CVE Scanner GitHub Action
Tags: actionshackathon, security, cve
Published: 2020-09-03 06:26:19

### My Workflow
I have created a GitHub action to scan CVEs([Common Vulnerabilities and Exposures](https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) from binary packages. My action uses [cve-bin-tool](https://github.com/intel/cve-bin-tool) to scan CVEs from binary packages and generates a detailed report and upload it as an [artifact](https://docs.github.com/en/rest/reference/actions#artifacts) which can be downloaded anytime. I am also using [actions/cache](https://github.com/actions/cache) to reduce the runtime of the action.

If you are a developer who develops binary packages and libraries then I recommend integrating this action as a part of your CI pipeline so that you will get to know about common vulnerabilities found in the libraries you are using, and take actions to mitigate it. 

The most recommended way to fix a given CVE is to upgrade the package to a non-vulnerable version. Ideally, a CVE is only made public after a fix is available, although this is not always the case. If this is not possible for some reason, search for the CVE number to get information on possible workarounds and patches that could be backported to other versions. Note that neither workarounds nor backported fixes can be detected by this tool, so your binary will continue to show up as vulnerable even though it may now be safely mitigated and result in a false positive. To avoid this problem, I recommend classifying CVE as Mitigated. See [User Manual of the cve-bin-tool](https://github.com/intel/cve-bin-tool/blob/master/doc/MANUAL.md) for more details.

### Submission Category: 

Maintainer Must-Haves


### Yaml File or Link to Code
```yml
name: CVE scanner
on:
#    You can customize this according to your need.
  - push
  - pull_request
jobs:
  build_and_scan:
    runs-on: ubuntu-latest
    steps:
    # Get date utility for caching database.
      - name: Get Date
        id: get-date
        run: |
          echo "::set-output name=date::$(/bin/date -u "+%Y%m%d")"
        shell: bash
    #  Let's first download dependencies for this action.
      - uses: actions/checkout@v2
      - name: Set up Python
        uses: actions/setup-python@v2
        with:
          python-version: 3.8
    #  This second step is unnecessary but highly recommended because
    #  it will cache database and saves time redownloading it
    #  if database isn't stale.
      - name: get cached python packages
        uses: actions/cache@v2
        with:
          path: ~/.cache/pip
          key: ${{ runner.os }}-pip-${{ hashFiles('**/requirements.txt') }}
          restore-keys: |
            ${{ runner.os }}-pip-
      - name: get cached database
        uses: actions/cache@v2
        with:
          path: ~/.cache/cve-bin-tool
          key: ${{ runner.os }}-cve-bin-tool-${{ steps.get-date.outputs.date }}
      - name: Install CVE Binary Tool
#          We are using the latest development version of cve-bin-tool
#          because current PyPI version don't have features like
#          config file support, generating an HTML report, etc.
        run: pip install git+https://github.com/intel/cve-bin-tool@master
#          In case you prefer current PyPI version, 
#          you need to hard code CLI options
#          for cve-bin-tool in the action itself and 
#          have to use CSV or JSON as output format.
      - name: build package
#          Here, we are building a Python wheel for this example.
#          You need to replace this with your build process.
        run: |
          pip install wheel
          python setup.py bdist_wheel
      - name: Scan built package
#          Now, we will scan the built wheel 
#          which is situated in "/dist" directory
#          Python stores built packages in /dist directory.
#          You need to replace it with the directory
#          where you have stored built package
        run: cve-bin-tool dist -f html -o cve-bin-tool-report.html -x
#          Alternatively if you have written config file
#          for cve-bin-tool you can use the following command
#          cve-bin-tool -C path/to/cve_bin_tool_config.toml
        continue-on-error: true
#          You need to set continue_on_error: true because 
#          CVE Binary Tool sets the number of product with CVEs
#          as exit code. And GitHub terminate the action 
#          when the process produces nonzero exit code status.
      - name: Upload report as an artifact
#        This will upload the generated report as 
#        a GitHub artifact which you can download later.
        uses: actions/upload-artifact@v2
        with:
          name: cve_report
          path: 'cve-bin-tool-report.html'
```


### Additional Resources / Info

I have also contributed this action to the cve-bin-tool. You can also find this in the [how-to-guides](https://github.com/intel/cve-bin-tool/blob/master/doc/how_to_guides/cve_scanner_gh_action.yml) directory of the official cve-bin-tool repository. 

You can also see my pull-request to cve-bin-tool for this action [here](https://github.com/intel/cve-bin-tool/pull/894) and discussion on the associated issue [here](https://github.com/intel/cve-bin-tool/issues/272).

I have also tested this action on my other project and it is working fine. You can see an example run of the action [here](https://github.com/Niraj-Kamdar/qpt_generator/actions/runs/219903197).