Lucas RayanandClaude Opus 5.5
16affedd2b
- Só itens fixados vão para o disco, com permissão 600/700 - Ignora conteúdo marcado por gerenciadores de senha - Limites de tamanho e validação do histórico salvo - Comando 'copiado esquecer' - Trivy (repo e pacote), ações fixadas por hash, permissões mínimas - Release publica SHA256SUMS e o instalador confere o checksum Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
127 lines
3.8 KiB
YAML
127 lines
3.8 KiB
YAML
name: Pacote
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
tags: ["v*"]
|
|
pull_request:
|
|
schedule:
|
|
- cron: "0 9 * * 1" # toda segunda: reavalia com a base de vulnerabilidades nova
|
|
|
|
# por padrão nenhum job pode escrever nada; cada um pede só o que precisa
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verificar:
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Checar código
|
|
run: |
|
|
python3 -m py_compile copiado.py
|
|
shellcheck instalar.sh desinstalar.sh empacotamento/gerar-deb.sh
|
|
|
|
trivy:
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: read
|
|
security-events: write # envia o relatório para a aba Security do GitHub
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Trivy (relatório para a aba Security)
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
scanners: vuln,secret,misconfig
|
|
format: sarif
|
|
output: trivy.sarif
|
|
exit-code: "0"
|
|
|
|
- uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
|
|
if: always()
|
|
with:
|
|
sarif_file: trivy.sarif
|
|
category: trivy
|
|
|
|
- name: Trivy (barra a esteira em HIGH/CRITICAL)
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: .
|
|
scanners: vuln,secret,misconfig
|
|
severity: HIGH,CRITICAL
|
|
format: table
|
|
exit-code: "1"
|
|
skip-setup-trivy: true
|
|
|
|
pacote:
|
|
needs: [verificar, trivy]
|
|
runs-on: ubuntu-24.04
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Definir versão
|
|
run: |
|
|
if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
|
|
echo "VERSAO=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
|
|
else
|
|
echo "VERSAO=0.0.0~dev${GITHUB_RUN_NUMBER}" >> "$GITHUB_ENV"
|
|
fi
|
|
|
|
- name: Gerar .deb
|
|
run: |
|
|
empacotamento/gerar-deb.sh "$VERSAO"
|
|
cd dist && sha256sum copiado_all.deb > SHA256SUMS
|
|
|
|
- name: Testar instalação do pacote
|
|
run: |
|
|
sudo apt-get update -qq
|
|
sudo apt-get install -y ./dist/copiado_all.deb
|
|
test -x /usr/bin/copiado
|
|
test -f /etc/xdg/autostart/copiado.desktop
|
|
mkdir -p conteudo && dpkg-deb -x dist/copiado_all.deb conteudo
|
|
|
|
- name: Trivy no conteúdo do pacote
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
scan-type: fs
|
|
scan-ref: conteudo
|
|
scanners: vuln,secret
|
|
severity: HIGH,CRITICAL
|
|
exit-code: "1"
|
|
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: copiado
|
|
path: |
|
|
dist/copiado_all.deb
|
|
dist/SHA256SUMS
|
|
|
|
release:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: pacote
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
contents: write # só este job pode publicar
|
|
steps:
|
|
- uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
|
|
with:
|
|
name: copiado
|
|
path: dist
|
|
- name: Publicar release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
TAG: ${{ github.ref_name }}
|
|
run: |
|
|
gh release create "$TAG" dist/copiado_all.deb dist/SHA256SUMS \
|
|
--repo "$GITHUB_REPOSITORY" --title "Copiado ${TAG#v}" --generate-notes
|