Skip to content

Commit b9fda37

Browse files
sheyanjie-qqsheyanjie-qq
authored
chore: add dependency review (#82)
Close: https://project.feishu.cn/taosdata_td/feature/detail/6785941906
1 parent ac5a4c7 commit b9fda37

File tree

7 files changed

+256
-666
lines changed

7 files changed

+256
-666
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ jobs:
2929
runs-on: ${{ matrix.os }}
3030
steps:
3131
- name: checkout TDengine
32-
uses: actions/checkout@v3
32+
uses: actions/checkout@v4
3333
with:
3434
fetch-depth: 1
3535
repository: 'taosdata/TDengine'
@@ -43,7 +43,7 @@ jobs:
4343
run: nohup sudo taosd &
4444

4545
- name: checkout
46-
uses: actions/checkout@v3
46+
uses: actions/checkout@v4
4747

4848
- name: set up java
4949
uses: actions/setup-java@v3

‎.github/workflows/codeql.yml‎

Lines changed: 100 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,100 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL Advanced"
13+
14+
on:
15+
push:
16+
branches: [ "master", "3.0" ]
17+
pull_request:
18+
branches: [ "master", "3.0" ]
19+
schedule:
20+
- cron: '0 0 * * *' # Daily scan at 00:00 UTC (8:00 Beijing Time)
21+
22+
jobs:
23+
analyze:
24+
name: Analyze (${{ matrix.language }})
25+
# Runner size impacts CodeQL analysis time. To learn more, please see:
26+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
27+
# - https://gh.io/supported-runners-and-hardware-resources
28+
# - https://gh.io/using-larger-runners (GitHub.com only)
29+
runs-on: ubuntu-latest
30+
permissions:
31+
# required for all workflows
32+
security-events: write
33+
34+
# required to fetch internal or private CodeQL packs
35+
packages: read
36+
37+
# only required for workflows in private repositories
38+
actions: read
39+
contents: read
40+
41+
strategy:
42+
fail-fast: false
43+
matrix:
44+
include:
45+
- language: actions
46+
build-mode: none
47+
- language: java-kotlin
48+
build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
49+
# CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
50+
# Use `c-cpp` to analyze code written in C, C++ or both
51+
# Use 'java-kotlin' to analyze code written in Java, Kotlin or both
52+
# Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
53+
# To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
54+
# see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
55+
# If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
56+
# your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
57+
steps:
58+
- name: Checkout repository
59+
uses: actions/checkout@v4
60+
61+
# Add any setup steps before running the `github/codeql-action/init` action.
62+
# This includes steps like installing compilers or runtimes (`actions/setup-node`
63+
# or others). This is typically only required for manual builds.
64+
# - name: Setup runtime (example)
65+
# uses: actions/setup-example@v1
66+
67+
# Initializes the CodeQL tools for scanning.
68+
- name: Initialize CodeQL
69+
uses: github/codeql-action/init@v4
70+
with:
71+
languages: ${{ matrix.language }}
72+
build-mode: ${{ matrix.build-mode }}
73+
# If you wish to specify custom queries, you can do so here or in a config file.
74+
# By default, queries listed here will override any specified in a config file.
75+
# Prefix the list here with "+" to use these queries and those in the config file.
76+
77+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
78+
# queries: security-extended,security-and-quality
79+
80+
# If the analyze step fails for one of the languages you are analyzing with
81+
# "We were unable to automatically build your code", modify the matrix above
82+
# to set the build mode to "manual" for that language. Then modify this step
83+
# to build your code.
84+
# ℹ️ Command-line programs to run using the OS shell.
85+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
86+
- name: Run manual build steps
87+
if: matrix.build-mode == 'manual'
88+
shell: bash
89+
run: |
90+
echo 'If you are using a "manual" build mode for one or more of the' \
91+
'languages you are analyzing, replace this with the commands to build' \
92+
'your code, for example:'
93+
echo ' make bootstrap'
94+
echo ' make release'
95+
exit 1
96+
97+
- name: Perform CodeQL Analysis
98+
uses: github/codeql-action/analyze@v4
99+
with:
100+
category: "/language:${{matrix.language}}"

