Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/run-yara-forge.yml
Original file line number Diff line number Diff line change
Expand Up @@ -47,3 +47,27 @@ jobs:
- name: Run YARA-Forge
run: |
python yara-forge.py

- name: Upload build statistics
if: always()
uses: actions/upload-artifact@v4
with:
name: build-statistics
path: build_stats.md
retention-days: 30

- name: Upload build log
if: always()
uses: actions/upload-artifact@v4
with:
name: build-log
path: yara-forge.log
retention-days: 30

- name: Upload rule issues
if: always()
uses: actions/upload-artifact@v4
with:
name: rule-issues
path: yara-forge-rule-issues.yml
retention-days: 30
24 changes: 24 additions & 0 deletions .github/workflows/weekly-release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,30 @@ jobs:
run: |
python yara-forge.py

- name: Upload build statistics
if: always()
uses: actions/upload-artifact@v4
with:
name: build-statistics
path: build_stats.md
retention-days: 90

- name: Upload build log
if: always()
uses: actions/upload-artifact@v4
with:
name: build-log
path: yara-forge.log
retention-days: 90

- name: Upload rule issues
if: always()
uses: actions/upload-artifact@v4
with:
name: rule-issues
path: yara-forge-rule-issues.yml
retention-days: 90

- name: Get current date
run: echo "CURRENT_DATE=$(date +'%Y%m%d')" >> $GITHUB_ENV
shell: bash
Expand Down
19 changes: 15 additions & 4 deletions main/rule_collector.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@
import shutil
import datetime
import logging
from urllib.parse import unquote
#from pprint import pprint
import plyara
from git import Repo
Expand Down Expand Up @@ -89,12 +90,20 @@ def retrieve_yara_rule_sets(repo_staging_dir, yara_repos):
# If a sub-path is configured, restrict checkout to that path to skip large folders
if 'path' in repo:
repo_obj.git.sparse_checkout('init', '--cone')
repo_obj.git.sparse_checkout('set', repo['path'])
# URL-decode the path before using it with git sparse-checkout
decoded_path = unquote(repo['path'])
repo_obj.git.sparse_checkout('set', decoded_path)
repo['commit_hash'] = repo_obj.head.commit.hexsha
else:
# Get the latest commit hash
# Repository already cloned - reuse it
repo_folder = os.path.join(repo_staging_dir, repo['owner'], repo['repo'])
repo['commit_hash'] = Repo(repo_folder).head.commit.hexsha
repo_obj = Repo(repo_folder)
repo['commit_hash'] = repo_obj.head.commit.hexsha
# If this repo config has a path, add it to sparse checkout
# (needed when multiple configs share the same git URL)
if 'path' in repo:
decoded_path = unquote(repo['path'])
repo_obj.git.sparse_checkout('add', decoded_path)

# Walk through the extracted folders and find a LICENSE file
# and save it into the repository object
Expand All @@ -121,7 +130,9 @@ def retrieve_yara_rule_sets(repo_staging_dir, yara_repos):
# Walk a sub folder if one is set in the config
walk_folder = repo_folder
if 'path' in repo:
walk_folder = os.path.join(repo_folder, repo['path'])
# URL-decode the path before using it
decoded_path = unquote(repo['path'])
walk_folder = os.path.join(repo_folder, decoded_path)
# Print the processed folder
logging.debug("Processing folder: %s", walk_folder)

Expand Down
2 changes: 1 addition & 1 deletion yara-forge-config.yml
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ yara_repositories:
author: "BlackBerry Threat Research Team"
quality: 85
branch: "master"
path: "BlackBerry"
path: "Blackberry"
- name: "Cluster25"
url: "https://github.com/mikesxrs/Open-Source-YARA-rules"
author: "Cluster25"
Expand Down