Skip to content

Commit f7aa7bb

Browse files
spencerschrockspencerschrock
authored
Merge branch 'main' into delete-project-update
2 parents 44a9559 + 8d865ff commit f7aa7bb

14 files changed

Lines changed: 384 additions & 10 deletions

File tree

‎.github/workflows/docker.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ jobs:
4242
fetch-depth: 2 # needed to diff changed files
4343
- id: files
4444
name: Get changed files
45-
uses: tj-actions/changed-files@1f20fb83f05eabed6e12ba0329edac8b6ec8e207 #v37.1.1
45+
uses: tj-actions/changed-files@2a968ff601949c81b47d9c1fdb789b0d25ddeea2 #v37.1.2
4646
with:
4747
files_ignore: '**.md'
4848
- id: docs_only_check

‎.github/workflows/main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ jobs:
8282
command: make e2e-pat
8383
- name: codecov
8484
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # 2.1.0
85-
if: ${{ github.event_name != 'pull_request' }}
85+
if: ${{ github.event_name != 'pull_request' || github.actor != 'dependabot[bot]' }}
8686
with:
8787
files: "*e2e-coverage.out"
8888
verbose: true

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -330,7 +330,7 @@ endif
330330
e2e-pat: ## Runs e2e tests. Requires GITHUB_AUTH_TOKEN env var to be set to GitHub personal access token
331331
e2e-pat: build-scorecard check-env | $(GINKGO)
332332
# Run e2e tests. GITHUB_AUTH_TOKEN with personal access token must be exported to run this
333-
TOKEN_TYPE="PAT" $(GINKGO) --race -p -v -cover -coverprofile=e2e-coverage.out --keep-separate-coverprofiles ./...
333+
TOKEN_TYPE="PAT" $(GINKGO) --race -p -v -coverprofile=e2e-coverage.out -coverpkg=./... -r ./...
334334

335335
e2e-gh-token: ## Runs e2e tests. Requires GITHUB_AUTH_TOKEN env var to be set to default GITHUB_TOKEN
336336
e2e-gh-token: build-scorecard check-env | $(GINKGO)
@@ -444,4 +444,4 @@ cron-github-server-ko: | $(KO) $(KOCACHE_PATH)
444444
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
445445
github.com/ossf/scorecard/v4/clients/githubrepo/roundtripper/tokens/server
446446

447-
###############################################################################
447+
###############################################################################

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# OpenSSF Scorecard
22

3-
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ossf/scorecard/badge)](https://api.securityscorecards.dev/projects/github.com/ossf/scorecard)
3+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/ossf/scorecard/badge)](https://securityscorecards.dev/viewer/?uri=github.com/ossf/scorecard)
44
[![OpenSSF Best Practices](https://bestpractices.coreinfrastructure.org/projects/5621/badge)](https://bestpractices.coreinfrastructure.org/projects/5621)
55
![build](https://github.com/ossf/scorecard/workflows/build/badge.svg?branch=main)
66
![CodeQL](https://github.com/ossf/scorecard/workflows/CodeQL/badge.svg?branch=main)
@@ -154,12 +154,12 @@ in the Scorecard GitHub Action setting.
154154

155155
Enabling [`publish_results: true`](https://github.com/ossf/scorecard-action/blob/dd5015aaf9688596b0e6d11e7f24fff566aa366b/action.yaml#L35)
156156
in Scorecard GitHub Actions also allows maintainers to display a Scorecard badge on their repository to show off their
157-
hard work. This badge also auto-updates for every change made to the repository.
157+
hard work. This badge also auto-updates for every change made to the repository. See more details on [this OSSF blogpost](https://openssf.org/blog/2022/09/08/show-off-your-security-score-announcing-scorecards-badges/).
158+
158159
To include a badge on your project's repository, simply add the following markdown to your README:
159160

160161
```
161-
[![OpenSSF
162-
Scorecard](https://api.securityscorecards.dev/projects/github.com/{owner}/{repo}/badge)](https://api.securityscorecards.dev/projects/github.com/{owner}/{repo})
162+
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/{owner}/{repo}/badge)](https://securityscorecards.dev/viewer/?uri=github.com/{owner}/{repo})
163163
```
164164

