repotests.yml

name: Repo tests

on:
  workflow_dispatch:
  pull_request:
    paths-ignore:
      - 'docs/**'
      - '*.md'
concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
  cancel-in-progress: true
jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        node-version: ['21.x']
        os: ['ubuntu-latest', 'windows-latest']
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4
      - name: Set up JDK
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '21'
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - uses: denoland/setup-deno@v1
        with:
          deno-version: v1.x
      - uses: oven-sh/setup-bun@v1
      - name: Trim CI agent
        run: |
          chmod +x contrib/free_disk_space.sh
          ./contrib/free_disk_space.sh
      - name: Install bazelisk - linux
        if: matrix.os == 'ubuntu-latest'
        run: |
          curl -LO "https://github.com/bazelbuild/bazelisk/releases/download/v1.15.0/bazelisk-linux-amd64"
          sudo mv bazelisk-linux-amd64 /usr/local/bin/bazel
      - name: Install bazelisk - windows
        if: matrix.os == 'windows-latest'
        run: choco install -y bazel
      - name: npm install, build and test
        run: |
          npm install
          npm run build --if-present
          npm test
          mkdir -p repotests
          mkdir -p bomresults
          mkdir -p denoresults
        env:
          CI: true
      - name: Setup Android SDK
        uses: android-actions/setup-android@v3
      - uses: swift-actions/setup-swift@v2
        if: matrix.os == 'ubuntu-latest'
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: 3.11
      - uses: actions/checkout@v4
        with:
          repository: 'ShiftLeftSecurity/shiftleft-java-example'
          path: 'repotests/shiftleft-java-example'
      - uses: actions/checkout@v4
        with:
          repository: 'ShiftLeftSecurity/shiftleft-ts-example'
          path: 'repotests/shiftleft-ts-example'
      - uses: actions/checkout@v4
        with:
          repository: 'ShiftLeftSecurity/shiftleft-go-example'
          path: 'repotests/shiftleft-go-example'
      - uses: actions/checkout@v4
        with:
          repository: 'prabhu/shiftleft-scala-example'
          path: 'repotests/shiftleft-scala-example'
      - uses: actions/checkout@v4
        with:
          repository: 'HooliCorp/vulnerable_net_core'
          path: 'repotests/vulnerable_net_core'
      - uses: actions/checkout@v4
        with:
          repository: 'HooliCorp/Goatly.NET'
          path: 'repotests/Goatly.NET'
      - uses: actions/checkout@v4
        with:
          repository: 'HooliCorp/DjanGoat'
          path: 'repotests/DjanGoat'
      - uses: actions/checkout@v4
        with:
          repository: 'prabhu/Vulnerable-Web-Application'
          path: 'repotests/Vulnerable-Web-Application'
      - uses: actions/checkout@v4
        with:
          repository: 'prabhu/railsgoat'
          path: 'repotests/railsgoat'
      - uses: actions/checkout@v4
        with:
          repository: 'bazelbuild/examples'
          path: 'repotests/bazel-examples'
      - uses: actions/checkout@v4
        with:
          repository: 'flutter/gallery'
          ref: 'v2.10.2'
          path: 'repotests/gallery'
      - uses: actions/checkout@v4
        with:
          repository: 'gojek/ziggurat'
          ref: '4.9.4'
          path: 'repotests/ziggurat'
      - uses: actions/checkout@v4
        with:
          repository: 'apple/swift-markdown'
          ref: '0.3.0'
          path: 'repotests/swift-markdown'
