Skip to content

Commit 36f35fc

Browse files
azeemshaikh38azeemshaikh38
committed
Squashed commit of the following:
commit 00da7a8be965c09d044f978d6b9eafee1350bd30 Author: Azeem Shaikh <[email protected]> Date: Tue Mar 14 23:07:19 2023 +0000 Pr comments commit 1127dd9 Merge: 274448f 23bd295 Author: Azeem Shaikh <[email protected]> Date: Wed Mar 15 04:23:32 2023 +0530 Merge branch 'main' into go-git commit 274448f Author: Azeem Shaikh <[email protected]> Date: Tue Mar 14 22:52:30 2023 +0000 Initial implementation of go-git client Signed-off-by: Azeem Shaikh <[email protected]> commit 23bd295 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 20:28:41 2023 +0000 :seedling: Bump github/codeql-action from 2.2.4 to 2.2.6 (ossf#2741) commit fc026ef Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 17:04:31 2023 +0000 :seedling: Bump github.com/google/ko from 0.12.0 to 0.13.0 in /tools (ossf#2742) commit 2e04214 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 14:02:34 2023 +0000 :seedling: Bump tj-actions/changed-files from 35.6.2 to 35.7.0 Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 35.6.2 to 35.7.0. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@5ce975c...bd376fb) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> commit e36b590 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 08:59:20 2023 -0500 :seedling: Bump actions/cache from 3.3.0 to 3.3.1 (ossf#2740) Bumps [actions/cache](https://github.com/actions/cache) from 3.3.0 to 3.3.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@940f3d7...88522ab) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit 6ff94eb Author: Gabriela Gutierrez <[email protected]> Date: Mon Mar 13 19:42:37 2023 +0000 :bug: Handle editable pip installs (ossf#2731) * fix: Handle editable pip install Editable pip installs (-e) should be considered secure if the package is installed from a local source or a remote source (VCS install) but pinned by commit hash. To keep the behaviour we have for normal pip installs, we need to guarantee the package dependencies are pinned by hash too. For normal pip installs, we verify that by using --require-hashes flag. Unfortunately, --require-hashes flag is not compatible with editable installs, so we use --no-deps flag to verify the dependencies are not installed since we can't verify if they are pinned. Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Editable pip install in GHA Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Editable pip install in Dockerfile Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Editable pip install in shell script Signed-off-by: Gabriela Gutierrez <[email protected]> * fix: Code complexity increase Signed-off-by: Gabriela Gutierrez <[email protected]> * fix: Simplify boolean return Signed-off-by: Gabriela Gutierrez <[email protected]> * docs: Add pip editable install references in comments Signed-off-by: Gabriela Gutierrez <[email protected]> * fix: Handle multiple packages in editable pip install Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Multi editable pip install in GHA Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Multi editable pip install in Dockerfile Signed-off-by: Gabriela Gutierrez <[email protected]> * test: Multi editable pip install in shell script Signed-off-by: Gabriela Gutierrez <[email protected]> --------- Signed-off-by: Gabriela Gutierrez <[email protected]> Co-authored-by: laurentsimon <[email protected]> commit 110e352 Author: raghavkaul <[email protected]> Date: Mon Mar 13 11:13:50 2023 -0400 ✨ Gitlab support: RepoClient (ossf#2655) * Add make targets and E2E test target for GitLab only Signed-off-by: Raghav Kaul <[email protected]> * Add GitLab support to RepoClient Signed-off-by: Raghav Kaul <[email protected]> * Build * Make target for e2e-gitlab-token * Only run Gitlab tests in CI that don't require a token Signed-off-by: Raghav Kaul <[email protected]> * Add tests Signed-off-by: Raghav Kaul <[email protected]> * Remove spurious printf Signed-off-by: Raghav Kaul <[email protected]> * 🐛 Check OSS Fuzz build file for Fuzzing check (ossf#2719) * Check OSS-Fuzz using project list Signed-off-by: Spencer Schrock <[email protected]> * Use clients.RepoClient interface to perform the new OSS Fuzz check Signed-off-by: Spencer Schrock <[email protected]> * wip: add eager client for better repeated lookup of projects Signed-off-by: Spencer Schrock <[email protected]> * Split lazy and eager behavior into different implementations. Signed-off-by: Spencer Schrock <[email protected]> * Add tests and benchmarks Signed-off-by: Spencer Schrock <[email protected]> * Switch to always parsing JSON to determine if a project is present. The other approach of looking for a substring match would lead to false positives. Signed-off-by: Spencer Schrock <[email protected]> * Add eager constructor to surface status file errors sooner. Signed-off-by: Spencer Schrock <[email protected]> * Switch existing users to new OSS Fuzz client Signed-off-by: Spencer Schrock <[email protected]> * Mark old method as deprecated in the godoc Signed-off-by: Spencer Schrock <[email protected]> * remove unused comment. Signed-off-by: Spencer Schrock <[email protected]> * Use new OSS Fuzz client in e2e test. Signed-off-by: Spencer Schrock <[email protected]> * fix typo. Signed-off-by: Spencer Schrock <[email protected]> * Fix potential path bug with test server. Signed-off-by: Spencer Schrock <[email protected]> * Force include the two JSON files which were being ignored by .gitignore Signed-off-by: Spencer Schrock <[email protected]> * trim the status json file Signed-off-by: Spencer Schrock <[email protected]> --------- Signed-off-by: Spencer Schrock <[email protected]> --------- Signed-off-by: Raghav Kaul <[email protected]> Signed-off-by: Spencer Schrock <[email protected]> Co-authored-by: Spencer Schrock <[email protected]> commit 5625dda Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat Mar 11 17:14:42 2023 +0000 :seedling: Bump github.com/onsi/ginkgo/v2 from 2.8.3 to 2.9.0 in /tools Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.8.3 to 2.9.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.8.3...v2.9.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> commit d591e38 Author: Spencer Schrock <[email protected]> Date: Fri Mar 10 16:02:05 2023 -0800 🌱 Add RepoClient re-use E2E tests. (ossf#2625) * Add e2e test for re-used repoclient. Signed-off-by: Spencer Schrock <[email protected]> * Improve diff logging Signed-off-by: Spencer Schrock <[email protected]> * Skip scorecard e2e test during unit tests. Signed-off-by: Spencer Schrock <[email protected]> * Fix linter. Signed-off-by: Spencer Schrock <[email protected]> --------- Signed-off-by: Spencer Schrock <[email protected]> commit a7e81bb Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri Mar 10 08:20:28 2023 -0600 :seedling: Bump actions/cache from 3.2.6 to 3.3.0 (ossf#2738) Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@69d9d44...940f3d7) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
1 parent b5254fe commit 36f35fc

