|
6 | 6 | paths: |
7 | 7 | - '**/*.vbs' |
8 | 8 | - '**/*.hta' |
9 | | - |
10 | 9 | pull_request: |
11 | 10 | branches: [main, develop] |
12 | 11 | paths: |
13 | 12 | - '**/*.vbs' |
14 | 13 | - '**/*.hta' |
15 | | - |
16 | 14 | workflow_dispatch: |
17 | 15 |
|
18 | 16 | jobs: |
19 | 17 | vbscript-lint: |
20 | | - name: VBScript Syntax Validation |
21 | | - runs-on: windows-latest |
| 18 | + name: 🧪 VBScript Syntax Validation (Wine + Ubuntu) |
| 19 | + runs-on: ubuntu-latest |
22 | 20 |
|
23 | 21 | steps: |
24 | | - - name: 📦 Checkout Repository |
| 22 | + - name: 📦 Checkout Repository (short path to prevent long file issues) |
25 | 23 | uses: actions/checkout@v4 |
26 | 24 | with: |
27 | | - path: repo |
| 25 | + path: src |
28 | 26 |
|
29 | | - - name: 🔍 Locate VBS and HTA Files (with filtering) |
30 | | - working-directory: ./repo |
31 | | - shell: pwsh |
| 27 | + - name: 🍷 Install Wine and VBScript Runtime |
32 | 28 | run: | |
33 | | - Get-ChildItem -Recurse -Include *.vbs,*.hta | ForEach-Object { |
34 | | - if ($_.Extension -eq ".hta") { |
35 | | - $content = Get-Content $_.FullName -Raw |
36 | | - if ($content -match '<script\s+language=["'']?VBScript["'']?' -or $content -match '<script\s+type=["'']?text/vbscript["'']?') { |
37 | | - $_.FullName |
38 | | - } |
39 | | - } |
40 | | - elseif ($_.Extension -eq ".vbs") { |
41 | | - $_.FullName |
42 | | - } |
43 | | - } > vbscript-files.txt |
44 | | -
|
45 | | - - name: ✅ Run cscript Syntax Validation and Generate SARIF |
46 | | - working-directory: ./repo |
47 | | - shell: pwsh |
| 29 | + sudo dpkg --add-architecture i386 |
| 30 | + sudo apt update |
| 31 | + sudo apt install -y wine64 wine32 cabextract unzip |
| 32 | + mkdir -p ~/.wine/drive_c/windows/system32 |
| 33 | + echo "[✔️] Wine installed successfully" |
| 34 | +
|
| 35 | + - name: 📂 Find .vbs and .hta Files |
| 36 | + working-directory: ./src |
48 | 37 | run: | |
49 | | - $sarifPath = "sarif-output" |
50 | | - New-Item -ItemType Directory -Path $sarifPath -Force | Out-Null |
51 | | - $sarif = @{ |
52 | | - version = "2.1.0" |
53 | | - runs = @(@{ |
54 | | - tool = @{ |
55 | | - driver = @{ |
56 | | - name = "cscript.exe VBScript Syntax Checker" |
57 | | - informationUri = "https://learn.microsoft.com/en-us/previous-versions//d1wf56tt(v=vs.85)" |
58 | | - rules = @() |
59 | | - } |
60 | | - } |
61 | | - results = @() |
62 | | - }) |
63 | | - } |
64 | | -
|
65 | | - $files = Get-Content vbscript-files.txt | Where-Object { Test-Path $_ } |
66 | | -
|
67 | | - foreach ($file in $files) { |
68 | | - Write-Host "🔍 Checking: $file" |
69 | | -
|
70 | | - $output = cmd /c "cscript.exe //nologo `"$file`"" 2>&1 |
71 | | - $exitCode = $LASTEXITCODE |
| 38 | + find . -type f \( -iname "*.vbs" -o -iname "*.hta" \) > vbscript-files.txt |
| 39 | + cat vbscript-files.txt || echo "No VBS or HTA files found" |
72 | 40 |
|
73 | | - if ($exitCode -ne 0) { |
74 | | - Write-Warning "❌ Syntax Error in $file" |
75 | | -
|
76 | | - # Attempt to extract line number |