      - uses: actions/checkout@v4
        with:
          repository: 'GoogleCloudPlatform/microservices-demo'
          ref: 'v0.8.1'
          path: 'repotests/microservices-demo'
      - uses: actions/checkout@v4
        with:
          repository: 'zoom/meetingsdk-vuejs-sample'
          ref: 'v2.18.0'
          path: 'repotests/meetingsdk-vuejs-sample'
      - uses: actions/checkout@v4
        with:
          repository: 'sveltejs/examples'
          path: 'repotests/sveltejs-examples'
      - uses: actions/checkout@v4
        with:
          repository: 'openpbs/openpbs'
          ref: 'v23.06.06'
          path: 'repotests/openpbs'
      - uses: actions/checkout@v4
        with:
          repository: 'home-assistant/android'
          ref: '2023.11.3'
          path: 'repotests/ha-android'
      - uses: actions/checkout@v4
        with:
          repository: 'rust-lang/rust'
          ref: '1.74.0'
          path: 'repotests/rs-rust'
      - uses: actions/checkout@v4
        with:
          repository: 'rust-lang/cargo'
          ref: '0.75.0'
          path: 'repotests/rs-cargo'
      - uses: actions/checkout@v4
        with:
          repository: 'Keats/validator'
          ref: 'v0.15.0'
          path: 'repotests/rs-validator'
      - uses: actions/checkout@v4
        with:
          repository: 'tokio-rs/axum'
          ref: 'axum-v0.6.20'
          path: 'repotests/rs-axum'
      - uses: actions/checkout@v4
        with:
          repository: 'fsprojects/FAKE'
          ref: '6.0.0'
          path: 'repotests/dotnet-paket'
      - uses: actions/checkout@v4
        with:
          repository: 'appthreat/blint'
          ref: 'v1.0.34'
          path: 'repotests/blint'
      - uses: actions/checkout@v4
        with:
          repository: 'hoolicorp/java-sec-code'
          path: 'repotests/java-sec-code'
      - uses: actions/checkout@v4
        with:
          repository: 'DefectDojo/django-DefectDojo'
          ref: '2.28.2'
          path: 'repotests/django-DefectDojo'
      - uses: actions/checkout@v4
        with:
          repository: 'googleprojectzero/Jackalope'
          path: 'repotests/Jackalope'
      - uses: actions/checkout@v4
        with:
          repository: 'hritik14/broken-mvn-wrapper'
          path: 'repotests/broken-mvn-wrapper'
      - uses: actions/checkout@v4
        with:
          repository: 'microsoft/dotnet-podcasts'
          path: 'repotests/dotnet-podcasts'
      - uses: actions/checkout@v4
        with:
          repository: 'microsoft/react-native-windows'
          path: 'repotests/react-native-windows'
      - uses: dtolnay/rust-toolchain@stable
      - name: repotests java-sec-code
        run: |
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-1.json --include-formulation --include-crypto
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-2.json --author foo --author bar
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-3.json --required-only
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-4.json --filter postgres --filter json
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-5.json --only spring
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-6.json --deep --evidence
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-7.json --profile research --export-proto
          bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-8.json --profile license-compliance
        shell: bash
      - name: repotests evidence
        run: |
          bin/cdxgen.js -p -t js --no-recurse -o bomresults/bom.json --evidence .