165165
### Scorecard Command Line Interface

‎checks/sast.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ func SAST(c *checker.CheckRequest) checker.CheckResult {
100100
Text: getNonCompliantPRMessage(nonCompliantPRs),
101101
})
102102
score := checker.AggregateScoresWithWeight(map[int]int{sastScore: sastWeight, codeQlScore: codeQlWeight})
103-
return checker.CreateResultWithScore(CheckSAST, "SAST tool detected but not run on all commmits", score)
103+
return checker.CreateResultWithScore(CheckSAST, "SAST tool detected but not run on all commits", score)
104104
default:
105105
return checker.CreateRuntimeErrorResult(CheckSAST, sce.WithMessage(sce.ErrScorecardInternal, "contact team"))
106106
}

‎clients/githubrepo/branches.go‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,16 @@ func copyAdminSettings(src *branchProtectionRule, dst *clients.BranchProtectionR
190190
copyBoolPtr(src.DismissesStaleReviews, &dst.RequiredPullRequestReviews.DismissStaleReviews)
191191
if src.RequiresStatusChecks != nil {
192192
copyBoolPtr(src.RequiresStatusChecks, &dst.CheckRules.RequiresStatusChecks)
193-
copyBoolPtr(src.RequiresStrictStatusChecks, &dst.CheckRules.UpToDateBeforeMerge)
193+
// TODO(#3255): Update when GitHub GraphQL bug is fixed
194+
// Workaround for GitHub GraphQL bug https://github.com/orgs/community/discussions/59471
195+
// The setting RequiresStrictStatusChecks should tell if the branch is required
196+
// to be up to date before merge, but it only returns the correct value if
197+
// RequiresStatusChecks is true. If RequiresStatusChecks is false, RequiresStrictStatusChecks
198+
// is wrongly retrieved as true.
199+
if src.RequiresStrictStatusChecks != nil {
200+
upToDateBeforeMerge := *src.RequiresStatusChecks && *src.RequiresStrictStatusChecks
201+
copyBoolPtr(&upToDateBeforeMerge, &dst.CheckRules.UpToDateBeforeMerge)
202+
}
194203
}
195204
}
196205

‎cmd/internal/scdiff/app/format/format.go‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
// Copyright 2023 OpenSSF Scorecard Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package format
16+
17+
import (
18+
"os"
19+
20+
"github.com/ossf/scorecard/v4/docs/checks"
21+
"github.com/ossf/scorecard/v4/log"
22+
"github.com/ossf/scorecard/v4/pkg"
23+
)
24+
25+
//nolint:wrapcheck
26+
func JSON(r *pkg.ScorecardResult) error {
27+
const details = true
28+
docs, err := checks.Read()
29+
if err != nil {
30+
return err
31+
}
32+
// TODO standardize the input, and output it to a file
33+
return r.AsJSON2(details, log.DefaultLevel, docs, os.Stdout)
34+
}

‎cmd/internal/scdiff/app/generate.go‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
// Copyright 2023 OpenSSF Scorecard Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package app
16+
17+
import (
18+
"bufio"
19+
"fmt"
20+
"os"
21+
22+
"github.com/spf13/cobra"
23+
24+
"github.com/ossf/scorecard/v4/cmd/internal/scdiff/app/format"
25+
"github.com/ossf/scorecard/v4/cmd/internal/scdiff/app/runner"
26+
)
27+
28+
//nolint:gochecknoinits // common for cobra apps
29+
func init() {
30+
rootCmd.AddCommand(generateCmd)
31+
generateCmd.PersistentFlags().StringVarP(&repoFile, "repos", "r", "", "path to newline-delimited repo file")
32+
}
33+
34+
var (
35+
repoFile string
36+
37+
generateCmd = &cobra.Command{
38+
Use: "generate [flags] repofile",
39+
Short: "Generate Scorecard results for diffing",
40+
Long: `Generate Scorecard results for diffing`,
41+
RunE: func(cmd *cobra.Command, args []string) error {
42+
f, err := os.Open(repoFile)
43+
if err != nil {
44+
return fmt.Errorf("unable to open repo file: %w", err)
45+
}
46+
scorecardRunner := runner.New()
47+
scanner := bufio.NewScanner(f)
48+
for scanner.Scan() {
49+
results, err := scorecardRunner.Run(scanner.Text())
50+
if err != nil {
51+
return fmt.Errorf("running scorecard on %s: %w", scanner.Text(), err)
52+
}
53+
err = format.JSON(&results)
54+
if err != nil {
55+
return fmt.Errorf("formatting results: %w", err)
56+
}
57+
}
58+
if err := scanner.Err(); err != nil {
59+
return fmt.Errorf("reading repo file: %w", err)
60+
}
61+
return nil
62+
},
63+
}
64+
)

