Add Ghidra Backend CI configuration, fix CHANGELOG #3745
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [ master, backend-ghidra ] | |
| pull_request: | |
| branches: [ master, backend-ghidra ] | |
| # save workspaces to speed up testing | |
| env: | |
| CAPA_SAVE_WORKSPACE: "True" | |
| jobs: | |
| changelog_format: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout capa | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| # The sync GH action in capa-rules relies on a single '- *$' in the CHANGELOG file | |
| - name: Ensure CHANGELOG has '- *$' | |
| run: | | |
| number=$(grep '\- *$' CHANGELOG.md | wc -l) | |
| if [ $number != 1 ]; then exit 1; fi | |
| code_style: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout capa | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| - name: Set up Python 3.8 | |
| uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0 | |
| with: | |
| python-version: "3.8" | |
| - name: Install dependencies | |
| run: pip install -e .[dev] | |
| - name: Lint with ruff | |
| run: ruff check --config .github/ruff.toml . | |
| - name: Lint with isort | |
| run: isort --profile black --length-sort --line-width 120 --skip-glob "*_pb2.py" -c . | |
| - name: Lint with black | |
| run: black -l 120 --extend-exclude ".*_pb2.py" --check . | |
| - name: Lint with pycodestyle | |
| run: pycodestyle --exclude="*_pb2.py" --show-source capa/ scripts/ tests/ | |
| - name: Check types with mypy | |
| run: mypy --config-file .github/mypy/mypy.ini --check-untyped-defs capa/ scripts/ tests/ | |
| rule_linter: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout capa with submodules | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python 3.8 | |
| uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0 | |
| with: | |
| python-version: "3.8" | |
| - name: Install capa | |
| run: pip install -e . | |
| - name: Run rule linter | |
| run: python scripts/lint.py rules/ | |
| tests: | |
| name: Tests in ${{ matrix.python-version }} on ${{ matrix.os }} | |
| runs-on: ${{ matrix.os }} | |
| needs: [code_style, rule_linter] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-20.04, windows-2019, macos-11] | |
| # across all operating systems | |
| python-version: ["3.7", "3.11"] | |
| include: | |
| # on Ubuntu run these as well | |
| - os: ubuntu-20.04 | |
| python-version: "3.8" | |
| - os: ubuntu-20.04 | |
| python-version: "3.9" | |
| - os: ubuntu-20.04 | |
| python-version: "3.10" | |
| steps: | |
| - name: Checkout capa with submodules | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install pyyaml | |
| if: matrix.os == 'ubuntu-20.04' | |
| run: sudo apt-get install -y libyaml-dev | |
| - name: Install capa | |
| run: pip install -e .[dev] | |
| - name: Run tests | |
| run: pytest -v tests/ | |
| binja-tests: | |
| name: Binary Ninja tests for ${{ matrix.python-version }} | |
| env: | |
| BN_SERIAL: ${{ secrets.BN_SERIAL }} | |
| runs-on: ubuntu-20.04 | |
| needs: [code_style, rule_linter] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.7", "3.11"] | |
| steps: | |
| - name: Checkout capa with submodules | |
| # do only run if BN_SERIAL is available, have to do this in every step, see https://github.com/orgs/community/discussions/26726#discussioncomment-3253118 | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python ${{ matrix.python-version }} | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install pyyaml | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| run: sudo apt-get install -y libyaml-dev | |
| - name: Install capa | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| run: pip install -e .[dev] | |
| - name: install Binary Ninja | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| run: | | |
| mkdir ./.github/binja | |
