kernelCTF: add vuln-verify workflow

2026-06-08 14:27:23 +00:00 · 2026-03-17 15:56:01 +00:00
parent a7d0bf1a33
commit 5745a3c191
8 changed files with 616 additions and 0 deletions
@@ -0,0 +1,72 @@
+name: kernelctf-vuln-verify
+on:
+  pull_request_target:
+    types: [labeled]
+
+jobs:
+  verify:
+    if: github.event.label.name == 'vuln-verify'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          credentials_json: '${{ secrets.KERNELCTF_GCS_SA_KEY }}'
+
+      - name: Checkout master
+        uses: actions/checkout@v4
+        with:
+          ref: master
+          sparse-checkout: kernelctf/vuln-verify
+
+      - name: Checkout PR
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          path: pr
+          sparse-checkout: pocs/linux/kernelctf
+
+      - name: Checkout kernel-research
+        uses: actions/checkout@v4
+        with:
+          repository: google/kernel-research
+          path: kernel-research
+          sparse-checkout: image_runner
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y expect build-essential flex bison bc libelf-dev libssl-dev cpio pahole
+          pip install requests
+
+      - name: Setup environment
+        run: echo "IMAGE_RUNNER_DIR=${{ github.workspace }}/kernel-research/image_runner" >> $GITHUB_ENV
+
+      - name: Determine submission folder
+        id: determine_folder
+        run: |
+          # Get added files in the PR
+          ADDED_FILES=$(gh pr view ${{ github.event.pull_request.number }} --json files --jq '.files[] | select(.status == "added") | .path')
+          echo $ADDED_FILES
+          
+          # Filter for pocs/linux/kernelctf/ and get the unique directory
+          ADDED_FOLDER=$(echo "$ADDED_FILES" | grep '^pocs/linux/kernelctf/' | cut -d/ -f1-4 | sort -u | head -n 1)
+          
+          if [ -z "$ADDED_FOLDER" ]; then
+            echo "No added folders found in pocs/linux/kernelctf/"
+            exit 0
+          fi
+
+          echo "folder=$ADDED_FOLDER" >> $GITHUB_OUTPUT
+          echo "Found added folder: $ADDED_FOLDER"
+
+      - name: Run vuln-verify
+        if: steps.determine_folder.outputs.folder != ''
+        run: |
+          ./kernelctf/vuln-verify/verify.py "pr/${{ steps.determine_folder.outputs.folder }}"