        shell: bash
      - name: repotests django-DefectDojo
        run: |
          bin/cdxgen.js -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo.json --deep --include-crypto --spec-version 1.6
        shell: bash
      - name: repotests shiftleft-java-example
        run: |
          bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/bom-java.json --generate-key-and-sign
          node bin/evinse.js -i bomresults/bom-java.json -o bomresults/bom-java.evinse.json -l java --with-data-flow -p repotests/shiftleft-java-example
          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/bom-github.json
        shell: bash
      - name: repotests shiftleft-ts-example
        run: |
          FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-1.json --include-formulation
          node bin/evinse.js -i bomresults/bom-ts-1.json -o bomresults/bom-ts.evinse.json -l javascript --with-data-flow -p repotests/shiftleft-ts-example
          FETCH_LICENSE=true bin/cdxgen.js -p -t js repotests/shiftleft-ts-example --required-only -o bomresults/bom-ts-2.json --validate
          FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/bom-ts-3.json --validate
        shell: bash
      - name: repotests meetingsdk-vuejs-sample
        run: |
          FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/meetingsdk-vuejs-sample -o bomresults/bom-vue.json
          node bin/evinse.js -i bomresults/bom-vue.json -o bomresults/bom-vue.evinse.json -l javascript --with-data-flow -p repotests/meetingsdk-vuejs-sample
        shell: bash
      - name: repotests sveltejs-examples
        run: |
          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" FETCH_LICENSE=false bin/cdxgen.js -p -t js repotests/sveltejs-examples -o bomresults/bom-svelte.json
          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-data-flow -p repotests/sveltejs-examples
          CDXGEN_DEBUG_MODE=debug ASTGEN_IGNORE_DIRS="" node bin/evinse.js -i bomresults/bom-svelte.json -o bomresults/bom-svelte.evinse.json -l javascript --with-reachables -p repotests/sveltejs-examples
        shell: bash
      - name: repotests shiftleft-go-example
        run: |
          FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/bom-go.json --validate --export-proto
        shell: bash
      - name: repotests vulnerable_net_core
        run: |
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/bom-csharp2.json --include-formulation
        shell: bash
      - name: repotests Goatly.NET
        run: |
          FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/bom-csharp3.json --include-formulation
        shell: bash
      - name: repotests DjanGoat
        run: |
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/bom-python.json --validate
        shell: bash
      - name: repotests Vulnerable-Web-Application
        run: |
          bin/cdxgen.js -p -t php repotests/Vulnerable-Web-Application -o bomresults/bom-php-1.json --validate
          bin/cdxgen.js -p -t php --no-recurse repotests/Vulnerable-Web-Application -o bomresults/bom-php-2.json --validate --profile research -p
        shell: bash
      - name: repotests railsgoat
        run: |
          bin/cdxgen.js -p -r -t ruby repotests/railsgoat -o bomresults/bom-ruby.json --validate
        shell: bash
      - name: repotests bazel-examples
        run: |
          bin/cdxgen.js -p -r -t java repotests/bazel-examples/java-maven -o bomresults/bom-bazel.json --validate
        shell: bash
      - name: repotests gallery
        run: |
          bin/cdxgen.js -p -r -t dart repotests/gallery -o bomresults/bom-pub.json --validate
        shell: bash
      - name: repotests ziggurat
        run: |
          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t clojure repotests/ziggurat -o bomresults/bom-clj.json --validate
        shell: bash
      - name: repotests swift-markdown
        run: |
          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t swift repotests/swift-markdown -o bomresults/bom-swift.json --validate
        shell: bash
      - name: repotests microservices-demo
        if: matrix.os == 'windows-latest'
        run: |
          bin/cdxgen.js -p --no-recurse repotests/microservices-demo -o bomresults/bom-msd-1.json --validate
          bin/cdxgen.js -p -r repotests/microservices-demo -o bomresults/bom-msd-2.json --validate
          bin/cdxgen.js -p -r -t yaml-manifest repotests/microservices-demo -o bomresults/bom-yaml.json --validate
        shell: bash
      - name: repotests openpbs
        run: |
          bin/cdxgen.js -p -r -t c repotests/openpbs -o bomresults/bom-openpbs.json
        shell: bash
      - name: repotests Jackalope
        run: |
          bin/cdxgen.js -p -r -t c repotests/Jackalope -o bomresults/bom-Jackalope.json
        shell: bash
      - name: repotests ha-android
        run: |
          cd repotests/ha-android && ./gradlew assembleDebug || true && cd ../..