| curl "https://raw.githubusercontent.com/Vector35/binaryninja-api/6812c97/scripts/download_headless.py" -o ./.github/binja/download_headless.py | |
| python ./.github/binja/download_headless.py --serial ${{ env.BN_SERIAL }} --output .github/binja/BinaryNinja-headless.zip | |
| unzip .github/binja/BinaryNinja-headless.zip -d .github/binja/ | |
| python .github/binja/binaryninja/scripts/install_api.py --install-on-root --silent | |
| - name: Run tests | |
| if: ${{ env.BN_SERIAL != 0 }} | |
| env: | |
| BN_LICENSE: ${{ secrets.BN_LICENSE }} | |
| run: pytest -v tests/test_binja_features.py # explicitly refer to the binja tests for performance. other tests run above. | |
| ghidra-tests: | |
| name: Ghidra tests for ${{ matrix.python-version }} | |
| runs-on: ubuntu-20.04 | |
| needs: [code_style, rule_linter] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.7", "3.11"] | |
| java-version: ["17"] | |
| gradle-version: ["7.3"] | |
| ghidra-version: ["10.3"] | |
| public-version: ["PUBLIC_20230510"] # for ghidra releases | |
| jep-version: ["4.1.1"] | |
| ghidrathon-version: ["2.1.0"] | |
| steps: | |
| - name: Checkout capa with submodules | |
| uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| with: | |
| submodules: true | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # v4.5.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Set up Java ${{ matrix.java-version }} | |
| uses: actions/setup-java@5ffc13f4174014e2d4d4572b3d74c3fa61aeb2c2 # v3 | |
| with: | |
| distribution: 'temurin' | |
| java-version: ${{ matrix.java-version }} | |
| - name: Set up Gradle ${{ matrix.gradle-version }} | |
| uses: gradle/gradle-build-action@40b6781dcdec2762ad36556682ac74e31030cfe2 # v2.5.1 | |
| with: | |
| gradle-version: ${{ matrix.gradle-version }} | |
| - name: Install Jep ${{ matrix.jep-version }} | |
| run : pip install jep==${{ matrix.jep-version }} | |
| - name: Install Ghidra ${{ matrix.ghidra-version }} | |
| run: | | |
| mkdir ./.github/ghidra | |
| mkdir ./.github/ghidra/project | |
| wget "https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_${{ matrix.ghidra-version }}_build/ghidra_${{ matrix.ghidra-version }}_${{ matrix.public-version }}.zip" -O ./.github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC.zip | |
| unzip .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC.zip -d .github/ghidra/ | |
| - name: Install Ghidrathon | |
| run : | | |
| mkdir ./.github/ghidrathon | |
| .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC/ghidraRun | |
| mkdir ~/.ghidra/.ghidra_${{ matrix.ghidra-version }}_PUBLIC/Extensions | |
| wget "https://github.com/mandiant/Ghidrathon/archive/refs/tags/v${{ matrix.ghidrathon-version }}.zip" -O ./.github/ghidrathon/ghidrathon-${{ matrix.ghidrathon-version }}.zip | |
| unzip .github/ghidrathon/ghidrathon-${{ matrix.ghidrathon-version }}.zip -d .github/ghidrathon/ | |
| workdir=$(pwd) | |
| gradle -p ./.github/ghidrathon/Ghidrathon-${{ matrix.ghidrathon-version }}/ -PGHIDRA_INSTALL_DIR=$workdir/.github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC | |
| unzip .github/ghidrathon/Ghidrathon-${{ matrix.ghidrathon-version }}/dist/*.zip -d ~/.ghidra/.ghidra_${{ matrix.ghidra-version }}_PUBLIC/Extensions | |
| - name: Install pyyaml | |
| run: sudo apt-get install -y libyaml-dev | |
| - name: Install capa | |
| run: | | |
| pip install -e .[dev] | |
| python scripts/cache-ruleset.py rules/ cache/ | |
| - name: Run tests | |
| run: | # runs main.py for now... | |
| .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC/support/analyzeHeadless .github/ghidra/project ghidra_test -Import /tests/data/'Practical Malware Analysis Lab 01-01.dll_' | |
| .github/ghidra/ghidra_${{ matrix.ghidra-version }}_PUBLIC/support/analyzeHeadless .github/ghidra/project ghidra_test -process 'Practical Malware Analysis Lab 01-01.dll_' -ScriptPath ./capa -PostScript main.py | |