2021-02-13 00:54:06 +03:00
|
|
|
SHELL := /bin/bash
|
2021-08-12 23:46:06 +03:00
|
|
|
GIT_HASH := $(shell git rev-parse HEAD)
|
2021-10-26 20:22:22 +03:00
|
|
|
GIT_VERSION ?= $(shell git describe --tags --always --dirty)
|
|
|
|
SOURCE_DATE_EPOCH=$(shell git log --date=iso8601-strict -1 --pretty=%ct)
|
2021-02-24 22:46:41 +03:00
|
|
|
IMAGE_NAME = scorecard
|
2021-02-25 22:51:57 +03:00
|
|
|
OUTPUT = output
|
2021-11-08 18:55:58 +03:00
|
|
|
PLATFORM="linux/amd64,linux/arm64,linux/386,linux/arm"
|
2021-10-25 22:30:13 +03:00
|
|
|
LDFLAGS=$(shell ./scripts/version-ldflags)
|
2022-02-18 23:27:24 +03:00
|
|
|
|
|
|
|
|
2021-07-27 20:37:27 +03:00
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
############################### make help #####################################
|
2021-02-22 02:35:39 +03:00
|
|
|
.PHONY: help
|
|
|
|
help: ## Display this help
|
2022-01-31 05:23:40 +03:00
|
|
|
@awk 'BEGIN {FS = ":.*##"; \
|
|
|
|
printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ \
|
|
|
|
{ printf " \033[36m%-15s\033[0m %s\n", $$1, $$2 } \
|
|
|
|
/^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
|
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
###############################################################################
|
|
|
|
|
2022-09-22 18:58:10 +03:00
|
|
|
##@ Tools
|
2021-05-15 23:58:01 +03:00
|
|
|
################################ make install #################################
|
2022-09-22 18:58:10 +03:00
|
|
|
TOOLS_DIR := tools
|
|
|
|
TOOLS_BIN_DIR := $(abspath $(TOOLS_DIR)/bin)
|
|
|
|
GOBIN := $(shell go env GOBIN)
|
|
|
|
|
|
|
|
# Golang binaries.
|
|
|
|
|
|
|
|
GOLANGCI_LINT := $(TOOLS_BIN_DIR)/golangci-lint
|
|
|
|
$(GOLANGCI_LINT): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/golangci/golangci-lint/cmd/golangci-lint
|
|
|
|
|
|
|
|
KO := $(TOOLS_BIN_DIR)/ko
|
|
|
|
$(KO): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/google/ko
|
|
|
|
|
|
|
|
STUNNING_TRIBBLE := $(TOOLS_BIN_DIR)/stunning-tribble
|
|
|
|
$(STUNNING_TRIBBLE): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/naveensrinivasan/stunning-tribble
|
2020-12-23 00:43:24 +03:00
|
|
|
|
2022-09-22 18:58:10 +03:00
|
|
|
MOCKGEN := $(TOOLS_BIN_DIR)/mockgen
|
|
|
|
$(MOCKGEN): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/golang/mock/mockgen
|
|
|
|
|
|
|
|
GINKGO := $(TOOLS_BIN_DIR)/ginkgo
|
|
|
|
$(GINKGO): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/onsi/ginkgo/v2/ginkgo
|
|
|
|
|
|
|
|
GORELEASER := $(TOOLS_BIN_DIR)/goreleaser
|
|
|
|
$(GORELEASER): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install github.com/goreleaser/goreleaser
|
|
|
|
|
|
|
|
PROTOC_GEN_GO := $(TOOLS_BIN_DIR)/protoc-gen-go
|
|
|
|
$(PROTOC_GEN_GO): $(TOOLS_DIR)/go.mod
|
|
|
|
cd $(TOOLS_DIR); GOBIN=$(TOOLS_BIN_DIR) go install google.golang.org/protobuf/cmd/protoc-gen-go
|
|
|
|
|
|
|
|
# Non-Golang binaries.
|
|
|
|
# TODO: Figure out how to install these binaries automatically.
|
|
|
|
|
|
|
|
PROTOC := $(shell which protoc)
|
2021-05-15 23:58:01 +03:00
|
|
|
$(PROTOC):
|
|
|
|
ifeq (,$(PROTOC))
|
|
|
|
$(error download and install protobuf compiler package - https://developers.google.com/protocol-buffers/docs/downloads)
