mirror of
https://github.com/peass-ng/PEASS-ng.git
synced 2026-07-28 14:47:18 -07:00
f
This commit is contained in:
Carlos Polop
@@ -96,14 +96,69 @@ jobs:
|
||||
echo "Leave the repo in a state ready to commit; changes will be committed and pushed automatically."
|
||||
} > codex_prompt.txt
|
||||
|
||||
- name: Run Codex
|
||||
id: run_codex
|
||||
uses: openai/codex-action@v1
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
|
||||
prompt-file: codex_prompt.txt
|
||||
sandbox: workspace-write
|
||||
model: gpt-5.2-codex
|
||||
python-version: "3.11"
|
||||
|
||||
- name: Install chack-agent
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
python -m pip install -e chack-agent
|
||||
|
||||
- name: Run Chack Agent
|
||||
id: run_codex
|
||||
env:
|
||||
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
||||
INPUT_PROVIDER: openai
|
||||
INPUT_MODEL_PRIMARY: gpt-5.2-codex
|
||||
INPUT_SYSTEM_PROMPT: You are an advanced research agent.
|
||||
run: |
|
||||
python - <<'PY' > chack_output.txt
|
||||
import os
|
||||
from chack_agent import (
|
||||
Chack,
|
||||
ChackConfig,
|
||||
ModelConfig,
|
||||
AgentConfig,
|
||||
SessionConfig,
|
||||
ToolsConfig,
|
||||
CredentialsConfig,
|
||||
LoggingConfig,
|
||||
)
|
||||
|
||||
with open("codex_prompt.txt", "r", encoding="utf-8") as handle:
|
||||
user_prompt = handle.read()
|
||||
|
||||
config = ChackConfig(
|
||||
model=ModelConfig(
|
||||
primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"),
|
||||
provider=os.environ.get("INPUT_PROVIDER", "openai"),
|
||||
),
|
||||
agent=AgentConfig(
|
||||
main_action="github_action",
|
||||
sub_action="run",
|
||||
),
|
||||
session=SessionConfig(),
|
||||
tools=ToolsConfig(exec_enabled=True),
|
||||
credentials=CredentialsConfig(
|
||||
openai_api_key=os.environ.get("OPENAI_API_KEY", ""),
|
||||
),
|
||||
logging=LoggingConfig(level="INFO"),
|
||||
system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."),
|
||||
env={},
|
||||
)
|
||||
|
||||
agent = Chack(config)
|
||||
result = agent.run(session_id="github-action", text=user_prompt)
|
||||
print(result.output)
|
||||
PY
|
||||
|
||||
{
|
||||
echo "final-message<<EOF"
|
||||
cat chack_output.txt
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Commit and push fix branch if changed
|
||||
id: push_fix
|
||||
@@ -114,9 +169,9 @@ jobs:
|
||||
exit 0
|
||||
fi
|
||||
|
||||
rm -f codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt
|
||||
rm -f codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt chack_output.txt
|
||||
git add -A
|
||||
git reset -- codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt
|
||||
git reset -- codex_failure_summary.txt codex_prompt.txt codex_failed_steps_logs.txt chack_output.txt
|
||||
git commit -m "Fix CI-master failures for run #${{ github.event.workflow_run.id }}"
|
||||
git push origin HEAD:"$FIX_BRANCH"
|
||||
echo "pushed=true" >> "$GITHUB_OUTPUT"
|
||||
|
||||
@@ -80,35 +80,96 @@ jobs:
|
||||
${{ steps.gate.outputs.base_ref }} \
|
||||
+refs/pull/${{ steps.gate.outputs.pr_number }}/head
|
||||
|
||||
- name: Run Codex
|
||||
- name: Set up Python
|
||||
if: ${{ steps.gate.outputs.should_run == 'true' }}
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: "3.11"
|
||||
|
||||
- name: Install chack-agent
|
||||
if: ${{ steps.gate.outputs.should_run == 'true' }}
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
python -m pip install -e chack-agent
|
||||
|
||||
- name: Run Chack Agent
|
||||
id: run_codex
|
||||
if: ${{ steps.gate.outputs.should_run == 'true' }}
|
||||
uses: openai/codex-action@v1
|
||||
with:
|
||||
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
|
||||
output-schema-file: .github/codex/pr-merge-schema.json
|
||||
model: gpt-5.2-codex
|
||||
prompt: |
|
||||
You are reviewing PR #${{ steps.gate.outputs.pr_number }} for ${{ github.repository }}.
