Skip to content

Commit ea7c906

Browse files
spencerschrockspencerschrock
authored
Merge branch 'main' into pinned-deps-probe-cleanup
2 parents 954c3ea + 2a45ba6 commit ea7c906

File tree

67 files changed

+1960
-2226
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+1960
-2226
lines changed

‎.github/workflows/scorecard-analysis.yml

+11-7
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ on:
77
schedule:
88
# Weekly on Saturdays.
99
- cron: '30 1 * * 6'
10-
# pull_request:
11-
# branches: [main]
1210

1311
permissions: read-all
1412

@@ -17,36 +15,42 @@ jobs:
1715
name: Scorecard analysis
1816
runs-on: ubuntu-latest
1917
permissions:
18+
# Needed for Code scanning upload
2019
security-events: write
20+
# Needed for GitHub OIDC token if publish_results is true
2121
id-token: write
2222

2323
steps:
2424
- name: "Checkout code"
2525
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
26+
with:
27+
persist-credentials: false
2628

2729
- name: "Run analysis"
2830
uses: ossf/scorecard-action@0864cf19026789058feabb7e87baa5f140aac736 # v2.3.1
2931
with:
3032
results_file: results.sarif
3133
results_format: sarif
32-
repo_token: ${{ secrets.GITHUB_TOKEN }}
3334
# Scorecard team runs a weekly scan of public GitHub repos,
3435
# see https://github.com/ossf/scorecard#public-data.
3536
# Setting `publish_results: true` helps us scale by leveraging your workflow to
3637
# extract the results instead of relying on our own infrastructure to run scans.
3738
# And it's free for you!
3839
publish_results: true
3940

41+
# Upload the results as artifacts (optional). Commenting out will disable
42+
# uploads of run results in SARIF format to the repository Actions tab.
4043
# https://docs.github.com/en/actions/advanced-guides/storing-workflow-data-as-artifacts
41-
# Optional.
4244
- name: "Upload artifact"
43-
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v3
45+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
4446
with:
4547
name: SARIF file
4648
path: results.sarif
4749
retention-days: 5
4850

49-
- name: "Upload SARIF results"
50-
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v1
51+
# Upload the results to GitHub's code scanning dashboard (optional).
52+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
53+
- name: "Upload to code-scanning"
54+
uses: github/codeql-action/upload-sarif@83a02f7883b12e0e4e1a146174f5e2292a01e601 # v2.16.4
5155
with:
5256
sarif_file: results.sarif

‎checks/branch_protection_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
9292
UpToDateBeforeMerge: &trueVal,
9393
Contexts: []string{"foo"},
9494
},
95-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
95+
PullRequestRule: clients.PullRequestRule{
9696
Required: &trueVal,
9797
DismissStaleReviews: &trueVal,
9898
RequireCodeOwnerReviews: &trueVal,
@@ -112,7 +112,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
112112
UpToDateBeforeMerge: &falseVal,
113113
Contexts: nil,
114114
},
115-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
115+
PullRequestRule: clients.PullRequestRule{
116116
Required: &trueVal,
117117
DismissStaleReviews: &falseVal,
118118
RequireCodeOwnerReviews: &falseVal,
@@ -152,7 +152,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
152152
UpToDateBeforeMerge: &falseVal,
153153
Contexts: nil,
154154
},
155-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
155+
PullRequestRule: clients.PullRequestRule{
156156
Required: &trueVal,
157157
DismissStaleReviews: &falseVal,
158158
RequireCodeOwnerReviews: &falseVal,
@@ -188,7 +188,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
188188
UpToDateBeforeMerge: &trueVal,
189189
Contexts: []string{"foo"},
190190
},
191-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
191+
PullRequestRule: clients.PullRequestRule{
192192
Required: &trueVal,
193193
DismissStaleReviews: &trueVal,
194194
RequireCodeOwnerReviews: &trueVal,
@@ -210,7 +210,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
210210
UpToDateBeforeMerge: &falseVal,
211211
Contexts: nil,
212212
},
213-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
213+
PullRequestRule: clients.PullRequestRule{
214214
Required: &trueVal,
215215
DismissStaleReviews: &falseVal,
216216
RequireCodeOwnerReviews: &falseVal,
@@ -246,7 +246,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
246246
UpToDateBeforeMerge: &trueVal,
247247
Contexts: []string{"foo"},
248248
},
249-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
249+
PullRequestRule: clients.PullRequestRule{
250250
Required: &trueVal,
251251
DismissStaleReviews: &trueVal,
252252
RequireCodeOwnerReviews: &trueVal,
@@ -268,7 +268,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
268268
UpToDateBeforeMerge: &trueVal,
269269
Contexts: []string{"foo"},
270270
},
271-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
271+
PullRequestRule: clients.PullRequestRule{
272272
Required: &trueVal,
273273
DismissStaleReviews: &trueVal,
274274
RequireCodeOwnerReviews: &trueVal,
@@ -305,7 +305,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
305305
UpToDateBeforeMerge: &falseVal,
306306
Contexts: nil,
307307
},
308-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
308+
PullRequestRule: clients.PullRequestRule{
309309
Required: &trueVal,
310310
DismissStaleReviews: &falseVal,
311311
RequireCodeOwnerReviews: &falseVal,
@@ -344,7 +344,7 @@ func TestReleaseAndDevBranchProtected(t *testing.T) {
344344
UpToDateBeforeMerge: &falseVal,
345345
Contexts: nil,
346346
},
347-
RequiredPullRequestReviews: clients.PullRequestReviewRule{
347+
PullRequestRule: clients.PullRequestRule{
348348
Required: &trueVal,
349349
DismissStaleReviews: &falseVal,
350350
RequireCodeOwnerReviews: &falseVal,