|
|
|
|
endif
|
2022-09-22 18:58:10 +03:00
|
|
|
|
|
|
|
# Installs required binaries into $(TOOLS_BIN_DIR) wherever possible.
|
|
|
|
# Keeping a local copy instead of a global install allows for:
|
|
|
|
# i) Controlling the binary version Scorecard depends on leading to consistent
|
|
|
|
# behavior across users.
|
|
|
|
# ii) Avoids installing a whole bunch of otherwise unnecessary tools in the user's workspace.
|
|
|
|
.PHONY: install
|
|
|
|
install: ## Installs required binaries.
|
|
|
|
install: $(GOLANGCI_LINT) \
|
|
|
|
$(KO) \
|
|
|
|
$(STUNNING_TRIBBLE) \
|
|
|
|
$(PROTOC_GEN_GO) $(PROTOC) \
|
|
|
|
$(MOCKGEN) \
|
|
|
|
$(GINKGO) \
|
|
|
|
$(GORELEASER)
|
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
###############################################################################
|
|
|
|
|
2022-01-31 05:23:40 +03:00
|
|
|
##@ Build
|
2021-05-15 23:58:01 +03:00
|
|
|
################################## make all ###################################
|
2021-02-22 02:35:39 +03:00
|
|
|
all: ## Runs build, test and verify
|
2022-11-30 21:22:00 +03:00
|
|
|
all-targets = build unit-test check-linter validate-docs add-projects validate-projects
|
2021-12-02 23:20:27 +03:00
|
|
|
.PHONY: all all-targets-update-dependencies $(all-targets) update-dependencies tree-status
|
|
|
|
all-targets-update-dependencies: $(all-targets) | update-dependencies
|
|
|
|
all: update-dependencies all-targets-update-dependencies tree-status
|
2021-05-15 23:58:01 +03:00
|
|
|
|
|
|
|
update-dependencies: ## Update go dependencies for all modules
|
|
|
|
# Update root go modules
|
|
|
|
go mod tidy && go mod verify
|
2022-09-12 23:33:52 +03:00
|
|
|
cd tools; go mod tidy && go mod verify; cd ../
|
2021-05-15 23:58:01 +03:00
|
|
|
|
|
|
|
check-linter: ## Install and run golang linter
|
2022-09-22 18:58:10 +03:00
|
|
|
check-linter: | $(GOLANGCI_LINT)
|
2021-05-15 23:58:01 +03:00
|
|
|
# Run golangci-lint linter
|
2022-09-22 18:58:10 +03:00
|
|
|
$(GOLANGCI_LINT) run -c .golangci.yml
|
2021-05-15 23:58:01 +03:00
|
|
|
|
2022-05-26 01:37:22 +03:00
|
|
|
add-projects: ## Adds new projects to ./cron/internal/data/projects.csv
|
|
|
|
add-projects: ./cron/internal/data/projects.csv | build-add-script
|
|
|
|
# Add new projects to ./cron/internal/data/projects.csv
|
|
|
|
./cron/internal/data/add/add ./cron/internal/data/projects.csv ./cron/internal/data/projects.new.csv
|
|
|
|
mv ./cron/internal/data/projects.new.csv ./cron/internal/data/projects.csv
|
2021-06-10 23:24:33 +03:00
|
|
|
|
2022-05-26 01:37:22 +03:00
|
|
|
validate-projects: ## Validates ./cron/internal/data/projects.csv
|
|
|
|
validate-projects: ./cron/internal/data/projects.csv | build-validate-script
|
|
|
|
# Validate ./cron/internal/data/projects.csv
|
|
|
|
./cron/internal/data/validate/validate ./cron/internal/data/projects.csv
|
2021-02-22 02:35:39 +03:00
|
|
|
|
2021-12-02 23:20:27 +03:00
|
|
|
tree-status: | all-targets-update-dependencies ## Verify tree is clean and all changes are committed
|
2021-05-15 23:58:01 +03:00
|
|
|
# Verify the tree is clean and all changes are commited
|
|
|
|
./scripts/tree-status
|
2021-05-17 22:20:28 +03:00
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
###############################################################################
|
|
|
|
|
2021-06-10 23:24:33 +03:00
|
|
|
################################## make build #################################
|
2021-10-21 23:08:56 +03:00
|
|
|
## Build all cron-related targets
|
2021-11-18 20:04:07 +03:00
|
|
|
build-cron: build-controller build-worker build-cii-worker \
|
|
|
|
build-shuffler build-bq-transfer build-github-server \
|
|
|
|
build-webhook build-add-script build-validate-script build-update-script
|
2021-10-21 23:08:56 +03:00
|
|
|
|
2022-11-01 21:30:17 +03:00
|
|
|
build-targets = generate-mocks generate-docs build-scorecard build-cron build-proto build-attestor
|
2021-05-15 23:58:01 +03:00
|
|
|
.PHONY: build $(build-targets)
|
2021-09-04 18:39:10 +03:00
|
|
|
build: ## Build all binaries and images in the repo.