          bin/cdxgen.js -r -t java repotests/ha-android -o bomresults/bom-android.json
          CDXGEN_DEBUG_MODE=debug bin/evinse.js -i bomresults/bom-android.json -o bomresults/bom-android.evinse.json -l java repotests/ha-android
        shell: bash
      - name: repotests rust
        run: |
          bin/cdxgen.js -p -r -t rust repotests/rs-rust -o bomresults/bom-rs-rust.json --validate
          bin/cdxgen.js -p -r -t rust repotests/rs-cargo -o bomresults/bom-rs-cargo.json --validate
          cargo generate-lockfile --manifest-path repotests/rs-validator/validator/Cargo.toml
          bin/cdxgen.js -p -r -t rust repotests/rs-validator -o bomresults/bom-rs-validator.json --validate
          bin/cdxgen.js -p -r -t rust repotests/rs-axum -o bomresults/bom-rs-axum.json --validate
        shell: bash
      - name: repotests dotnet-paket
        run: |
          bin/cdxgen.js -p -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket.json --validate
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t dotnet repotests/dotnet-paket -o bomresults/bom-dotnet-paket-2.json --validate
          bin/cdxgen.js -p -r -t dotnet repotests/dotnet-podcasts -o bomresults/bom-dotnet-podcasts.json --profile research --export-proto
          bin/cdxgen.js -p -r -t dotnet repotests/react-native-windows -o bomresults/bom-react-native-windows.json
        shell: bash
      - name: repotests blint
        run: |
          bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint.json
          bin/cdxgen.js -p -t python repotests/blint -o bomresults/bom-blint-deep.json --deep
          bin/cdxgen.js -p -t java repotests/broken-mvn-wrapper -o bomresults/bom-broken-mvn-wrapper.json
        shell: bash
      - name: jenkins plugins
        run: |
          mkdir -p jenkins
          curl -LO https://updates.jenkins.io/download/plugins/sonar/2.14/sonar.hpi
          curl -LO https://updates.jenkins.io/download/plugins/bouncycastle-api/2.26/bouncycastle-api.hpi
          curl -LO https://updates.jenkins.io/download/plugins/jsch/0.1.55.61.va_e9ee26616e7/jsch.hpi
          curl -LO https://updates.jenkins.io/download/plugins/momentjs/1.1.1/momentjs.hpi
          mv *.hpi jenkins
          CDXGEN_DEBUG_MODE=debug bin/cdxgen.js -p -r -t jenkins jenkins -o bomresults/bom-jenkins.json --validate
        shell: bash
      - name: standalone jar files
        run: |
          mkdir -p standalone-jar-files
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.report/0.8.8/org.jacoco.report-0.8.8.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/ws/xmlschema/xmlschema-core/2.2.5/xmlschema-core-2.2.5.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.0/jackson-core-2.16.0.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/junit/junit/4.13.2/junit-4.13.2.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/wsdl4j/wsdl4j/1.6.3/wsdl4j-1.6.3.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/maven/maven-core/3.9.2/maven-core-3.9.2.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/displaytag/displaytag/1.2/displaytag-1.2.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/apache/poi/poi/3.17/poi-3.17.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jacoco/org.jacoco.agent/0.8.8/org.jacoco.agent-0.8.8.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/javax/jws/javax.jws-api/1.1/javax.jws-api-1.1.jar
          curl --output-dir standalone-jar-files -LO https://repo1.maven.org/maven2/org/jrobin/jrobin/1.5.9/jrobin-1.5.9.jar
          FETCH_LICENSE=true bin/cdxgen.js -p standalone-jar-files -o bomresults/bom-standalone-jar-files.json --validate
        shell: bash
      - name: post-build lifecycle tests
        run: |
          pip install blint
          mkdir -p bintests
          cd bintests
          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai.exe
          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai
          curl -LO https://github.com/owasp-dep-scan/dosai/releases/download/v0.1.1/Dosai-osx-arm64
          cd ..
          bin/cdxgen.js -p -t dotnet --lifecycle post-build -o bomresults/bom-binary.json bintests
          mkdir -p gobintests
          cd gobintests
          curl -LO https://github.com/anchore/syft/releases/download/v1.0.1/syft_1.0.1_linux_arm64.tar.gz
          tar -xvf syft_1.0.1_linux_arm64.tar.gz
          rm syft_1.0.1_linux_arm64.tar.gz
          curl -LO https://github.com/containerd/containerd/releases/download/v2.0.0-rc.0/containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
          tar -xvf containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
          rm containerd-static-2.0.0-rc.0-linux-amd64.tar.gz
          cd ..
