entrypoint (replaces bash step) - lib/extract-sboms.js - SBOM extraction entrypoint (replaces bash step) - lib/scan-sboms.js - SBOM scan + diff entrypoint (replaces bash step) Tests added (all pass, auto-discovered by ode --test): - test/platforms.test.js - test/distro.test.js - test/verifier.test.js - test/diagnostics.test.js - test/orchestration.test.js action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node scripts via INPUT_* env vars so modules are fully decoupled from the Actions runner and testable in isolation.
40 lines
1.7 KiB
JavaScript
40 lines
1.7 KiB
JavaScript
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
const fs = require('node:fs');
|
|
const path = require('node:path');
|
|
const os = require('node:os');
|
|
const crypto = require('node:crypto');
|
|
const { mapArch, parseChecksums, verifyFileSha256 } = require('../lib/verifier.js');
|
|
|
|
test('mapArch maps uname architecture to Trivy release arch', () => {
|
|
assert.equal(mapArch('x86_64'), '64bit');
|
|
assert.equal(mapArch('aarch64'), 'ARM64');
|
|
assert.equal(mapArch('arm64'), 'ARM64');
|
|
assert.throws(() => mapArch('mips'), /Unsupported architecture/);
|
|
});
|
|
|
|
test('parseChecksums parses sha256 checksum lockfile into filename map', () => {
|
|
const content = `
|
|
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 trivy_0.74.0_Linux-64bit.tar.gz
|
|
a1b2c3d4e5f60000000000000000000000000000000000000000000000000000 trivy_0.74.0_Linux-ARM64.tar.gz
|
|
`;
|
|
|
|
const map = parseChecksums(content);
|
|
assert.equal(map.get('trivy_0.74.0_Linux-64bit.tar.gz'), 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855');
|
|
assert.equal(map.get('trivy_0.74.0_Linux-ARM64.tar.gz'), 'a1b2c3d4e5f60000000000000000000000000000000000000000000000000000');
|
|
assert.equal(map.has('nonexistent'), false);
|
|
});
|
|
|
|
test('verifyFileSha256 verifies actual sha256 hash of a file', () => {
|
|
const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cve-test-'));
|
|
const testFile = path.join(tmpDir, 'test.txt');
|
|
const fileContent = 'hello world\n';
|
|
fs.writeFileSync(testFile, fileContent);
|
|
|
|
const expectedHash = crypto.createHash('sha256').update(fileContent).digest('hex');
|
|
assert.equal(verifyFileSha256(testFile, expectedHash), true);
|
|
assert.equal(verifyFileSha256(testFile, 'wronghash'), false);
|
|
|
|
fs.rmSync(tmpDir, { recursive: true, force: true });
|
|
});
|