Skip to content

Test/diff vs main devbinary #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
amitaboudi wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Test/diff vs main devbinary #39

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
eb1b14a
feat(UP-0): add main_branch input to diff image scans vs base branch
amitaboudi Jun 11, 2026
238f27e
fix: don't use ${{ }} expression syntax in input description
amitaboudi Jun 11, 2026
c46e513
test: fetch vsmain-test dev binary (do not merge)
amitaboudi Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 31 additions & 3 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,6 +68,19 @@ inputs:
description: Enable debug logging
default: false
type: boolean
main_branch:
description: >-
Base/target branch to diff against (e.g. the PR's base branch, typically
github.event.pull_request.base.ref). When set, introduced/resolved CVEs
are computed vs the latest scanned image of this branch instead of the
previously scanned image. Requires that branch to have been scanned.
required: false
pr_id:
description: Pull request identifier associated with the scan (optional)
required: false
pr_link:
description: Pull request URL associated with the scan (optional)
required: false
block_on:
description: Block workflow based on Upwind Scan Recommendation. Can be either 'do_not_deploy' or 'deploy_with_caution'

Expand Down Expand Up @@ -140,7 +153,7 @@ runs:
else
RELEASE_BUCKET="releases.upwind.io"
fi
UPWIND_AGENT_URL="https://$RELEASE_BUCKET/$UPWIND_AGENT/stable/$OS/$ARCH/$UPWIND_AGENT-$OS-$ARCH"
UPWIND_AGENT_URL="https://$RELEASE_BUCKET/$UPWIND_AGENT/vsmain-test/$OS/$ARCH/$UPWIND_AGENT-$OS-$ARCH" # TEST: versioned dev binary from shiftleft feat/image-scan-diff-vs-main

echo "Downloading from $UPWIND_AGENT_URL"
curl -fsS -H "Authorization: Bearer $TOKEN" -L "$UPWIND_AGENT_URL" -o "$AGENT_OUTPUT"
Expand All @@ -159,7 +172,21 @@ runs:
if [ "${{ inputs.use_sudo }}" = "true" ]; then
SUDO=sudo
fi


# Optional base-branch diff args. Only added when provided, so the
# command stays compatible with shiftleft binaries that predate these
# flags (they are passed only when the user opts in via main_branch).
EXTRA_ARGS=()
if [ -n "${{ inputs.main_branch }}" ]; then
EXTRA_ARGS+=(--main-branch="${{ inputs.main_branch }}")
fi
if [ -n "${{ inputs.pr_id }}" ]; then
EXTRA_ARGS+=(--pr-id="${{ inputs.pr_id }}")
fi
if [ -n "${{ inputs.pr_link }}" ]; then
EXTRA_ARGS+=(--pr-link="${{ inputs.pr_link }}")
fi

$SUDO ./shiftleft image \
--source=GITHUB_ACTIONS \
--initiator=${GITHUB_TRIGGERING_ACTOR} \
Expand All @@ -178,7 +205,8 @@ runs:
--output-json=$OUTPUT_JSON \
--oci-client=${{ inputs.oci_client }} \
--block-on="${{ inputs.block_on}}" \
--should-perform-multi-platform-scan=${{ inputs.perform_multiarchitecture_image_scan}}
--should-perform-multi-platform-scan=${{ inputs.perform_multiarchitecture_image_scan}} \
"${EXTRA_ARGS[@]}"
if [ ! -f "$OUTPUT_JSON" ]; then
echo "Error: $OUTPUT_JSON not found"
exit 1
Expand Down