|
2021-05-15 23:58:01 +03:00
|
|
|
build: $(build-targets)
|
|
|
|
|
|
|
|
build-proto: ## Compiles and generates all required protobufs
|
2022-10-20 00:01:42 +03:00
|
|
|
build-proto: cron/data/request.pb.go cron/data/metadata.pb.go
|
|
|
|
cron/data/request.pb.go: cron/data/request.proto | $(PROTOC) $(PROTOC_GEN_GO)
|
|
|
|
$(PROTOC) --plugin=$(PROTOC_GEN_GO) --go_out=. --go_opt=paths=source_relative cron/data/request.proto
|
|
|
|
cron/data/metadata.pb.go: cron/data/metadata.proto | $(PROTOC) $(PROTOC_GEN_GO)
|
|
|
|
$(PROTOC) --plugin=$(PROTOC_GEN_GO) --go_out=. --go_opt=paths=source_relative cron/data/metadata.proto
|
2021-05-15 23:58:01 +03:00
|
|
|
|
2021-11-13 01:16:22 +03:00
|
|
|
generate-mocks: ## Compiles and generates all mocks using mockgen.
|
2022-09-22 18:58:10 +03:00
|
|
|
generate-mocks: clients/mockclients/repo_client.go \
|
|
|
|
clients/mockclients/repo.go \
|
|
|
|
clients/mockclients/cii_client.go \
|
|
|
|
checks/mockclients/vulnerabilities.go \
|
|
|
|
cmd/packagemanager_mockclient.go
|
|
|
|
clients/mockclients/repo_client.go: clients/repo_client.go | $(MOCKGEN)
|
2021-11-13 01:16:22 +03:00
|
|
|
# Generating MockRepoClient
|
2021-11-15 05:46:41 +03:00
|
|
|
$(MOCKGEN) -source=clients/repo_client.go -destination=clients/mockclients/repo_client.go -package=mockrepo -copyright_file=clients/mockclients/license.txt
|
2022-09-22 18:58:10 +03:00
|
|
|
clients/mockclients/repo.go: clients/repo.go | $(MOCKGEN)
|
2021-11-15 05:46:41 +03:00
|
|
|
# Generating MockRepo
|
|
|
|
$(MOCKGEN) -source=clients/repo.go -destination=clients/mockclients/repo.go -package=mockrepo -copyright_file=clients/mockclients/license.txt
|
2022-09-22 18:58:10 +03:00
|
|
|
clients/mockclients/cii_client.go: clients/cii_client.go | $(MOCKGEN)
|
2021-11-15 05:46:41 +03:00
|
|
|
# Generating MockCIIClient
|
|
|
|
$(MOCKGEN) -source=clients/cii_client.go -destination=clients/mockclients/cii_client.go -package=mockrepo -copyright_file=clients/mockclients/license.txt
|
2022-09-22 18:58:10 +03:00
|
|
|
checks/mockclients/vulnerabilities.go: clients/vulnerabilities.go | $(MOCKGEN)
|
2022-01-03 04:43:38 +03:00
|
|
|
# Generating MockCIIClient
|
|
|
|
$(MOCKGEN) -source=clients/vulnerabilities.go -destination=clients/mockclients/vulnerabilities.go -package=mockrepo -copyright_file=clients/mockclients/license.txt
|
2022-09-22 18:58:10 +03:00
|
|
|
cmd/packagemanager_mockclient.go: cmd/packagemanager_client.go | $(MOCKGEN)
|
2022-03-09 08:36:23 +03:00
|
|
|
# Generating MockPackageManagerClient
|
2022-03-11 18:28:10 +03:00
|
|
|
$(MOCKGEN) -source=cmd/packagemanager_client.go -destination=cmd/packagemanager_mockclient.go -package=cmd -copyright_file=clients/mockclients/license.txt
|
2022-09-22 18:58:10 +03:00
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
generate-docs: ## Generates docs
|
2021-11-10 19:56:44 +03:00
|
|
|
generate-docs: validate-docs docs/checks.md
|
2021-09-10 01:09:39 +03:00
|
|
|
docs/checks.md: docs/checks/internal/checks.yaml docs/checks/internal/*.go docs/checks/internal/generate/*.go
|
2021-05-15 23:58:01 +03:00
|
|
|
# Generating checks.md
|
2021-09-10 18:26:27 +03:00
|
|
|
go run ./docs/checks/internal/generate/main.go docs/checks.md
|
2021-05-15 23:58:01 +03:00
|
|
|
|
2021-11-10 19:56:44 +03:00
|
|
|
validate-docs: docs/checks/internal/generate/main.go
|
|
|
|
# Validating checks.yaml
|
