|
| 1 | +--- |
| 2 | +layout: post |
| 3 | +comments: false |
| 4 | +title: "Speeding Up Your GitHub Builds with the Official Conan Action" |
| 5 | +meta_title: "A GitHub Action for Conan - Conan Blog" |
| 6 | +description: "Integrate Conan into your GitHub Actions workflow with the new Conan Action." |
| 7 | +keywords: "C++, C, GitHub, CI, CD, Workflow" |
| 8 | +--- |
| 9 | + |
| 10 | +In modern software development, fast and reliable CI/CD pipelines are essential. However, configuring and maintaining CI scripts (especially for dependency management) can slow down your workflow and increase maintenance costs. |
| 11 | + |
| 12 | +[GitHub Actions](https://github.com/features/actions) automates tasks like installing dependencies, running tests, and deploying applications. But setting up tool dependencies can be time-consuming. Fortunately, GitHub Actions supports reusable extensions from the [GitHub Marketplace](https://github.com/marketplace?type=actions), making it easier to manage tools like Conan. |
| 13 | + |
| 14 | +This article shows how to use the official [Conan GitHub Action](https://github.com/marketplace/actions/setup-conan-client) to speed up your builds and streamline your CI/CD pipeline. |
| 15 | + |
| 16 | +## Why Use the Conan GitHub Action? |
| 17 | + |
| 18 | +The official Conan GitHub Action, maintained by the Conan team, takes care of setting up the Conan client for you. It’s available on the GitHub Marketplace and is designed for easy integration and efficient dependency management. Using the official action ensures you benefit from ongoing maintenance, security, and community support. |
| 19 | + |
| 20 | +### Features of the Conan GitHub Action |
| 21 | + |
| 22 | +The Conan GitHub Action offers some features to customize your workflow execution, including: |
| 23 | + |
| 24 | +- **Caching Conan packages:** The action can cache Conan packages to speed up the installation process. This is particularly useful when building multiple times, as it reduces the time spent downloading and installing dependencies. The cache is restored automatically when the action is run, so you don't have to worry about managing it yourself. By default, the action will not cache the Conan packages. |
| 25 | + |
| 26 | +- **Custom Conan home folder:** The action allows you to specify a custom Conan home folder, which can be used to store the Conan cache and other configuration files. This is useful when you want to share the cache between different jobs or workflows, or when you want to use a specific location for the Conan home folder. By default, the action will use the default Conan home folder, which is located in the workstation home directory. |
| 27 | + |
| 28 | +- **Conan version:** Define what Conan version you want to use in your workflow. This is useful when you want to use a specific version of Conan or when you want to test a new version before upgrading your workflow. Only Conan 2.x is supported by this action, so if you are using Conan 1.x, you will need to upgrade your workflow to use Conan 2.x. By default, the action will use the latest stable version of Conan available in the `pypi.org` repository. |
| 29 | + |
| 30 | +- **Conan Audit token:** The action allows you to specify a Conan Audit token, which can be used to authenticate with the Conan server. This is useful when you want to authenticate with an Audit server and scan your packages for vulnerabilities. Remember to always use GitHub secrets to store your tokens and avoid exposing them in your workflow. |
| 31 | +By default, the action will not use a Conan Audit token. |
| 32 | + |
| 33 | +- **Configuration installation:** The action allows you to specify a list of URLs to be consumed by the command [conan config install/install-pkg](https://docs.conan.io/2/reference/commands/config.html). This is useful when you want to install profiles, settings, or other configuration files from a remote server. The action will download the files and install them in the specified Conan home folder, so you don't have to worry about managing them yourself. By default, the action will not install any configuration files. |
| 34 | + |