47 files changed

Lines changed: 1490 additions & 1437 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ jobs:
6262
# Initializes the CodeQL tools for scanning.
6363
- name: Initialize CodeQL
6464

65-
uses: github/codeql-action/init@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v1
65+
uses: github/codeql-action/init@16964e90ba004cdf0cd845b866b5df21038b7723 # v1
6666
with:
6767
languages: ${{ matrix.language }}
6868
queries: +security-extended
@@ -74,7 +74,7 @@ jobs:
7474
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
7575
# If this step fails, then you should remove it and run the build manually (see below)
7676
- name: Autobuild
77-
uses: github/codeql-action/autobuild@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v1
77+
uses: github/codeql-action/autobuild@16964e90ba004cdf0cd845b866b5df21038b7723 # v1
7878

7979
# ℹ️ Command-line programs to run using the OS shell.
8080
# 📚 https://git.io/JvXDl
@@ -88,4 +88,4 @@ jobs:
8888
# make release
8989

9090
- name: Perform CodeQL Analysis
91-
uses: github/codeql-action/analyze@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v1
91+
uses: github/codeql-action/analyze@16964e90ba004cdf0cd845b866b5df21038b7723 # v1

‎.github/workflows/docker.yml‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ jobs:
4141
fetch-depth: 2
4242
- id: files
4343
name: Get changed files
44-
uses: tj-actions/changed-files@5ce975c6021a0b11062c547acb6c26c96a34a8c5 #v35.6.2
44+
uses: tj-actions/changed-files@bd376fbcfae914347656e4c70801e2a3fafed05b #v35.7.0
4545
with:
4646
files_ignore: '**.md'
4747
- id: docs_only_check
@@ -70,7 +70,7 @@ jobs:
7070
repo-token: ${{ secrets.GITHUB_TOKEN }}
7171
- name: Cache builds
7272
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
73-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
73+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
7474
with:
7575
# In order:
7676
# * Module download cache
@@ -118,7 +118,7 @@ jobs:
118118
repo-token: ${{ secrets.GITHUB_TOKEN }}
119119
- name: Cache builds
120120
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
121-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
121+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
122122
with:
123123
# In order:
124124
# * Module download cache
@@ -166,7 +166,7 @@ jobs:
166166
repo-token: ${{ secrets.GITHUB_TOKEN }}
167167
- name: Cache builds
168168
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
169-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
169+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
170170
with:
171171
# In order:
172172
# * Module download cache
@@ -214,7 +214,7 @@ jobs:
214214
repo-token: ${{ secrets.GITHUB_TOKEN }}
215215
- name: Cache builds
216216
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
217-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
217+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
218218
with:
219219
# In order:
220220
# * Module download cache
@@ -262,7 +262,7 @@ jobs:
262262
repo-token: ${{ secrets.GITHUB_TOKEN }}
263263
- name: Cache builds
264264
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
265-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
265+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
266266
with:
267267
# In order:
268268
# * Module download cache
@@ -310,7 +310,7 @@ jobs:
310310
repo-token: ${{ secrets.GITHUB_TOKEN }}
311311
- name: Cache builds
312312
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
313-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
313+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
314314
with:
315315
# In order:
316316
# * Module download cache
@@ -358,7 +358,7 @@ jobs:
358358
repo-token: ${{ secrets.GITHUB_TOKEN }}
359359
- name: Cache builds
360360
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
361-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
361+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
362362
with:
363363
# In order:
364364
# * Module download cache

‎.github/workflows/integration.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,3 +71,17 @@ jobs:
7171
with:
7272
files: ./e2e-coverage.out
7373
verbose: true
74+
75+
- name: Run GitLab E2E #using retry because the GitHub token is being throttled.
76+
uses: nick-invision/retry@943e742917ac94714d2f408a0e8320f2d1fcafcd
77+
with:
78+
max_attempts: 3
79+
retry_on: error
80+
timeout_minutes: 30
81+
command: make e2e-gitlab
82+
83+
- name: codecov
84+
uses: codecov/codecov-action@81cd2dc8148241f03f5839d295e000b8f761e378 # 2.1.0
85+
with:
86+
files: ./e2e-coverage.out
87+
verbose: true