|
|
|
go run ./docs/checks/internal/validate/main.go
|
|
|
|
|
2022-11-30 21:22:00 +03:00
|
|
|
SCORECARD_DEPS = $(shell find . -iname "*.go" | grep -v tools/)
|
2022-09-24 22:58:50 +03:00
|
|
|
build-scorecard: ## Build Scorecard CLI
|
|
|
|
build-scorecard: scorecard
|
|
|
|
scorecard: $(SCORECARD_DEPS)
|
2021-05-15 23:58:01 +03:00
|
|
|
# Run go build and generate scorecard executable
|
2021-09-29 01:02:58 +03:00
|
|
|
CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)'
|
2022-09-24 22:58:50 +03:00
|
|
|
scorecard-docker: ## Build Scorecard CLI Docker image
|
|
|
|
scorecard-docker: scorecard.docker
|
|
|
|
scorecard.docker: Dockerfile $(SCORECARD_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file Dockerfile \
|
|
|
|
--tag $(IMAGE_NAME) && \
|
|
|
|
touch scorecard.docker
|
|
|
|
|
|
|
|
build-releaser: ## Build goreleaser for the Scorecard CLI
|
|
|
|
build-releaser: scorecard.releaser
|
|
|
|
scorecard.releaser: .goreleaser.yml $(SCORECARD_DEPS) | $(GORELEASER)
|
2021-11-23 19:56:21 +03:00
|
|
|
# Run go releaser on the Scorecard repo
|
2022-09-24 22:58:50 +03:00
|
|
|
$(GORELEASER) check && \
|
|
|
|
VERSION_LDFLAGS="$(LDFLAGS)" $(GORELEASER) release \
|
|
|
|
--snapshot --rm-dist --skip-publish --skip-sign && \
|
|
|
|
touch scorecard.releaser
|
|
|
|
|
|
|
|
CRON_CONTROLLER_DEPS = $(shell find cron/internal/ -iname "*.go")
|
|
|
|
build-controller: ## Build cron controller
|
|
|
|
build-controller: cron/internal/controller/controller
|
|
|
|
cron/internal/controller/controller: $(CRON_CONTROLLER_DEPS)
|
2021-11-18 20:04:07 +03:00
|
|
|
# Run go build on the cron PubSub controller
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/controller && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o controller
|
2022-09-24 22:58:50 +03:00
|
|
|
cron-controller-docker: ## Build cron controller Docker image
|
|
|
|
cron-controller-docker: cron/internal/controller/controller.docker
|
|
|
|
cron/internal/controller/controller.docker: cron/internal/controller/Dockerfile $(CRON_CONTROLLER_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file cron/internal/controller/Dockerfile \
|
|
|
|
--tag $(IMAGE_NAME)-batch-controller \
|
|
|
|
&& touch cron/internal/controller/controller.docker
|
2021-11-18 20:04:07 +03:00
|
|
|
|
|
|
|
build-worker: ## Runs go build on the cron PubSub worker
|
|
|
|
# Run go build on the cron PubSub worker
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/worker && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o worker
|
2021-05-19 01:18:08 +03:00
|
|
|
|
2022-09-24 22:58:50 +03:00
|
|
|
CRON_CII_DEPS = $(shell find cron/internal/ clients/ -iname "*.go")
|
|
|
|
build-cii-worker: ## Build cron CII worker
|
|
|
|
build-cii-worker: cron/internal/cii/cii-worker
|
|
|
|
cron/internal/cii/cii-worker: $(CRON_CII_DEPS)
|
2021-11-16 07:23:00 +03:00
|
|
|
# Run go build on the CII worker
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/cii && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o cii-worker
|
2022-09-24 22:58:50 +03:00
|
|
|
cron-cii-worker-docker: # Build cron CII worker Docker image
|
|
|
|
cron-cii-worker-docker: cron/internal/cii/cii-worker.docker
|
|
|
|
cron/internal/cii/cii-worker.docker: cron/internal/cii/Dockerfile $(CRON_CII_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file cron/internal/cii/Dockerfile \
|
|
|
|
