Bumblebee：零依赖的只读扫描器，让软件供应链投毒无处藏身

# 克隆仓库并构建（零第三方依赖，go build 直接出二进制）
git clone https://github.com/perplexity-ai/bumblebee.git
cd bumblebee
go build -o bumblebee .

# 在开发者终端上运行只读扫描
./bumblebee scan

# 输出清单到文件，供后续比对
./bumblebee scan --output manifest-$(date +%Y%m%d).json

# 周一扫描，生成基准清单
./bumblebee scan --output baseline.json

# 周五扫描，生成当前清单
./bumblebee scan --output current.json

# 用 jq 快速比对差异（假设输出为 JSON 格式）
diff <(jq -S '.packages | sort_by(.name)' baseline.json) \
     <(jq -S '.packages | sort_by(.name)' current.json)

name: Supply Chain Manifest Check

on:
  pull_request:
    branches: [main]

jobs:
  manifest-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.22'

      - name: Build Bumblebee
        run: |
          git clone https://github.com/perplexity-ai/bumblebee.git /tmp/bumblebee
          cd /tmp/bumblebee
          go build -o bumblebee .

      - name: Scan and compare
        run: |
          # 下载仓库中保存的基准清单
          BASELINE=manifests/baseline.json
          if [ ! -f "$BASELINE" ]; then
            echo "No baseline found, creating initial manifest"
            /tmp/bumblebee/bumblebee scan --output "$BASELINE"
            exit 0
          fi

          # 当前扫描
          /tmp/bumblebee/bumblebee scan --output current.json

          # 比对
          CHANGES=$(diff <(jq -S '.packages | sort_by(.name)' "$BASELINE") \
                        <(jq -S '.packages | sort_by(.name)' current.json) || true)

          if [ -n "$CHANGES" ]; then
            echo "::warning::Manifest changes detected"
            echo "$CHANGES"
            # 可选：严格模式下 exit 1 阻断 PR
          fi

package main

import (
    "encoding/json"
    "fmt"
    "os"
    "os/exec"
    "runtime"
    "strings"
    "time"
)

// PackageRecord 记录单个包的信息
type PackageRecord struct {
    Name    string `json:"name"`
    Version string `json:"version"`
    Source  string `json:"source"`
    Path    string `json:"path,omitempty"`
}

// Manifest 清单结构
type Manifest struct {
    Timestamp string          `json:"timestamp"`
    Platform  string          `json:"platform"`
    Packages  []PackageRecord `json:"packages"`
}

// 只读收集 Homebrew 包信息（macOS）
func collectBrewPackages() []PackageRecord {
    cmd := exec.Command("brew", "list", "--versions")
    output, err := cmd.Output()
    if err != nil {
        // brew 不存在则跳过，不报错——只读原则
        return nil
    }
    var records []PackageRecord
    for _, line := range strings.Split(string(output), "\n") {
        if line == "" {
            continue
        }
        parts := strings.Fields(line)
        name := parts[0]
        version := ""
        if len(parts) > 1 {
            version = parts[1]
        }
        records = append(records, PackageRecord{
            Name:    name,
            Version: version,
            Source:  "homebrew",
        })
    }
    return records
}

// 只读收集 pip 包信息
func collectPipPackages() []PackageRecord {
    cmd := exec.Command("pip3", "list", "--format=json")
    output, err := cmd.Output()
    if err != nil {
        return nil
    }
    var raw []struct {
        Name    string `json:"name"`
        Version string `json:"version"`
    }
    if json.Unmarshal(output, &raw) != nil {
        return nil
    }
    var records []PackageRecord
    for _, p := range raw {
        records = append(records, PackageRecord{
            Name:    p.Name,
            Version: p.Version,
            Source:  "pip",
        })
    }
    return records
}

func main() {
    manifest := Manifest{
        Timestamp: time.Now().UTC().Format(time.RFC3339),
        Platform:  runtime.GOOS + "/" + runtime.GOARCH,
    }

    // 按平台收集，只调用只读命令
    manifest.Packages = append(manifest.Packages, collectBrewPackages()...)
    manifest.Packages = append(manifest.Packages, collectPipPackages()...)

    data, _ := json.MarshalIndent(manifest, "", "  ")
    fmt.Println(string(data))

    // 可选：写入文件
    if len(os.Args) > 2 && os.Args[1] == "--output" {
        os.WriteFile(os.Args[2], data, 0644)
    }
}