‎checks/dependency_update_tool_test.go

+45-27
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ func TestDependencyUpdateTool(t *testing.T) {
4242
wantErr bool
4343
}{
4444
{
45-
name: "dependency yml",
45+
name: "dependabot config detected",
4646
wantErr: false,
4747
files: []string{
4848
".github/dependabot.yml",
@@ -55,7 +55,7 @@ func TestDependencyUpdateTool(t *testing.T) {
5555
},
5656
},
5757
{
58-
name: "dependency yaml ",
58+
name: "dependabot alternate yaml extension detected",
5959
wantErr: false,
6060
files: []string{
6161
".github/dependabot.yaml",
@@ -68,66 +68,84 @@ func TestDependencyUpdateTool(t *testing.T) {
6868
},
6969
},
7070
{
71-
name: "foo bar",
71+
name: "renovatebot config detected",
7272
wantErr: false,
7373
files: []string{
74-
".github/foobar.yml",
74+
"renovate.json",
7575
},
76-
SearchCommits: []clients.Commit{{Committer: clients.User{ID: 111111111}}},
77-
CallSearchCommits: 1,
76+
CallSearchCommits: 0,
7877
expected: scut.TestReturn{
79-
NumberOfWarn: 3,
78+
NumberOfInfo: 1,
79+
NumberOfWarn: 0,
80+
Score: 10,
8081
},
8182
},
8283
{
83-
name: "foo bar 2",
84+
name: "alternate renovatebot config detected",
8485
wantErr: false,
8586
files: []string{
86-
".github/foobar.yml",
87+
".github/renovate.json5",
8788
},
88-
SearchCommits: []clients.Commit{},
89-
CallSearchCommits: 1,
89+
CallSearchCommits: 0,
9090
expected: scut.TestReturn{
91-
NumberOfWarn: 3,
91+
NumberOfInfo: 1,
92+
NumberOfWarn: 0,
93+
Score: 10,
9294
},
9395
},
94-
9596
{
96-
name: "found in commits",
97+
name: "pyup config detected",
9798
wantErr: false,
9899
files: []string{
99-
".github/foobar.yaml",
100+
".pyup.yml",
100101
},
101-
SearchCommits: []clients.Commit{{Committer: clients.User{ID: dependabotID}}},
102-
CallSearchCommits: 1,
102+
CallSearchCommits: 0,
103103
expected: scut.TestReturn{
104104
NumberOfInfo: 1,
105105
NumberOfWarn: 0,
106106
Score: 10,
107107
},
108108
},
109109
{
110-
name: "found in commits 2",
110+
name: "random committer ID not detected as dependecy tool bot",
111+
wantErr: false,
112+
files: []string{},
113+
SearchCommits: []clients.Commit{{Committer: clients.User{ID: 111111111}}},
114+
CallSearchCommits: 1,
115+
expected: scut.TestReturn{
116+
NumberOfWarn: 1,
117+
},
118+
},
119+
{
120+
name: "random yaml file not detected as update tool config",
111121
wantErr: false,
112-
files: []string{},
113-
SearchCommits: []clients.Commit{
114-
{Committer: clients.User{ID: 111111111}},
115-
{Committer: clients.User{ID: dependabotID}},
122+
files: []string{
123+
".github/foobar.yml",
116124
},
125+
SearchCommits: []clients.Commit{},
126+
CallSearchCommits: 1,
127+
expected: scut.TestReturn{
128+
NumberOfWarn: 1,
129+
},
130+
},
131+
{
132+
name: "dependabot found in recent commits",
133+
wantErr: false,
134+
files: []string{
135+
".github/foobar.yaml",
136+
},
137+
SearchCommits: []clients.Commit{{Committer: clients.User{ID: dependabotID}}},
117138
CallSearchCommits: 1,
118139
expected: scut.TestReturn{
119140
NumberOfInfo: 1,
120141
NumberOfWarn: 0,
121142
Score: 10,
122143
},
123144
},
124-
125145
{
126-
name: "many commits",
146+
name: "dependabot bot found in recent commits 2",
127147
wantErr: false,
128-
files: []string{
129-
".github/foobar.yml",
130-
},
148+
files: []string{},
131149
SearchCommits: []clients.Commit{
132150
{Committer: clients.User{ID: 111111111}},
133151
{Committer: clients.User{ID: dependabotID}},

‎checks/evaluation/dependency_update_tool.go

+2-6
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,7 @@ import (
1818
"github.com/ossf/scorecard/v4/checker"
1919
sce "github.com/ossf/scorecard/v4/errors"
2020
"github.com/ossf/scorecard/v4/finding"
21-
"github.com/ossf/scorecard/v4/probes/toolDependabotInstalled"
22-
"github.com/ossf/scorecard/v4/probes/toolPyUpInstalled"
23-
"github.com/ossf/scorecard/v4/probes/toolRenovateInstalled"
21+
"github.com/ossf/scorecard/v4/probes/dependencyUpdateToolConfigured"
2422
)
2523

2624
// DependencyUpdateTool applies the score policy and logs the details
@@ -29,9 +27,7 @@ func DependencyUpdateTool(name string,
2927
findings []finding.Finding, dl checker.DetailLogger,
3028
) checker.CheckResult {
3129
expectedProbes := []string{
32-
toolDependabotInstalled.Probe,
33-
toolPyUpInstalled.Probe,
34-
toolRenovateInstalled.Probe,
30+
dependencyUpdateToolConfigured.Probe,
3531
}
3632
if !finding.UniqueProbesEqual(findings, expectedProbes) {
3733
e := sce.WithMessage(sce.ErrScorecardInternal, "invalid probe results")

0 commit comments

Comments
 (0)