--tag $(IMAGE_NAME)-cii-worker && \
|
|
|
|
touch cron/internal/cii/cii-worker.docker
|
|
|
|
|
2022-10-20 00:01:42 +03:00
|
|
|
CRON_SHUFFLER_DEPS = $(shell find cron/data/ cron/internal/shuffle/ -iname "*.go")
|
2022-09-24 22:58:50 +03:00
|
|
|
build-shuffler: ## Build cron shuffle script
|
|
|
|
build-shuffler: cron/internal/shuffle/shuffle
|
|
|
|
cron/internal/shuffle/shuffle: $(CRON_SHUFFLER_DEPS)
|
2021-11-18 20:04:07 +03:00
|
|
|
# Run go build on the cron shuffle script
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/shuffle && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o shuffle
|
2021-11-18 20:04:07 +03:00
|
|
|
|
2022-10-20 00:01:42 +03:00
|
|
|
CRON_TRANSFER_DEPS = $(shell find cron/data/ cron/config/ cron/internal/bq/ -iname "*.go")
|
2022-09-24 22:58:50 +03:00
|
|
|
build-bq-transfer: ## Build cron BQ transfer worker
|
|
|
|
build-bq-transfer: cron/internal/bq/data-transfer
|
|
|
|
cron/internal/bq/data-transfer: $(CRON_TRANSFER_DEPS)
|
2021-06-15 02:25:32 +03:00
|
|
|
# Run go build on the Copier cron job
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/bq && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o data-transfer
|
2022-09-24 22:58:50 +03:00
|
|
|
cron-bq-transfer-docker: ## Build cron BQ transfer worker Docker image
|
|
|
|
cron-bq-transfer-docker: cron/internal/bq/data-transfer.docker
|
|
|
|
cron/internal/bq/data-transfer.docker: cron/internal/bq/Dockerfile $(CRON_TRANSFER_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file cron/internal/bq/Dockerfile \
|
|
|
|
--tag $(IMAGE_NAME)-bq-transfer && \
|
|
|
|
touch cron/internal/bq/data-transfer.docker
|
|
|
|
|
2022-11-01 21:30:17 +03:00
|
|
|
build-attestor: ## Runs go build on scorecard attestor
|
|
|
|
# Run go build on scorecard attestor
|
|
|
|
cd attestor/; CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)' -o scorecard-attestor
|
|
|
|
|
✨ Commit depth feature (#2407)
* :seedling: Bump actions/dependency-review-action from 2.4.1 to 2.5.1
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2.4.1 to 2.5.1.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/9c96258789e5d9e85fe4ca86115ba4cc62b780cf...0efb1d1d84fc9633afcdaad14c485cbbc90ef46c)
---
updated-dependencies:
- dependency-name: actions/dependency-review-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* commit_depth feature
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* added more descriptive comments, changed numberofcommits variable name, moved paging for commits into seperate function.
small changes
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
linter
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* added unit tests
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
added test in e2e
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (#2397)
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.6.0 to 1.6.1.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.6.0...v1.6.1)
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/ginkgo/v2 from 2.1.6 to 2.4.0
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.1.6 to 2.4.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.1.6...v2.4.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump cloud.google.com/go/pubsub from 1.25.1 to 1.26.0
Bumps [cloud.google.com/go/pubsub](https://github.com/googleapis/google-cloud-go) from 1.25.1 to 1.26.0.