|
||||
env:
|
||||
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
||||
INPUT_PROVIDER: openai
|
||||
INPUT_MODEL_PRIMARY: gpt-5.2-codex
|
||||
INPUT_SYSTEM_PROMPT: You are an advanced research agent.
|
||||
run: |
|
||||
cat <<'EOF' > chack_prompt.txt
|
||||
You are reviewing PR #${{ steps.gate.outputs.pr_number }} for ${{ github.repository }}.
|
||||
|
||||
Decide whether to merge or comment. Merge only if all of the following are true:
|
||||
- Changes are simple and safe (no DoS, no long operations, no backdoors).
|
||||
- Changes follow common PEASS syntax and style without breaking anything and add useful checks or value.
|
||||
- Changes simplify code or add new useful checks without breaking anything.
|
||||
Decide whether to merge or comment. Merge only if all of the following are true:
|
||||
- Changes are simple and safe (no DoS, no long operations, no backdoors).
|
||||
- Changes follow common PEASS syntax and style without breaking anything and add useful checks or value.
|
||||
- Changes simplify code or add new useful checks without breaking anything.
|
||||
|
||||
If you don't have any doubts, and all the previous conditions are met, decide to merge.
|
||||
If you have serious doubts, choose "comment" and include your doubts or questions.
|
||||
If you decide to merge, include a short rationale.
|
||||
If you don't have any doubts, and all the previous conditions are met, decide to merge.
|
||||
If you have serious doubts, choose "comment" and include your doubts or questions.
|
||||
If you decide to merge, include a short rationale.
|
||||
|
||||
Pull request title and body:
|
||||
----
|
||||
${{ steps.gate.outputs.pr_title }}
|
||||
${{ steps.gate.outputs.pr_body }}
|
||||
Pull request title and body:
|
||||
----
|
||||
${{ steps.gate.outputs.pr_title }}
|
||||
${{ steps.gate.outputs.pr_body }}
|
||||
|
||||
Review ONLY the changes introduced by the PR:
|
||||
git log --oneline ${{ steps.gate.outputs.base_sha }}...${{ steps.gate.outputs.head_sha }}
|
||||
Review ONLY the changes introduced by the PR:
|
||||
git log --oneline ${{ steps.gate.outputs.base_sha }}...${{ steps.gate.outputs.head_sha }}
|
||||
|
||||
Output JSON only, following the provided schema.
