Improve VERS version range support, comparators, and native range parsing #838
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Python matrix CI | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| build: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, windows-latest, macos-15] | |
| python-version: ['3.10', '3.11', '3.12', '3.13', '3.14'] | |
| fail-fast: false | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Display Python version | |
| run: python -c "import sys; print(sys.version)" | |
| - name: Use Node.js | |
| uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: '25.x' | |
| - name: Set up JDK | |
| uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '25' | |
| - name: Install dependencies | |
| run: | | |
| uv sync --all-extras --dev | |
| - name: Lint with flake8 | |
| run: | | |
| uv run flake8 . --count --show-source --exit-zero --statistics | |
| - name: Test with pytest | |
| run: | | |
| uv run pytest --cov=vdb test | |
| env: | |
| PYTHONPATH: . | |
| TEST_VDB_HOME: vdb_data | |
| VDB_TEMP_DIR: ${{ runner.temp }}/vdb-temp | |
| - name: Generate SBOM with cdxgen | |
| run: | | |
| npm install -g @cyclonedx/cdxgen | |
| cdxgen -t python -o bom.json . | |
| if: ${{ matrix.python-version == '3.13' && matrix.os == 'ubuntu-latest' }} | |
| - name: CLI tests | |
| run: | | |
| set -euxo pipefail | |
| uv sync --all-extras --dev | |
| export VDB_HOME="$PWD/vdb_live" | |
| uv run vdb --cache --only-osv --include-metadata | |
| uv run vdb --bom bom.json | |
| uv run vdb --search "pkg:maven/org.springframework/spring-core@6.0.13" | |
| uv run vdb --search "pkg:maven/org.hibernate.orm/hibernate-core@6.2.9.Final" | |
| uv run vdb --search "pkg:nuget/Microsoft.Data.SqlClient@5.0.1" | |
| uv run vdb --search "pkg:nuget/Microsoft.IdentityModel.JsonWebTokens@6.21.0" | |
| uv run vdb --search "pkg:nuget/System.Drawing.Common@5.0.0" | |
| uv run vdb --search "pkg:npm/eslint-config-prettier@9.1.0" | |
| uv run vdb --search "pkg:npm/eslint-config-prettier@9.1.1" | |
| uv run vdb --search "pkg:npm/eslint-config-prettier@10.1.7" | |
| uv run vdb --search "escape.tech:graphql-armor-max-depth:2.4.0" | |
| uv run vdb --search "pkg:npm/%40escape.tech/graphql-armor-max-depth@2.4.0" | |
| echo "Reporting metadata + FTS footprint and query timings..." | |
| uv run python .github/workflows/report_vdb_metadata.py --vdb-home "$VDB_HOME" | |
| echo "Running SQL sanity checks on the built database..." | |
| uv run python .github/workflows/sanity_check_vdb.py --vdb-home "$VDB_HOME" | |
| echo "Creating custom vulnerability file..." | |
| mkdir -p custom_vulns | |
| cat > custom_vulns/private.yaml <<EOF | |
| dataType: CVE_RECORD | |
| dataVersion: "5.2" | |
| cveMetadata: | |
| cveId: PRIVATE-CLI-TEST | |
| assignerOrgId: 00000000-0000-4000-8000-000000000000 | |
| state: PUBLISHED | |
| datePublished: "2024-01-01T00:00:00Z" | |
| dateUpdated: "2024-01-01T00:00:00Z" | |
| containers: | |
| cna: | |
| providerMetadata: | |
| orgId: 00000000-0000-4000-8000-000000000000 | |
| descriptions: | |
| - lang: en | |
| value: "CLI Test Vulnerability" | |
| affected: | |
| - vendor: internal | |
| product: cli-test | |
| packageName: cli-test | |
| packageURL: pkg:pypi/cli-test | |
| versions: | |
| - version: "1.0.0" | |
| status: affected | |
| versionType: semver | |
| lessThan: "2.0.0" | |
| EOF | |
| # Overlay search of a private CVE that only exists in custom data. | |
| # This mirrors the former test_overlay_search_private_cve unit test, | |
| # which could not run in-process because search_by_cve(with_data=True) | |
| # resolves to the on-disk VDB_HOME database. Widen the rich table so the | |
| # description does not wrap and break the grep assertions below. | |
| export COLUMNS=200 | |
| echo "Overlay: in-range version must match the private CVE..." | |
| uv run vdb --search pkg:pypi/cli-test@1.5.0 --custom-data custom_vulns | tee overlay-in-range.out | |
| grep -q "PRIVATE-CLI-TEST" overlay-in-range.out | |
| echo "Overlay: out-of-range version must NOT match..." | |
| uv run vdb --search pkg:pypi/cli-test@2.1.0 --custom-data custom_vulns | tee overlay-out-of-range.out | |
| if grep -q "PRIVATE-CLI-TEST" overlay-out-of-range.out; then | |
| echo "FAIL: out-of-range 2.1.0 unexpectedly matched PRIVATE-CLI-TEST" | |
| exit 1 | |
| fi | |
| echo "Overlay: search by CVE id must return the record with its metadata..." | |
| uv run vdb --search PRIVATE-CLI-TEST --custom-data custom_vulns | tee overlay-by-cve.out | |
| grep -q "PRIVATE-CLI-TEST" overlay-by-cve.out | |
| grep -q "CLI Test Vulnerability" overlay-by-cve.out | |
| echo "Creating deterministic CLI fixture database for text and bulk searches..." | |
| export VDB_HOME="$PWD/vdb_seeded" | |
| rm -rf "$VDB_HOME" | |
| mkdir -p "$VDB_HOME" | |
| uv run python .github/workflows/seed_cli_fixture_db.py --vdb-home "$VDB_HOME" | |
| cat > packages.json <<'EOF' | |
| { | |
| "packages": [ | |
| {"purl": "pkg:pypi/cli-demo@1.5.0"}, | |
| {"package_name": "widget-ui"}, | |
| {"alias": "GHSA-cli-1234"}, | |
| {"search": "deserialization parser"} | |
| ] | |
| } | |
| EOF | |
| uv run vdb --search-text "deserialization parser" | tee search-text.out | |
| grep -q "CVE-2025-9001" search-text.out | |
| uv run vdb --search-alias "GHSA-cli-1234" | tee search-alias.out | |
| grep -q "CVE-2025-9001" search-alias.out | |
| uv run vdb --search-reference "example.com/advisories/cli-demo" | tee search-reference.out | |
| grep -q "CVE-2025-9001" search-reference.out | |
| uv run vdb --search-package-name "widget-ui" | tee search-package-name.out | |
| grep -q "CVE-2025-9002" search-package-name.out | |
| uv run vdb --search-symbol "parse_payload" | tee search-symbol.out | |
| grep -q "CVE-2025-9001" search-symbol.out | |
| uv run vdb --search-packages packages.json --batch-size 2 | tee search-packages.out | |
| grep -q "CVE-2025-9001" search-packages.out | |
| grep -q "CVE-2025-9002" search-packages.out | |
| if: ${{ matrix.python-version == '3.13' && matrix.os == 'ubuntu-latest' }} | |
| env: | |
| VDB_IGNORE_OS: true | |
| VDB_TEMP_DIR: ${{ runner.temp }}/vdb-temp | |
| VDB_INCLUDE_METADATA: true | |
| OSV_EXCLUDE_MALWARE: true |