‎.github/workflows/main.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343

4444
- name: Cache builds
4545
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
46-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 #v3.2.6
46+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 #v3.3.1
4747
with:
4848
path: |
4949
~/go/pkg/mod
@@ -88,7 +88,7 @@ jobs:
8888
repo-token: ${{ secrets.GITHUB_TOKEN }}
8989
- name: Cache builds
9090
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
91-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
91+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
9292
with:
9393
path: |
9494
~/go/pkg/mod
@@ -136,7 +136,7 @@ jobs:
136136
repo-token: ${{ secrets.GITHUB_TOKEN }}
137137
- name: Cache builds
138138
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
139-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
139+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
140140
with:
141141
path: |
142142
~/go/pkg/mod
@@ -219,7 +219,7 @@ jobs:
219219
repo-token: ${{ secrets.GITHUB_TOKEN }}
220220
- name: Cache builds
221221
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
222-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
222+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
223223
with:
224224
path: |
225225
~/go/pkg/mod
@@ -267,7 +267,7 @@ jobs:
267267
repo-token: ${{ secrets.GITHUB_TOKEN }}
268268
- name: Cache builds
269269
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
270-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
270+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
271271
with:
272272
path: |
273273
~/go/pkg/mod
@@ -315,7 +315,7 @@ jobs:
315315
repo-token: ${{ secrets.GITHUB_TOKEN }}
316316
- name: Cache builds
317317
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
318-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
318+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
319319
with:
320320
path: |
321321
~/go/pkg/mod
@@ -363,7 +363,7 @@ jobs:
363363
repo-token: ${{ secrets.GITHUB_TOKEN }}
364364
- name: Cache builds
365365
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
366-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
366+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
367367
with:
368368
path: |
369369
~/go/pkg/mod
@@ -411,7 +411,7 @@ jobs:
411411
repo-token: ${{ secrets.GITHUB_TOKEN }}
412412
- name: Cache builds
413413
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
414-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
414+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
415415
with:
416416
path: |
417417
~/go/pkg/mod
@@ -459,7 +459,7 @@ jobs:
459459
repo-token: ${{ secrets.GITHUB_TOKEN }}
460460
- name: Cache builds
461461
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
462-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
462+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
463463
with:
464464
path: |
465465
~/go/pkg/mod
@@ -507,7 +507,7 @@ jobs:
507507
repo-token: ${{ secrets.GITHUB_TOKEN }}
508508
- name: Cache builds
509509
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
510-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
510+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
511511
with:
512512
path: |
513513
~/go/pkg/mod
@@ -555,7 +555,7 @@ jobs:
555555
repo-token: ${{ secrets.GITHUB_TOKEN }}
556556
- name: Cache builds
557557
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
558-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
558+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
559559
with:
560560
path: |
561561
~/go/pkg/mod
@@ -603,7 +603,7 @@ jobs:
603603
repo-token: ${{ secrets.GITHUB_TOKEN }}
604604
- name: Cache builds
605605
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
606-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
606+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
607607
with:
608608
path: |
609609
~/go/pkg/mod
@@ -651,7 +651,7 @@ jobs:
651651
repo-token: ${{ secrets.GITHUB_TOKEN }}
652652
- name: Cache builds
653653
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
654-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
654+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
655655
with:
656656
path: |
657657
~/go/pkg/mod
@@ -699,7 +699,7 @@ jobs:
699699
repo-token: ${{ secrets.GITHUB_TOKEN }}
700700
- name: Cache builds
701701
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
702-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
702+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
703703
with:
704704
path: |
705705
~/go/pkg/mod
@@ -771,7 +771,7 @@ jobs:
771771

772772
- name: Cache builds
773773
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
774-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
774+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
775775
with:
776776
path: |
777777
~/go/pkg/mod
@@ -818,7 +818,7 @@ jobs:
818818
repo-token: ${{ secrets.GITHUB_TOKEN }}
819819
- name: Cache builds
820820
# https://github.com/mvdan/github-actions-golang#how-do-i-set-up-caching-between-builds
821-
uses: actions/cache@69d9d449aced6a2ede0bc19182fadc3a0a42d2b0 # v3.2.6
821+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
822822
with:
823823
path: |
824824
~/go/pkg/mod

‎.github/workflows/scorecard-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,6 @@ jobs:
4747
retention-days: 5
4848

4949
- name: "Upload SARIF results"
50-
uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v1
50+
uses: github/codeql-action/upload-sarif@16964e90ba004cdf0cd845b866b5df21038b7723 # v1
5151
with:
5252
sarif_file: results.sarif

‎Makefile‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,12 @@ e2e-gh-token: build-scorecard check-env | $(GINKGO)
334334
# Run e2e tests. GITHUB_AUTH_TOKEN set to secrets.GITHUB_TOKEN must be used to run this.
335335
TOKEN_TYPE="GITHUB_TOKEN" $(GINKGO) --race -p -v -cover -coverprofile=e2e-coverage.out --keep-separate-coverprofiles ./...
336336