|
||||
Output JSON only, following the provided schema:
|
||||
.github/codex/pr-merge-schema.json
|
||||
EOF
|
||||
|
||||
python - <<'PY' > chack_output.txt
|
||||
import os
|
||||
from chack_agent import (
|
||||
Chack,
|
||||
ChackConfig,
|
||||
ModelConfig,
|
||||
AgentConfig,
|
||||
SessionConfig,
|
||||
ToolsConfig,
|
||||
CredentialsConfig,
|
||||
LoggingConfig,
|
||||
)
|
||||
|
||||
with open("chack_prompt.txt", "r", encoding="utf-8") as handle:
|
||||
user_prompt = handle.read()
|
||||
|
||||
config = ChackConfig(
|
||||
model=ModelConfig(
|
||||
primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"),
|
||||
provider=os.environ.get("INPUT_PROVIDER", "openai"),
|
||||
),
|
||||
agent=AgentConfig(
|
||||
main_action="github_action",
|
||||
sub_action="run",
|
||||
),
|
||||
session=SessionConfig(),
|
||||
tools=ToolsConfig(exec_enabled=True),
|
||||
credentials=CredentialsConfig(
|
||||
openai_api_key=os.environ.get("OPENAI_API_KEY", ""),
|
||||
),
|
||||
logging=LoggingConfig(level="INFO"),
|
||||
system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."),
|
||||
env={},
|
||||
)
|
||||
|
||||
agent = Chack(config)
|
||||
result = agent.run(session_id="github-action", text=user_prompt)
|
||||
print(result.output)
|
||||
PY
|
||||
|
||||
{
|
||||
echo "final-message<<EOF"
|
||||
cat chack_output.txt
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Parse Codex decision
|
||||
id: parse
|
||||
|
||||
@@ -152,14 +152,69 @@ jobs:
|
||||
echo "Leave the repo in a state ready to commit as when you finish, it'll be automatically committed and pushed."
|
||||
} > codex_prompt.txt
|
||||
|
||||
- name: Run Codex
|
||||
id: run_codex
|
||||
uses: openai/codex-action@v1
|
||||
- name: Set up Python
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
openai-api-key: ${{ secrets.OPENAI_API_KEY }}
|
||||
prompt-file: codex_prompt.txt
|
||||
sandbox: workspace-write
|
||||
model: gpt-5.2-codex
|
||||
python-version: "3.11"
|
||||
|
||||
- name: Install chack-agent
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
python -m pip install -e chack-agent
|
||||
|
||||
- name: Run Chack Agent
|
||||
id: run_codex
|
||||
env:
|
||||
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
|
||||
INPUT_PROVIDER: openai
|
||||
INPUT_MODEL_PRIMARY: gpt-5.2-codex
|
||||
INPUT_SYSTEM_PROMPT: You are an advanced research agent.
|
||||
run: |
|
||||
python - <<'PY' > chack_output.txt
|
||||
import os
|
||||
from chack_agent import (
|
||||
Chack,
|
||||
ChackConfig,
|
||||
ModelConfig,
|
||||
AgentConfig,
|
||||
SessionConfig,
|
||||
ToolsConfig,
|
||||
CredentialsConfig,
|
||||
LoggingConfig,
|
||||
)
|
||||
|
||||
with open("codex_prompt.txt", "r", encoding="utf-8") as handle:
|
||||
user_prompt = handle.read()
|
||||
|
||||
config = ChackConfig(
|
||||
model=ModelConfig(
|
||||
primary=os.environ.get("INPUT_MODEL_PRIMARY", "gpt-5.2-codex"),
|
||||
provider=os.environ.get("INPUT_PROVIDER", "openai"),
|
||||
),
|
||||
agent=AgentConfig(
|
||||
main_action="github_action",
|
||||
sub_action="run",
|
||||
),
|
||||
session=SessionConfig(),
|
||||
tools=ToolsConfig(exec_enabled=True),
|
||||
credentials=CredentialsConfig(
|
||||
openai_api_key=os.environ.get("OPENAI_API_KEY", ""),
|
||||
),
|
||||
logging=LoggingConfig(level="INFO"),
|
||||
system_prompt=os.environ.get("INPUT_SYSTEM_PROMPT", "You are an advanced research agent."),
|
||||
env={},
|
||||
)
|
||||
|
||||
agent = Chack(config)
|
||||
result = agent.run(session_id="github-action", text=user_prompt)
|
||||
print(result.output)
|
||||
PY
|
||||
|
||||
{
|
||||
echo "final-message<<EOF"
|
||||
cat chack_output.txt
|
||||
echo "EOF"
|
||||
} >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Commit and push if changed
|
||||
env:
|
||||
@@ -170,9 +225,9 @@ jobs:
|
||||
echo "No changes to commit."
