Skip to content

Commit 2184743

Browse files
temblekingtembleking
authored
ci: smoke-test the task with the oldest supported sysdig-cli-scanner (#21)
The task lets users pin `sysdigCliScannerVersion`, but CI only ever ran with `latest`, so nothing proved older supported versions still work with the task. The smoke run now runs the task twice: once with `latest` and once with the oldest release inside the 365-day support window. The versions in the README and pipeline are tagged with markers and refreshed by `just update` (`update-cli-scanner` / `update-oldest-cli-scanner`), the same approach used in scan-action and the Jenkins plugin. The dev shell now ships GNU coreutils/sed/grep because the recipes rely on them.
1 parent e1ac360 commit 2184743

8 files changed

Lines changed: 106 additions & 11 deletions

File tree

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ steps:
9696
verbose: true
9797
jsonOutput: true
9898
jsonOutputFile: 'sysdig-cli-scan-output.json'
99-
sysdigCliScannerVersion: '1.6.0'
99+
sysdigCliScannerVersion: '1.30.1' # newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner`
100100
policy: my_custom_policy,my-custom-policy-ab
101101
102102
- task: PublishBuildArtifacts@1
@@ -141,7 +141,7 @@ steps:
141141

142142
- **JSON Output File (`jsonOutputFile`)**: The file name to export the JSON result to. This will be ignored if `jsonOutput` is `false`. Default: `sysdig-cli-scan-output.json`,
143143

144-
- **Sysdig CLI Scanner Version (`sysdigCliScannerVersion`)**: The version of the Sysdig CLI Scanner to use. Will use the latest version if not specified. Default: `latest`,
144+
- **Sysdig CLI Scanner Version (`sysdigCliScannerVersion`)**: The version of the Sysdig CLI Scanner to use. Will use the latest version if not specified. Versions are supported for 1 year after release; oldest version tested is <!-- oldest-version-marker: DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner` -->1.23.0<!-- /oldest-version-marker -->. Default: `latest`,
145145

146146
- **Policy (`policy`)**: Policy to evaluate in the pipeline execution. If not specified, only the Always Apply policy will be evaluated. Default: `null`,
147147

‎azure-pipelines.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,10 @@ steps:
6666
export INPUT_IMAGE='$(imageName)'
6767
export INPUT_VERBOSE='true'
6868
export INPUT_FAILBUILD='false'
69-
export INPUT_SYSDIGCLISCANNERVERSION='latest'
7069
71-
# Run the task directly
72-
node sysdig-cli-scan-task/dist/index.js
70+
# Run the task directly, with the default (latest) and the oldest supported scanner
71+
for version in latest 1.23.0; do # oldest-version-marker — DO NOT REMOVE; auto-updated by `just update-oldest-cli-scanner`
72+
echo "Running smoke test with sysdig-cli-scanner ${version}..."
73+
INPUT_SYSDIGCLISCANNERVERSION="${version}" node sysdig-cli-scan-task/dist/index.js
74+
done
7375
displayName: 'Local smoke-run of the task'

‎flake.nix‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,12 @@
2626
mkShell {
2727
packages = [
2828
azure-cli
29+
# GNU tools the justfile `scanner` recipes rely on (BSD versions on macOS break them).
30+
coreutils
2931
curl
3032
git
33+
gnugrep
34+
gnused
3135
jq
3236
just
3337
nodejs_22

‎justfile‎

Lines changed: 90 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,100 @@ publish-release:
3030
pin-actions:
3131
pinact run -u
3232