‎.github/workflows/dependency-report.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
2+
name: 'Dependency report'
3+
on:
4+
pull_request:
5+
branches: [ "master", "3.0" ]
6+
schedule:
7+
# Cron expression format: minute hour day month weekday (GitHub uses UTC time zone)
8+
# Example 1: Run once daily at 00:00 UTC (equivalent to 08:00 Beijing time)
9+
- cron: '0 0 * * *'
10+
# Optional: To scan every Monday, replace with: 0 0 * * 1
11+
# Optional: To scan hourly, replace with: 0 * * * *
12+
13+
permissions:
14+
contents: read
15+
pull-requests: write
16+
jobs:
17+
depchecktest:
18+
runs-on: ubuntu-latest
19+
name: depcheck_test
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
- name: Set up Java
24+
uses: actions/setup-java@v3
25+
with:
26+
distribution: 'temurin'
27+
java-version: 8
28+
java-package: jdk
29+
cache: 'maven'
30+
- name: Build project with Maven
31+
run: mvn -B -DskipTests clean install
32+
- name: Depcheck
33+
uses: dependency-check/Dependency-Check_Action@1.1.0
34+
env:
35+
# actions/setup-java@v3 changes JAVA_HOME so it needs to be reset to match the depcheck image
36+
JAVA_HOME: /opt/jdk
37+
id: Depcheck
38+
with:
39+
project: 'flink-connector-tdengine'
40+
path: '.'
41+
format: 'HTML'
42+
out: 'reports' # this is the default, no need to specify unless you wish to override it
43+
args: >
44+
--failOnCVSS 7
45+
--enableRetired
46+
- name: Upload Test results
47+
if: always()
48+
uses: actions/upload-artifact@v4
49+
with:
50+
name: Depcheck report
51+
path: ${{github.workspace}}/reports

‎.github/workflows/trivy-scan.yml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
name: Trivy Vulnerability + License Scan (PR + Scheduled)
2+
3+
# Trigger conditions: PR/push on master/3.0 branches, daily scheduled scan (00:00 UTC)
4+
on:
5+
workflow_dispatch:
6+
pull_request:
7+
branches: [ master, 3.0 ]
8+
types: [ opened, synchronize, reopened ]
9+
push:
10+
branches: [ master, 3.0 ]
11+
schedule:
12+
- cron: '0 0 * * *' # Daily scan at 00:00 UTC (8:00 Beijing Time)
13+
14+
jobs:
15+
trivy-scan:
16+
runs-on: ubuntu-latest
17+
permissions:
18+
contents: read
19+
security-events: write # Required for uploading SARIF to GitHub Security
20+
21+
steps:
22+
# Step 1: Check out repository code (required for scanning local files/pom.xml)
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
26+
# Step 2: Trivy FS Scan - Detect vulnerabilities in code/dependencies
27+
- name: Trivy FS Scan (Code/Dependency Vulnerabilities)
28+
id: run_trivy_scan # FIX: Add step ID for subsequent failure check
29+
uses: aquasecurity/trivy-action@0.33.1
30+
continue-on-error: true
31+
with:
32+
scan-type: 'fs'
33+
scan-ref: '.' # Scan project root directory
34+
vuln-type: 'library'
35+
format: 'sarif'
36+
output: 'trivy-fs-results.sarif'
37+
severity: 'CRITICAL,HIGH,MEDIUM'
38+
exit-code: '1' # Set to 1 to fail step when vulnerabilities are found (match comment intent)
39+
skip-dirs: 'target,node_modules' # Skip Maven build artifacts and node modules
40+
skip-files: 'pom.xml.versionsBackup' # Skip temporary Maven files
41+
42+
# Step 3: Enforce quality gate - Fail CI if vulnerabilities are detected
43+
- name: Fail CI if vulnerabilities were found
44+
if: steps.run_trivy_scan.outcome == 'failure' # Only execute if scan step fails
45+
run: |
46+
echo "❌ Trivy scan detected vulnerabilities with CRITICAL/HIGH/MEDIUM severity, CI process failed."
47+
echo "Please check the generated SARIF report or Security panel for details."
48+
exit 1 # Explicitly exit to fail this step and the entire CI
49+
50+
# Step 4: Debug - Verify SARIF file existence and content
51+
- name: Debug - Check SARIF file
52+
if: always()
53+
run: |
54+
echo "File exists:"
55+
ls -la trivy-fs-results.sarif || echo "SARIF file does not exist"
56+
echo "First few lines:"
57+
head -20 trivy-fs-results.sarif || echo "Failed to read SARIF file"
58+
59+
# Step 5: Upload SARIF report to GitHub Security (visualize vulnerabilities)
60+
- name: Upload Trivy Results to GitHub Security
61+
if: always()
62+
uses: github/codeql-action/upload-sarif@v4
63+
with:
64+
sarif_file: 'trivy-fs-results.sarif'
65+
66+
# Step 6: Trivy License Scan - Detect non-compliant licenses
67+
- name: Trivy License Scan
68+
uses: aquasecurity/trivy-action@0.33.1
69+
with:
70+
scan-type: fs
71+
scan-ref: .
72+
format: table
73+
exit-code: 1 # Fail CI on non-allowed licenses
74+
skip-dirs: target # Skip build artifacts to speed up scan
75+
scanners: license
76+
severity: 'CRITICAL,HIGH,UNKNOWN'
77+
skip-files: 'LICENSE'

‎.gitignore‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33

44
# Log file
55
*.log
6+
.DS_Store
7+
68

79
# BlueJ files
810
*.ctxt
@@ -23,4 +25,4 @@
2325
hs_err_pid*
2426
.idea
2527
target
26-
version.txt
28+
version.txt

0 commit comments

Comments
 (0)