          bin/cdxgen.js -p -t go --lifecycle post-build -o bomresults/bom-go-binary.json gobintests
        shell: bash
      - name: repotests 1.6
        run: |
          bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/1.6-bom-java.json --generate-key-and-sign --spec-version 1.6
          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.6-bom-github.json --spec-version 1.6
          FETCH_LICENSE=0 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/1.6-bom-ts-1.json --validate --spec-version 1.6
          FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example --required-only -o bomresults/1.6-bom-ts-2.json --validate --spec-version 1.6
          FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/1.6-bom-go.json --validate --spec-version 1.6
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/1.6-bom-csharp2.json --validate --spec-version 1.6
          FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/1.6-bom-csharp3.json --validate --spec-version 1.6
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/1.6-bom-python.json --validate --spec-version 1.6
          bin/cdxgen.js -p -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.6-bom-php.json --validate --spec-version 1.6
        shell: bash
      - name: repotests 1.4
        run: |
          bin/cdxgen.js -p -r -t java repotests/shiftleft-java-example -o bomresults/1.4-bom-java.json --generate-key-and-sign --spec-version 1.4
          SBOM_SIGN_ALGORITHM=RS512 SBOM_SIGN_PRIVATE_KEY=bomresults/private.key SBOM_SIGN_PUBLIC_KEY=bomresults/public.key bin/cdxgen.js -p -r -t github repotests/shiftleft-java-example -o bomresults/1.4-bom-github.json --spec-version 1.4
          FETCH_LICENSE=0 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example -o bomresults/1.4-bom-ts-1.json --validate --spec-version 1.4
          FETCH_LICENSE=1 bin/cdxgen.js -p -r -t js repotests/shiftleft-ts-example --required-only -o bomresults/1.4-bom-ts-2.json --validate --spec-version 1.4
          FETCH_LICENSE=false bin/cdxgen.js -p -r -t go repotests/shiftleft-go-example -o bomresults/1.4-bom-go.json --validate --spec-version 1.4
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t csharp repotests/vulnerable_net_core -o bomresults/1.4-bom-csharp2.json --validate --spec-version 1.4
          FETCH_LICENSE=false bin/cdxgen.js -p -r repotests/Goatly.NET -o bomresults/1.4-bom-csharp3.json --validate --spec-version 1.4
          FETCH_LICENSE=true bin/cdxgen.js -p -r -t python repotests/DjanGoat -o bomresults/1.4-bom-python.json --validate --spec-version 1.4
          bin/cdxgen.js -p -r -t php repotests/Vulnerable-Web-Application -o bomresults/1.4-bom-php.json --validate --spec-version 1.4
        shell: bash
      - name: list repotest bomresults
        run: |
          ls -ltr bomresults
        shell: bash
      - name: buntests
        run: |
          rm -rf node_modules
          bun install --frozen-lockfile
          bun --bun bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-bun.json --deep
          bun --bun bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-bun.json
        continue-on-error: true
      - name: denotests
        run: |
          deno info bin/cdxgen.js
          deno info bin/evinse.js
          deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid --allow-write --allow-net bin/cdxgen.js -p -t java repotests/java-sec-code -o bomresults/bom-java-sec-code-deno.json
          deno run --allow-read --allow-env --allow-run --allow-sys=uid,systemMemoryInfo,gid --allow-write --allow-net bin/cdxgen.js -p -t python repotests/django-DefectDojo -o bomresults/django-DefectDojo-deno.json
      - uses: actions/upload-artifact@v4
        if: github.ref == 'refs/heads/master' && matrix.os == 'ubuntu-latest'
        with:
          name: bomresults
          path: bomresults