‎cmd/internal/scdiff/app/root.go‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// Copyright 2023 OpenSSF Scorecard Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package app
16+
17+
import (
18+
"fmt"
19+
"os"
20+
21+
"github.com/spf13/cobra"
22+
)
23+
24+
var rootCmd = &cobra.Command{
25+
Use: "scdiff",
26+
Short: "Scorecard Diff",
27+
Long: `Scorecard result diffing command line interface tool`,
28+
}
29+
30+
func Execute() {
31+
if err := rootCmd.Execute(); err != nil {
32+
fmt.Fprintln(os.Stderr, err)
33+
os.Exit(1)
34+
}
35+
}

‎cmd/internal/scdiff/app/runner/runner.go‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
// Copyright 2023 OpenSSF Scorecard Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package runner
16+
17+
import (
18+
"context"
19+
20+
"github.com/ossf/scorecard/v4/checker"
21+
"github.com/ossf/scorecard/v4/checks"
22+
"github.com/ossf/scorecard/v4/clients"
23+
"github.com/ossf/scorecard/v4/clients/githubrepo"
24+
"github.com/ossf/scorecard/v4/clients/ossfuzz"
25+
"github.com/ossf/scorecard/v4/log"
26+
"github.com/ossf/scorecard/v4/pkg"
27+
)
28+
29+
const (
30+
commit = clients.HeadSHA
31+
commitDepth = 0 // default
32+
)
33+
34+
// Runner holds the clients and configuration needed to run Scorecard on multiple repos.
35+
type Runner struct {
36+
ctx context.Context
37+
logger *log.Logger
38+
enabledChecks checker.CheckNameToFnMap
39+
repoClient clients.RepoClient
40+
ossFuzz clients.RepoClient
41+
cii clients.CIIBestPracticesClient
42+
vuln clients.VulnerabilitiesClient
43+
}
44+
45+
func New() Runner {
46+
ctx := context.Background()
47+
logger := log.NewLogger(log.DefaultLevel)
48+
return Runner{
49+
ctx: ctx,
50+
logger: logger,
51+
repoClient: githubrepo.CreateGithubRepoClient(ctx, logger),
52+
ossFuzz: ossfuzz.CreateOSSFuzzClient(ossfuzz.StatusURL),
53+
cii: clients.DefaultCIIBestPracticesClient(),
54+
vuln: clients.DefaultVulnerabilitiesClient(),
55+
enabledChecks: checks.GetAll(),
56+
}
57+
}
58+
59+
//nolint:wrapcheck
60+
func (r *Runner) Run(repoURI string) (pkg.ScorecardResult, error) {
61+
r.log("processing repo: " + repoURI)
62+
// TODO (gitlab?)
63+
repo, err := githubrepo.MakeGithubRepo(repoURI)
64+
if err != nil {
65+
return pkg.ScorecardResult{}, err
66+
}
67+
return pkg.RunScorecard(r.ctx, repo, commit, commitDepth, r.enabledChecks, r.repoClient, r.ossFuzz, r.cii, r.vuln)
68+
}
69+
70+
// logs only if logger is set.
71+
func (r *Runner) log(msg string) {
72+
if r.logger != nil {
73+
r.logger.Info(msg)
74+
}
75+
}

0 commit comments

Comments
 (0)