From 5584e3d6c57565d300d8f0031a43c216c33240e7 Mon Sep 17 00:00:00 2001 From: AJ Ancheta <7781450+ancheetah@users.noreply.github.com> Date: Thu, 22 Oct 2026 16:57:30 -0400 Subject: [PATCH] ci(mend): fix mend sca scan of packages --- .github/actions/mend-sast/action.yml | 11 ++--- .github/actions/mend-sca/action.yml | 58 ++++++++++++++++++++----- .github/workflows/mend-release-scan.yml | 10 +---- .gitignore | 3 ++ 4 files changed, 54 insertions(+), 28 deletions(-) diff --git a/.github/actions/mend-sast/action.yml b/.github/actions/mend-sast/action.yml index 8238c5e032..f515b8faec 100644 --- a/.github/actions/mend-sast/action.yml +++ b/.github/actions/mend-sast/action.yml @@ -1,12 +1,8 @@ name: 'Mend SAST Scan' description: 'SAST scan packages for release' inputs: - scan_dir: - description: 'Directory to scan' - required: false - default: 'packages/' full_scan: - description: 'Scan full repo if true' + description: 'Scan full repo' required: false default: 'false' MEND_SAST_REPORT_NAME: @@ -25,7 +21,6 @@ runs: steps: - name: Mend SAST scan env: - SCAN_DIR: ${{ inputs.scan_dir }} FULL_SCAN: ${{ inputs.full_scan }} REPORT_NAME: ${{ inputs.MEND_SAST_REPORT_NAME }} MEND_EMAIL: ${{ inputs.MEND_EMAIL }} @@ -36,8 +31,8 @@ runs: run: | args=(--scope 'Mobile//unified-sdk-javascript' --retries 2 --non-interactive --report --filename "$REPORT_NAME" --formats json --name "${REPORT_NAME}_$(date +%s)") # Omit `--dir` on a full scan so Mend scans the whole repo. - if [ "$FULL_SCAN" != "true" ]; then - args+=(--dir "$SCAN_DIR") + if [ "$FULL_SCAN" = "false" ]; then + args+=(--dir packages) fi mend code "${args[@]}" > "$REPORT_NAME.txt" diff --git a/.github/actions/mend-sca/action.yml b/.github/actions/mend-sca/action.yml index 529350f80b..65957e2d50 100644 --- a/.github/actions/mend-sca/action.yml +++ b/.github/actions/mend-sca/action.yml @@ -1,14 +1,14 @@ name: 'Mend SCA Scan' description: 'SCA scan packages for release' inputs: - scan_dir: - description: 'Directory to scan' - required: false - default: 'packages/' full_scan: - description: 'Scan full repo if true' + description: 'Scan full repo' required: false default: 'false' + temp_dir: + description: 'Directory for staging manifests' + required: false + default: 'mend-scan-dir' MEND_SCA_REPORT_NAME: description: 'Filename for the output of the scan' required: false @@ -23,7 +23,26 @@ inputs: runs: using: 'composite' steps: - - uses: pnpm/action-setup@v4 + - name: Isolate package manifests in a temporary directory + if: inputs.full_scan != 'true' + shell: bash + env: + MEND_TEMP_DIR: ${{ inputs.temp_dir }} + # Mend SCA scans need a matching lockfile, so stage it and package manifests + # in a temporary directory + run: | + mkdir -p "$MEND_TEMP_DIR"/packages/sdk-effects + cp package.json pnpm-workspace.yaml pnpm-lock.yaml .npmrc "$MEND_TEMP_DIR/" + + # Copy only manifests, preserving relative paths + for d in packages/*/ packages/sdk-effects/*/; do + # Skip directories which aren't npm packages + [ -f "$d/package.json" ] || continue + mkdir -p "$MEND_TEMP_DIR/$d" && cp "$d/package.json" "$MEND_TEMP_DIR/$d" + done + + - name: Install pnpm + uses: pnpm/action-setup@v4 with: run_install: false @@ -31,20 +50,34 @@ runs: run: pnpm config set store-dir '.pnpm-store' --global shell: bash - - uses: actions/setup-node@v6 + - name: Install Node.js + uses: actions/setup-node@v6 with: node-version-file: '.node-version' cache: 'pnpm' registry-url: 'https://registry.npmjs.org' - name: Install dependencies - run: pnpm install --frozen-lockfile + env: + FULL_SCAN: ${{ inputs.full_scan }} + MEND_TEMP_DIR: ${{ inputs.temp_dir }} shell: bash + run: | + if [ "$FULL_SCAN" = "false" ]; then + if [ ! -d "$MEND_TEMP_DIR" ]; then + echo "::error::Staging directory $MEND_TEMP_DIR does not exist." + exit 1 + fi + cd "$MEND_TEMP_DIR" + fi + + # Install deps with --prod flag to skip devDependencies + pnpm install --frozen-lockfile --ignore-scripts --prod - name: Mend SCA scan env: - SCAN_DIR: ${{ inputs.scan_dir }} FULL_SCAN: ${{ inputs.full_scan }} + MEND_TEMP_DIR: ${{ inputs.temp_dir }} REPORT_NAME: ${{ inputs.MEND_SCA_REPORT_NAME }} MEND_EMAIL: ${{ inputs.MEND_EMAIL }} MEND_USER_KEY: ${{ inputs.MEND_USER_KEY }} @@ -52,11 +85,12 @@ runs: shell: bash # Mend SCA scan does not generate a report so tee output to both console and file # --update flag syncs the results to the Mend portal and overwrites any pre-existing vulnerabilities + # --no-default-exclusions flag is necessary to scan `packages/` directory run: | - args=(--non-interactive --update --scope 'Mobile//unified-sdk-javascript') + args=(--non-interactive --update --no-default-exclusions --scope 'Mobile//unified-sdk-javascript') # Omit `--dir` on a full scan so Mend scans the whole repo. - if [ "$FULL_SCAN" != "true" ]; then - args+=(--dir "$SCAN_DIR") + if [ "$FULL_SCAN" = "false" ]; then + args+=(--dir "$MEND_TEMP_DIR") fi mend dep "${args[@]}" 2>&1 | tee "$REPORT_NAME.txt" diff --git a/.github/workflows/mend-release-scan.yml b/.github/workflows/mend-release-scan.yml index d7cb94edf3..4835c322bf 100644 --- a/.github/workflows/mend-release-scan.yml +++ b/.github/workflows/mend-release-scan.yml @@ -8,13 +8,9 @@ name: Mend Scans for Release on: workflow_dispatch: inputs: - scan_dir: - description: 'Directory to scan' - required: false - default: 'packages/' - type: string + # When full_scan is off, only `packages/` are scanned by default full_scan: - description: 'Scan full repo if true' + description: 'Scan full repo (optional)' required: false type: boolean default: false @@ -51,7 +47,6 @@ jobs: uses: ./.github/actions/mend-sast timeout-minutes: 10 with: - scan_dir: ${{ inputs.scan_dir }} full_scan: ${{ inputs.full_scan }} MEND_SAST_REPORT_NAME: ${{ inputs.sast_report_name }} MEND_EMAIL: ${{ env.MEND_EMAIL }} @@ -77,7 +72,6 @@ jobs: uses: ./.github/actions/mend-sca timeout-minutes: 10 with: - scan_dir: ${{ inputs.scan_dir }} full_scan: ${{ inputs.full_scan }} MEND_SCA_REPORT_NAME: ${{ inputs.sca_report_name }} MEND_EMAIL: ${{ env.MEND_EMAIL }} diff --git a/.gitignore b/.gitignore index d1637e636f..88cf1d23b8 100644 --- a/.gitignore +++ b/.gitignore @@ -102,3 +102,6 @@ tasks/ .polaris-setup-progress.json .playwright-mcp .polaris/ + +# Mend +mend-scan-dir/ \ No newline at end of file