google / log4jscanner

A log4j vulnerability filesystem scanner and Go package for analyzing JAR files.
Apache License 2.0
1.57k stars 120 forks source link

workflow: add binary build and publish action #9

Closed RiRa12621 closed 2 years ago

RiRa12621 commented 2 years ago

This PR adds an action to create binaries once a release is crafted.

As a follow up, an addition to the readme is needed, but it would make sense to ensure the workflow is working as expected, before adding the corresponding readme section.

This fixes #6

RiRa12621 commented 2 years ago

The zip and tar archive should just be a single line essentially, so that could be added to the run section. Maybe the folder should then be renamed.

We can point to a release version of the actions as well. I can dig up which are the current stable releases.

The token is a built in of GitHub that's generated at the start of a run: https://docs.github.com/en/actions/security-guides/automatic-token-authentication

ericchiang commented 2 years ago

Okay cool! I'm going to try to see how rough it is to just call curl directly from the script to upload the asset. Doesn't seem too bad

ericchiang commented 2 years ago

Closed via https://github.com/google/log4jscanner/pull/11 https://github.com/google/log4jscanner/pull/14