| 35 | +- **Python version:** The action allows you to specify the Python version to use in your workflow. This is useful when you want share the same Python version between Conan and your workflow. By default, the action will use the Python version 3.10. |
| 36 | + |
| 37 | +## How to Use the Conan Action in a Workflow |
| 38 | + |
| 39 | +Let’s look at a practical example: a nightly workflow that builds your project and scans for vulnerabilities using Conan. |
| 40 | +Besides the GitHub workflow yaml file, a `conanfile.py` is expected to be present in the same repository. |
| 41 | + |
| 42 | +First, add the Conan Action to your workflow yaml file: |
| 43 | + |
| 44 | +```yaml |
| 45 | +- name: Setup Conan Client |
| 46 | + uses: conan-io/setup-conan@v1 |
| 47 | +``` |
| 48 | +
|
| 49 | +The full workflow file will look like this: |
| 50 | +
|
| 51 | +```yaml |
| 52 | +# .github/workflows/nightly-conan-audit-scan.yml |
| 53 | +name: Nightly Conan Audit Scan |
| 54 | +on: |
| 55 | + schedule: |
| 56 | + - cron: '0 1 * * *' |
| 57 | + workflow_dispatch: |
| 58 | + |
| 59 | +jobs: |
| 60 | + conan: |
| 61 | + runs-on: ubuntu-latest |
| 62 | + steps: |
| 63 | + - name: Checkout code |
| 64 | + uses: actions/checkout@v4 |
| 65 | + |
| 66 | + - name: Setup Conan Client |
| 67 | + uses: conan-io/setup-conan@v1 |
| 68 | + with: |
| 69 | + conan_audit_token: ${{ secrets.CONAN_AUDIT_TOKEN }} |
| 70 | + |
| 71 | + - name: Scan Conan packages |
| 72 | + run: | |
| 73 | + conan audit scan . --format=json > output/conan-audit-report.json |
| 74 | +
|
| 75 | + - name: Archive Conan Audit report |
| 76 | + uses: actions/upload-artifact@v4 |
| 77 | + with: |
| 78 | + name: conan-audit-report |
| 79 | + path: output/conan-audit-report.json |
| 80 | + |
| 81 | + - name: Check High severity vulnerabilities |
| 82 | + run: | |
| 83 | + if [ -n $(jq -r '.. | select(.severity? == "High") | .severity' output/conan-audit-report.json) ] |
| 84 | + then |
| 85 | + echo "ERROR: High severity vulnerabilities found. Please check the report file for details." |
| 86 | + exit 1 |
| 87 | + fi |
| 88 | +``` |
| 89 | +
|
| 90 | +This workflow will run every night at 01:00 a.m. UTC and will install the latest version of Conan. |
| 91 | +It will also scan the requirements and all the transitive dependencies listed in the `conanfile.py` for expected vulnerabilities and upload the report as an artifact. |
| 92 | +Finally, the file `output/conan-audit-report.json` will be checked for any **high** severity vulnerabilities using the `jq` command. If any are found, the workflow will fail with an error message. |
| 93 | + |
| 94 | +For reference, the Conan package `openssl/3.4.1` should contain the [CVE-2019-0190](https://www.cve.org/CVERecord?id=CVE-2019-0190). In that case, the produced output by `conan audit scan` should contain the following JSON: |
| 95 | + |
| 96 | +```javascript |
| 97 | +{ |
| 98 | + "name": "CVE-2019-0190", |
| 99 | + "description": "A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.", |
| 100 | + "severity": "High", |
| 101 | + "cvss": { |
| 102 | + "preferredBaseScore": 7.5 |
| 103 | + }, |
| 104 | + "aliases": [ |
| 105 | + "CVE-2019-0190", |
| 106 | + "JFSA-2023-000317713" |
| 107 | + ], |
| 108 | + "advisories": [ |
| 109 | + { |
| 110 | + "name": "CVE-2019-0190" |
| 111 | + } |
| 112 | + ], |
| 113 | + "references": [ |
| 114 | + "https://httpd.apache.org/security/vulnerabilities_24.html" |
| 115 | + ] |
| 116 | +} |
| 117 | +``` |
| 118 | + |
| 119 | +Here, the `severity` field is set to **High**. The workflow will fail and print the error message. |
| 120 | + |
| 121 | +## Conclusion |
| 122 | + |
| 123 | +The Conan GitHub Action streamlines dependency management and security scanning in your CI/CD workflows. It helps you automate Conan installation and configuration, making your builds faster and more reliable. |
| 124 | +For further documentation reading, please check the [Conan GitHub Action documentation](https://docs.conan.io/2/integrations/github.html). In case of any questions, bugs and feature requests, please file a [issue](https://github.com/conan-io/setup-conan/issues) to its official repository. |
0 commit comments