33-
# Update everything: flake inputs, tfx-cli, and pinned actions
33+
# Update everything: flake inputs, tfx-cli, pinned actions, and the sysdig-cli-scanner versions
3434
update:
3535
nix flake update
3636
nix develop --command just update-tfx
3737
nix develop --command just pin-actions
38+
nix develop --command just update-cli-scanner
39+
nix develop --command just update-oldest-cli-scanner
40+
41+
# (internal) Print the latest published sysdig-cli-scanner version
42+
[private]
43+
_latest-version:
44+
@curl --silent --fail --show-error --location https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt | tr -d '[:space:]'
45+
46+
# Find the oldest sysdig-cli-scanner version still within the support window (default 365 days)
47+
oldest-cli-scanner window_days="365":
48+
#!/usr/bin/env bash
49+
set -euo pipefail
50+
base="https://download.sysdig.com/scanning/bin/sysdig-cli-scanner"
51+
os="linux"; arch="amd64"
52+
cutoff=$(( $(date -u +%s) - {{window_days}} * 86400 ))
53+
latest=$(just _latest-version)
54+
major=${latest%%.*}
55+
minor=$(echo "$latest" | cut -d. -f2)
56+
oldest_ver=""; oldest_epoch=""
57+
for m in $(seq "$minor" -1 0); do
58+
minor_hit=0; misses=0
59+
for p in $(seq 0 30); do
60+
v="$major.$m.$p"
61+
lm=$(curl -sfI "$base/$v/$os/$arch/sysdig-cli-scanner" \
62+
| grep -i '^last-modified:' | sed 's/^[Ll]ast-[Mm]odified: //' | tr -d '\r' || true)
63+
if [ -z "$lm" ]; then
64+
misses=$((misses + 1)); [ "$misses" -ge 2 ] && break; continue
65+
fi
66+
misses=0
67+
epoch=$(date -u -d "$lm" +%s)
68+
if [ "$epoch" -ge "$cutoff" ]; then
69+
minor_hit=1
70+
if [ -z "$oldest_epoch" ] || [ "$epoch" -lt "$oldest_epoch" ]; then
71+
oldest_epoch=$epoch; oldest_ver=$v
72+
fi
73+
fi
74+
done
75+
# Versions are chronological: once a whole minor is out of window, stop.
76+
[ "$minor_hit" -eq 0 ] && [ -n "$oldest_ver" ] && break
77+
done
78+
if [ -z "$oldest_ver" ]; then
79+
echo "No version found within the last {{window_days}} days" >&2
80+
exit 1
81+
fi
82+
echo >&2 "Oldest supported: $oldest_ver (released $(date -u -d "@$oldest_epoch" '+%Y-%m-%d'))"
83+
echo "$oldest_ver"
84+
85+
# (internal) Replace the version tagged with <marker>-version-marker wherever it
86+
# appears. Markers are HTML-comment spans in Markdown and trailing `#`/`//`
87+
# comments in YAML/TS. Target files are discovered, not hardcoded, so a new
88+
# marker anywhere is picked up automatically. DO NOT delete those markers.
89+
[private]
90+
_set-version marker version:
91+
#!/usr/bin/env bash
92+
set -euo pipefail
93+
# Discover files carrying this marker. Skip deps, build output, and the
94+
# tooling/docs that only name the marker in prose.
95+
mapfile -t files < <(grep -rl \
96+
--exclude-dir=.git --exclude-dir=node_modules --exclude-dir=dist \
97+
--exclude=justfile --exclude=AGENTS.md \
98+
"{{marker}}-version-marker" . | sort)
99+
if [ "${#files[@]}" -eq 0 ]; then
100+
echo "No files found carrying {{marker}}-version-marker" >&2
101+
exit 1
102+
fi
103+
for f in "${files[@]}"; do
104+
echo "Updating $f" >&2
105+
# Markdown: <!-- {{marker}}-version-marker ... -->X<!-- /{{marker}}-version-marker -->
106+
sed -i -E "s#(<!-- {{marker}}-version-marker[^>]*-->)(\`?)[0-9][0-9.]*(\`?)(<!-- /{{marker}}-version-marker -->)#\1\2{{version}}\3\4#g" "$f"
107+
# YAML/TS: line carrying a `#`/`//` {{marker}}-version-marker comment
108+
sed -i -E "/(#|\/\/)[[:space:]]*{{marker}}-version-marker/ s/[0-9]+\.[0-9]+\.[0-9]+/{{version}}/" "$f"
109+
done
110+
111+
# Substitute the oldest supported version wherever the oldest-version-marker is placed
112+
update-oldest-cli-scanner window_days="365":
113+
#!/usr/bin/env bash
114+
set -euo pipefail
115+
oldest=$(just oldest-cli-scanner {{window_days}})
116+
just _set-version oldest "$oldest"
117+
echo "Oldest supported version set to $oldest (via oldest-version-marker)"
118+
119+
# Update the pinned sysdig-cli-scanner version (README example) to the latest available.
120+
# The task itself defaults to `latest` at runtime.
121+
update-cli-scanner:
122+
#!/usr/bin/env bash
123+
set -euo pipefail
124+
latest=$(just _latest-version)
125+
just _set-version newest "$latest"
126+
echo "Newest version set to $latest (via newest-version-marker)"
38127
39128
# Bump tfx-cli to the latest upstream commit and recompute its hashes
40129
update-tfx:

‎sysdig-cli-scan-task/package-lock.json‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎sysdig-cli-scan-task/package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "sysdig-cli-scan-task",
3-
"version": "1.0.3",
3+
"version": "1.0.4",
44
"description": "Sysdig Secure Scan Task",
55
"main": "index.js",
66
"scripts": {

‎sysdig-cli-scan-task/task.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
"version": {
1111
"Major": 1,
1212
"Minor": 0,
13-
"Patch": 3
13+
"Patch": 4
1414
},
1515
"minimumAgentVersion": "3.232.1",
1616
"groups": [

‎vss-extension.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
"manifestVersion": 1,
33
"id": "sysdig-cli-scan-task",
44
"name": "Sysdig CLI scanner",
5-
"version": "1.0.3",
5+
"version": "1.0.4",
66
"publisher": "SysdigDevOps",
77
"description": "Scan images with Sysdig Secure as part of your development pipeline.",
88
"public": true,

0 commit comments

Comments
 (0)