|
||||
exit 0
|
||||
fi
|
||||
rm -f codex_failure_summary.txt codex_prompt.txt
|
||||
rm -f codex_failure_summary.txt codex_prompt.txt chack_output.txt
|
||||
git add -A
|
||||
git reset -- codex_failure_summary.txt codex_prompt.txt
|
||||
git reset -- codex_failure_summary.txt codex_prompt.txt chack_output.txt
|
||||
git commit -m "Fix CI failures for PR #${PR_NUMBER}"
|
||||
git push origin HEAD:${TARGET_BRANCH}
|
||||
|
||||
|
||||
@@ -1,39 +0,0 @@
|
||||
# Title: System Information - Linux Exploit Suggester
|
||||
# ID: SY_Linux_exploit_suggester
|
||||
# Author: Carlos Polop
|
||||
# Last Update: 07-03-2024
|
||||
# Description: Execute Linux Exploit Suggester to identify potential kernel exploits:
|
||||
# - Automated kernel vulnerability detection
|
||||
# - Common vulnerable scenarios:
|
||||
# * Known kernel vulnerabilities
|
||||
# * Unpatched kernel versions
|
||||
# * Missing security patches
|
||||
# - Exploitation methods:
|
||||
# * Kernel exploit execution: Use suggested exploits
|
||||
# * Common attack vectors:
|
||||
# - Kernel memory corruption
|
||||
# - Race conditions
|
||||
# - Use-after-free
|
||||
# - Integer overflow
|
||||
# * Exploit techniques:
|
||||
# - Kernel memory manipulation
|
||||
# - Privilege escalation
|
||||
# - Root access acquisition
|
||||
# - System compromise
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Functions Used: print_2title, print_info
|
||||
# Global Variables: $MACPEAS
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $les_b64
|
||||
# Fat linpeas: 0
|
||||
# Small linpeas: 1
|
||||
|
||||
|
||||
if [ "$(command -v bash 2>/dev/null || echo -n '')" ] && ! [ "$MACPEAS" ]; then
|
||||
print_2title "Executing Linux Exploit Suggester"
|
||||
print_info "https://github.com/mzet-/linux-exploit-suggester"
|
||||
les_b64="peass{https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh}"
|
||||
echo $les_b64 | base64 -d | bash | sed "s,$(printf '\033')\\[[0-9;]*[a-zA-Z],,g" | grep -i "\[CVE" -A 10 | grep -Ev "^\-\-$" | sed -${E} "s/\[(CVE-[0-9]+-[0-9]+,?)+\].*/${SED_RED}/g"
|
||||
echo ""
|
||||
fi
|
||||
@@ -1,41 +0,0 @@
|
||||
# Title: System Information - Linux Exploit Suggester 2
|
||||
# ID: SY_Linux_exploit_suggester_2
|
||||
# Author: Carlos Polop
|
||||
# Last Update: 07-03-2024
|
||||
# Description: Execute Linux Exploit Suggester 2 (Perl version) to identify potential kernel exploits:
|
||||
# - Alternative kernel vulnerability detection
|
||||
# - Perl-based exploit suggestions
|
||||
# - Common vulnerable scenarios:
|
||||
# * Known kernel vulnerabilities
|
||||
# * Unpatched kernel versions
|
||||
# * Missing security patches
|
||||
# * Alternative exploit paths
|
||||
# - Exploitation methods:
|
||||
# * Kernel exploit execution: Use suggested exploits
|
||||
# * Common attack vectors:
|
||||
# - Kernel memory corruption
|
||||
# - Race conditions
|
||||
# - Use-after-free
|
||||
# - Integer overflow
|
||||
# * Exploit techniques:
|
||||
# - Kernel memory manipulation
|
||||
# - Privilege escalation
|
||||
# - Root access acquisition
|