337+
e2e-gitlab-token: ## Runs e2e tests that require a GITLAB_TOKEN
338+
TOKEN_TYPE="GITLAB_PAT" $(GINKGO) --race -p -vv --focus '.*GitLab Token' ./...
339+
340+
e2e-gitlab: ## Runs e2e tests for GitLab only. TOKEN_TYPE is not used (since these are public APIs), but must be set to something
341+
TOKEN_TYPE="GITLAB_PAT" $(GINKGO) --race -p -vv --focus '.*GitLab' ./...
342+
337343
e2e-attestor: ## Runs e2e tests for scorecard-attestor
338344
cd attestor/e2e; go test -covermode=atomic -coverprofile=e2e-coverage.out; cd ../..
339345

‎checker/client.go‎

Lines changed: 43 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,11 @@ package checker
1717
import (
1818
"context"
1919
"fmt"
20+
"os"
2021

2122
"github.com/ossf/scorecard/v4/clients"
2223
ghrepo "github.com/ossf/scorecard/v4/clients/githubrepo"
24+
glrepo "github.com/ossf/scorecard/v4/clients/gitlabrepo"
2325
"github.com/ossf/scorecard/v4/clients/localdir"
2426
"github.com/ossf/scorecard/v4/clients/ossfuzz"
2527
"github.com/ossf/scorecard/v4/log"
@@ -35,7 +37,9 @@ func GetClients(ctx context.Context, repoURI, localURI string, logger *log.Logge
3537
clients.VulnerabilitiesClient, // vulnClient
3638
error,
3739
) {
38-
var githubRepo clients.Repo
40+
var repo clients.Repo
41+
var makeRepoError error
42+
3943
if localURI != "" {
4044
localRepo, errLocal := localdir.MakeLocalDirRepo(localURI)
4145
var retErr error
@@ -50,18 +54,46 @@ func GetClients(ctx context.Context, repoURI, localURI string, logger *log.Logge
5054
retErr
5155
}
5256

53-
githubRepo, errGitHub := ghrepo.MakeGithubRepo(repoURI)
54-
if errGitHub != nil {
55-
return githubRepo,
56-
nil,
57-
nil,
58-
nil,
59-
nil,
60-
fmt.Errorf("getting local directory client: %w", errGitHub)
57+
_, experimental := os.LookupEnv("SCORECARD_EXPERIMENTAL")
58+
var repoClient clients.RepoClient
59+
60+
//nolint:nestif
61+
if experimental && glrepo.DetectGitLab(repoURI) {
62+
repo, makeRepoError = glrepo.MakeGitlabRepo(repoURI)
63+
if makeRepoError != nil {
64+
return repo,
65+
nil,
66+
nil,
67+
nil,
68+
nil,
69+
fmt.Errorf("getting local directory client: %w", makeRepoError)
70+
}
71+
72+
var err error
73+
repoClient, err = glrepo.CreateGitlabClientWithToken(ctx, os.Getenv("GITLAB_AUTH_TOKEN"), repo)
74+
if err != nil {
75+
return repo,
76+
nil,
77+
nil,
78+
nil,
79+
nil,
80+
fmt.Errorf("error creating gitlab client: %w", err)
81+
}
82+
} else {
83+
repo, makeRepoError = ghrepo.MakeGithubRepo(repoURI)
84+
if makeRepoError != nil {
85+
return repo,
86+
nil,
87+
nil,
88+
nil,
89+
nil,
90+
fmt.Errorf("getting local directory client: %w", makeRepoError)
91+
}
92+
repoClient = ghrepo.CreateGithubRepoClient(ctx, logger)
6193
}
6294

63-
return githubRepo, /*repo*/
64-
ghrepo.CreateGithubRepoClient(ctx, logger), /*repoClient*/
95+
return repo, /*repo*/
96+
repoClient, /*repoClient*/
6597
ossfuzz.CreateOSSFuzzClient(ossfuzz.StatusURL), /*ossFuzzClient*/
6698
clients.DefaultCIIBestPracticesClient(), /*ciiClient*/
6799
clients.DefaultVulnerabilitiesClient(), /*vulnClient*/

0 commit comments

Comments
 (0)