also looking at this
Gate releases on shipped artifact findings
#316
11 files
+454
-25
| @@ -0,0 +1,35 @@ | ||
| 1 | name: Set up release scanners | |
| 2 | description: Install pinned Syft and Grype binaries for release artifact checks | |
| 3 | runs: | |
| 4 | using: composite | |
| 5 | steps: | |
| 6 | - name: Install Syft and Grype | |
| 7 | shell: bash | |
| 8 | run: | | |
| 9 | set -euo pipefail | |
| 10 | case "$RUNNER_OS" in | |
| 11 | Linux) | |
| 12 | syft_platform=linux_amd64 | |
| 13 | grype_platform=linux_amd64 | |
| 14 | syft_hash=caeedb81fb0491615f1ebd1761e4145d41ee86dd2cc7bf80669f9f5ad9d6133d | |
| 15 | grype_hash=3fa2dc4b924621ab65404cf08d0b8438d896d80ab949c9d5a4ca283c36004c9b | |
| 16 | ;; | |
| 17 | macOS) | |
| 18 | syft_platform=darwin_arm64 | |
| 19 | grype_platform=darwin_arm64 | |
| 20 | syft_hash=014d561b6d13059124155f74a6c5a9a99501f5e209313638dd884f39eb418ee6 | |
| 21 | grype_hash=500c9b2b6c089d21481815f57a553fabbd441ec7d1e79d95e3aaf40c3bfc7e36 | |
| 22 | ;; | |
| 23 | *) echo "Unsupported scanner platform: $RUNNER_OS" >&2; exit 1 ;; | |
| 24 | esac | |
| 25 | mkdir -p "$RUNNER_TEMP/release-scanners" | |
| 26 | cd "$RUNNER_TEMP/release-scanners" | |
| 27 | curl --fail --location --retry 3 --output syft.tar.gz \ | |
| 28 | "https://github.com/anchore/syft/releases/download/v1.52.0/syft_1.52.0_${syft_platform}.tar.gz" | |
| 29 | echo "$syft_hash syft.tar.gz" | shasum -a 256 --check | |
| 30 | tar -xzf syft.tar.gz syft | |
| 31 | curl --fail --location --retry 3 --output grype.tar.gz \ | |
| 32 | "https://github.com/anchore/grype/releases/download/v0.119.0/grype_0.119.0_${grype_platform}.tar.gz" | |
| 33 | echo "$grype_hash grype.tar.gz" | shasum -a 256 --check | |
| 34 | tar -xzf grype.tar.gz grype | |
| 35 | echo "$RUNNER_TEMP/release-scanners" >> "$GITHUB_PATH" | |