mirror of
https://github.com/Yamato-Security/WELA.git
synced 2026-11-02 19:28:19 +01:00
Shirofune-SecurityandClaude Opus 4.8
07c9e10cbf
Updates GitHub Actions to their latest releases and switches .github/workflows/docs.yml from floating major tags to commit-SHA pins, so every actions/* reference is pinned by SHA with a version comment (matching the convention used in the other workflows). - actions/checkout v6.0.2 -> v7.0.1 (docs.yml was already @v7) - actions/setup-python v6 / v6.3.0 -> v7.1.0 - actions/setup-node v6.4.0 -> v7.1.0 - actions/upload-artifact v7.0.1 -> v7.0.2 - actions/configure-pages -> v6.0.0 (SHA-pinned) - actions/upload-pages-artifact -> v5.0.0 (SHA-pinned) - actions/deploy-pages -> v5.0.1 (SHA-pinned) peter-evans/create-pull-request (v8.1.1) and peter-evans/enable-pull-request-automerge (v3.0.0) are already on their latest releases and left unchanged. Safe for our usage: checkout v7 only changes pull_request_target / workflow_run behavior (unused here); setup-python v7 drops the unused pip-install input (both usages pass only python-version / cache). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
91 lines
3.9 KiB
YAML
91 lines
3.9 KiB
YAML
name: create security_rules.json
|
|
on:
|
|
schedule:
|
|
- cron: '0 20 1 * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout self repository
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
path: WELA
|
|
|
|
- name: Checkout wela-extractor
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
repository: Yamato-Security/WELA-RulesGenerator
|
|
path: wela-extractor
|
|
|
|
- name: Checkout hayabusa-rules
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
repository: Yamato-Security/hayabusa-rules
|
|
path: hayabusa-rules
|
|
|
|
- name: Run
|
|
run: cd wela-extractor && cargo run --release -- ../hayabusa-rules ../WELA/config/eid_subcategory_mapping.csv ../WELA/config/security_rules.json
|
|
|
|
- name: Create Text
|
|
id: create-text
|
|
run: |
|
|
pushd WELA
|
|
echo "action_date=$(date '+%Y-%m-%d %H:%M:%S')" >> $GITHUB_ENV
|
|
echo "change_exist=true" >> $GITHUB_ENV
|
|
git_new=$(git diff --name-status --diff-filter=AC)
|
|
git_mod=$(git diff --name-status --diff-filter=MR)
|
|
git_del=$(git diff --name-status --diff-filter=D)
|
|
is_rule_changed=$(git status)
|
|
if [ "${is_rule_changed}" =~ nothing\sto\scommit ]; then
|
|
echo "change_exist=false" >> $GITHUB_ENV
|
|
else
|
|
echo "<details><summary>New files</summary>" >> ../changed_rule.logs
|
|
echo "${git_new}" >> ../changed_rule.logs
|
|
echo "</details>" >> ../changed_rule.logs
|
|
echo "<details><summary>Modified files</summary>" >> ../changed_rule.logs
|
|
echo "${git_mod}" >> ../changed_rule.logs
|
|
echo "</details>" >> ../changed_rule.logs
|
|
echo "<details><summary>Deleted files</summary>" >> ../changed_rule.logs
|
|
echo "${git_del}" >> ../changed_rule.logs
|
|
echo "</details>" >> ../changed_rule.logs
|
|
fi
|
|
popd
|
|
|
|
- name: Create Pull Request
|
|
if: env.change_exist == 'true'
|
|
id: cpr
|
|
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
|
|
with:
|
|
path: WELA
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
commit-message: Sigma Rule Update (${{ env.action_date }})
|
|
branch: rules/auto-sigma-update
|
|
delete-branch: true
|
|
title: '[Auto] Sigma Update report(${{ env.action_date }})' ### If a PR with the same name already exists, this github action library will not create a new pull request but it will update the PR with the same name. Therefore I added the date to the pull request's title so it creates a new PR.
|
|
branch-suffix: timestamp ### I use this field in order to avoid name duplication. If the pull request which is related to the same branch exists, the pull request is not newly created but is updated. So the next step will be skipped due to its if-field
|
|
body: |
|
|
${{ env.action_date }} Update report
|
|
|
|
- name: Enable Pull Request Automerge
|
|
if: steps.cpr.outputs.pull-request-operation == 'created' # This only runs if there were sigma rules updates and a new PR was created.
|
|
uses: peter-evans/enable-pull-request-automerge@a660677d5469627102a1c1e11409dd063606628d # v3.0.0
|
|
with:
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
pull-request-number: ${{ steps.cpr.outputs.pull-request-number }}
|
|
merge-method: squash
|
|
|
|
- name: upload change log
|
|
if: env.change_exist == 'true'
|
|
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
|
|
with:
|
|
name: changed_rule_log
|
|
path: ${{ github.workspace }}/changed_rule.logs
|
|
retention-days: 30
|