||||
# - System compromise
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Functions Used: print_2title, print_info
|
||||
# Global Variables:
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $les2_b64
|
||||
# Fat linpeas: 1
|
||||
# Small linpeas: 0
|
||||
|
||||
|
||||
if [ "$(command -v perl 2>/dev/null || echo -n '')" ] && ! [ "$MACPEAS" ]; then
|
||||
print_2title "Executing Linux Exploit Suggester 2"
|
||||
print_info "https://github.com/jondonas/linux-exploit-suggester-2"
|
||||
les2_b64="peass{https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl}"
|
||||
echo $les2_b64 | base64 -d | perl 2>/dev/null | sed "s,$(printf '\033')\\[[0-9;]*[a-zA-Z],,g" | grep -iE "CVE" -B 1 -A 10 | grep -Ev "^\-\-$" | sed -${E} "s,CVE-[0-9]+-[0-9]+,${SED_RED},g"
|
||||
echo ""
|
||||
fi
|
||||
@@ -1,20 +0,0 @@
|
||||
# Title: Container - Am I Containered
|
||||
# ID: CT_Am_I_contained
|
||||
# Author: Carlos Polop
|
||||
# Last Update: 22-08-2023
|
||||
# Description: Am I Containered tool
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Functions Used: print_2title, execBin
|
||||
# Global Variables:
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $FAT_LINPEAS_AMICONTAINED
|
||||
# Fat linpeas: 1
|
||||
# Small linpeas: 0
|
||||
|
||||
|
||||
if [ "$$FAT_LINPEAS_AMICONTAINED" ]; then
|
||||
print_2title "Am I Containered?"
|
||||
FAT_LINPEAS_AMICONTAINED="peass{https://github.com/genuinetools/amicontained/releases/latest/download/amicontained-linux-amd64}"
|
||||
execBin "AmIContainered" "https://github.com/genuinetools/amicontained" "$FAT_LINPEAS_AMICONTAINED"
|
||||
fi
|
||||
@@ -1,30 +0,0 @@
|
||||
# Title: Software Information - Checking leaks in git repositories
|
||||
# ID: SI_Leaks_git_repo
|
||||
# Author: Carlos Polop
|
||||
# Last Update: 22-08-2023
|
||||
# Description: Checking leaks in git repositories
|
||||
# License: GNU GPL
|
||||
# Version: 1.0
|
||||
# Functions Used: execBin, print_2title
|
||||
# Global Variables: $MACPEAS, $TIMEOUT
|
||||
# Initial Functions:
|
||||
# Generated Global Variables: $git_dirname, $FAT_LINPEAS_GITLEAKS
|
||||
# Fat linpeas: 1
|
||||
# Small linpeas: 0
|
||||
|
||||
|
||||
if ! [ "$FAST" ] && ! [ "$SUPERFAST" ] && [ "$TIMEOUT" ]; then
|
||||
print_2title "Checking leaks in git repositories"
|
||||
printf "%s\n" "$PSTORAGE_GITHUB" | while read f; do
|
||||
if echo "$f" | grep -Eq ".git$"; then
|
||||
git_dirname=$(dirname "$f")
|
||||
if [ "$MACPEAS" ]; then
|
||||
FAT_LINPEAS_GITLEAKS="peass{https://github.com/gitleaks/gitleaks/releases/download/v8.17.0/gitleaks_8.17.0_darwin_arm64.tar.gz}"
|
||||
else
|
||||
FAT_LINPEAS_GITLEAKS="peass{https://github.com/gitleaks/gitleaks/releases/download/v8.17.0/gitleaks_8.17.0_linux_x64.tar.gz}"
|
||||
fi
|
||||
execBin "GitLeaks (checking $git_dirname)" "https://github.com/zricethezav/gitleaks" "$FAT_LINPEAS_GITLEAKS" "detect -s '$git_dirname' -v | grep -E 'Description|Match|Secret|Message|Date'"
|
||||
fi
|
||||
done
|
||||
echo ""
|
||||
fi
|
||||
Reference in New Issue
Block a user