77 | | - $lineNum = 1 |
78 | | - if ($output -match "line (\d+)" -or $output -match "Line:(\d+)") { |
79 | | - $lineNum = [int]($matches[1]) |
80 | | - } |
81 | | -
|
82 | | - # Heuristic severity |
83 | | - $severity = if ($output -match "Expected|Syntax error|Invalid") { |
84 | | - "error" |
85 | | - } elseif ($output -match "unterminated|not defined") { |
86 | | - "warning" |
87 | | - } else { |
88 | | - "note" |
89 | | - } |
90 | | -
|
91 | | - $sarif.runs[0].results += @{ |
92 | | - ruleId = "vbscript-syntax-error" |
93 | | - level = $severity |
94 | | - message = @{ text = $output.Trim() } |
95 | | - locations = @(@{ |
96 | | - physicalLocation = @{ |
97 | | - artifactLocation = @{ uri = $file.Replace('\','/') } |
98 | | - region = @{ startLine = $lineNum } |
99 | | - } |
100 | | - }) |
101 | | - } |
102 | | - } |
103 | | - } |
104 | | -
|
105 | | - $sarif | ConvertTo-Json -Depth 10 | Set-Content "$sarifPath/vbscript-results.sarif" -Encoding UTF8 |
106 | | -
|
107 | | - - name: 📤 Upload SARIF Artifact |
| 41 | + - name: 🧠 Analyze and Validate VBScript Files |
| 42 | + working-directory: ./src |
| 43 | + run: | |
| 44 | + mkdir -p sarif |
| 45 | + echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"VBScript Syntax Check","informationUri":"https://learn.microsoft.com/en-us/previous-versions//d1wf56tt(v=vs.85)","rules":[]}},"results":[' > sarif/results.sarif |
| 46 | +
|
| 47 | + while IFS= read -r file; do |
| 48 | + echo "Checking: $file" |
| 49 | +
|
| 50 | + if [[ "$file" == *.hta ]]; then |
| 51 | + if ! grep -qi '<script[^>]*language="VBScript"' "$file"; then |
| 52 | + echo "Skipping non-VBScript HTA: $file" |
| 53 | + continue |
| 54 | + fi |
| 55 | + fi |
| 56 | +
|
| 57 | + if file "$file" | grep -qi text; then |
| 58 | + wine cscript.exe //nologo "$file" 2> stderr.txt |
| 59 | + exitCode=$? |
| 60 | +
|
| 61 | + if [ $exitCode -ne 0 ]; then |
| 62 | + msg=$(<stderr.txt) |
| 63 | + msg=${msg//\"/\\\"} |
| 64 | + echo "{\"level\": \"error\", \"message\": {\"text\": \"$msg\"}, \"locations\": [{\"physicalLocation\": {\"artifactLocation\": {\"uri\": \"$file\"}}}]}," >> sarif/results.sarif |
| 65 | + fi |
| 66 | + fi |
| 67 | + done < vbscript-files.txt |
| 68 | +
|
| 69 | + sed -i '$ s/},$/}]/' sarif/results.sarif |
| 70 | + echo '}]}]' >> sarif/results.sarif |
| 71 | +
|
| 72 | + - name: 📤 Upload SARIF Results |
108 | 73 | uses: actions/upload-artifact@v4 |
109 | 74 | with: |
110 | | - name: vbscript-sarif-results |
111 | | - path: repo/sarif-output/vbscript-results.sarif |
| 75 | + name: vbscript-syntax-results |
| 76 | + path: src/sarif/results.sarif |
| 77 | + if-no-files-found: warn |
112 | 78 |
|
113 | | - - name: 📡 Publish SARIF to GitHub Code Scanning |
| 79 | + - name: 🚨 Upload to GitHub Code Scanning (optional) |
114 | 80 | uses: github/codeql-action/upload-sarif@v3 |
115 | 81 | with: |
116 | | - sarif_file: repo/sarif-output/vbscript-results.sarif |
| 82 | + sarif_file: src/sarif/results.sarif |
0 commit comments