Mayhem #285
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Mayhem | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 2 * * *' # run at 1 AM UTC | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| BRANCH_NAME: ${{ github.head_ref || github.ref_name }} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: 'build' | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest] | |
| shared: [false] | |
| build_type: [Release] | |
| include: | |
| - os: ubuntu-latest | |
| triplet: x64-linux | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Log in to the Container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v5 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| - name: Set lowercase image name | |
| run: | | |
| echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> ${GITHUB_ENV} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| push: true | |
| file: mayhem/Dockerfile | |
| tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH_NAME }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| outputs: | |
| image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.BRANCH_NAME }} | |
| mayhem: | |
| needs: build | |
| name: 'fuzz' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| mayhemfile: | |
| - mayhem/lighttpd.mayhemfile | |
| - mayhem/mayhemit.mayhemfile | |
| # Specify one or many Mayhemfiles here | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| submodules: recursive | |
| - name: Start analysis for ${{ matrix.mayhemfile }} | |
| id: run-mayhem | |
| uses: ForAllSecure/mcode-action@v1 | |
| with: | |
| mayhem-url: ${{ secrets.MAYHEM_URL }} | |
| mayhem-token: ${{ secrets.MAYHEM_TOKEN }} | |
| args: --image ${{ needs.build.outputs.image }} --file ${{ matrix.mayhemfile }} --duration 60 | |
| owner: forallsecure-demo | |
| fail-on-defects: true | |
| sarif-output: sarif | |
| junit-output: junit | |
| coverage-output: coverage | |
| - name: Upload SARIF file(s) | |
| if: always() | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: sarif | |
| - name: Upload JUNIT file(s) | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: junit | |
| path: junit | |
| - name: Upload coverage to Codecov | |
| if: always() | |
| uses: codecov/codecov-action@v4 | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} | |
| with: | |
| files: coverage/*.lcov | |
| flags: vulnerability-tests | |
| name: mayhem |