- [Release notes](https://github.com/googleapis/google-cloud-go/releases)
- [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md)
- [Commits](https://github.com/googleapis/google-cloud-go/compare/pubsub/v1.25.1...pubsub/v1.26.0)
---
updated-dependencies:
- dependency-name: cloud.google.com/go/pubsub
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/xanzy/go-gitlab from 0.73.1 to 0.74.0
Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.73.1 to 0.74.0.
- [Release notes](https://github.com/xanzy/go-gitlab/releases)
- [Changelog](https://github.com/xanzy/go-gitlab/blob/master/releases_test.go)
- [Commits](https://github.com/xanzy/go-gitlab/compare/v0.73.1...v0.74.0)
---
updated-dependencies:
- dependency-name: github.com/xanzy/go-gitlab
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/gomega from 1.20.2 to 1.23.0 (#2409)
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.20.2 to 1.23.0.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.20.2...v1.23.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/ginkgo/v2 from 2.1.6 to 2.4.0 in /tools
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.1.6 to 2.4.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.1.6...v2.4.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/golangci/golangci-lint in /tools
Bumps [github.com/golangci/golangci-lint](https://github.com/golangci/golangci-lint) from 1.50.0 to 1.50.1.
- [Release notes](https://github.com/golangci/golangci-lint/releases)
- [Changelog](https://github.com/golangci/golangci-lint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/golangci/golangci-lint/compare/v1.50.0...v1.50.1)
---
updated-dependencies:
- dependency-name: github.com/golangci/golangci-lint
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump goreleaser/goreleaser-action from 2.9.1 to 3.2.0 (#2363)
Bumps [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) from 2.9.1 to 3.2.0.
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](https://github.com/goreleaser/goreleaser-action/compare/b953231f81b8dfd023c58e0854a721e35037f28b...b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757)
---
updated-dependencies:
- dependency-name: goreleaser/goreleaser-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/goreleaser/goreleaser in /tools (#2373)
Bumps [github.com/goreleaser/goreleaser](https://github.com/goreleaser/goreleaser) from 1.11.5 to 1.12.3.
- [Release notes](https://github.com/goreleaser/goreleaser/releases)
- [Changelog](https://github.com/goreleaser/goreleaser/blob/main/.goreleaser.yaml)
- [Commits](https://github.com/goreleaser/goreleaser/compare/v1.11.5...v1.12.3)
---
updated-dependencies:
- dependency-name: github.com/goreleaser/goreleaser
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* ✨ CLI for scorecard-attestor (#2309)
* Reorganize
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Working commit
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Compile with local scorecard; go mod tidy
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add signing code
Heavily borrowed from https://github.com/grafeas/kritis/blob/master/cmd/kritis/signer/main.go
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Update deps
* Naming
* Makefile
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Edit license, add lint.yml
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* checks: go mod tidy, license
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Address PR comments
* Split into checker/signer files
* Naming convention
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* License, remove golangci.yml
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Address PR comments
* Use cobra
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add tests for root command
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Filter out checks that aren't needed for policy evaluation
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add `make` targets for attestor; submit coverage stats
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Improvements
* Use sclog instead of glog
* Remove unneeded subcommands
* Formatting
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Flags: Make note-name constant and fix messaging
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Remove SupportedRequestTypes
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* go mod tidy
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* go mod tidy, makefile
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Fix GH actions run
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* fix workflow (#2417)
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Bump scorecard-action (#2416)
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Fail unit-test job if codecov upload fails (#2415)
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* 🌱 Enable comparison for alternative isText implementation (#2414)
* use more performant IsText
Signed-off-by: Spencer Schrock <sschrock@google.com>
* AB test isText implementations
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add comparison env var to release test.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* go mod tidy for attestor
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* 🐛 modify alternative isText to accept carriage returns (#2421)
* modify IsText from golang.org/x/tools/godoc/util to accept carriage returns.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add TODO reminder to cleanup after release tests
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/gomega from 1.23.0 to 1.24.0
Bumps [github.com/onsi/gomega](https://github.com/onsi/gomega) from 1.23.0 to 1.24.0.
- [Release notes](https://github.com/onsi/gomega/releases)
- [Changelog](https://github.com/onsi/gomega/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/gomega/compare/v1.23.0...v1.24.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/gomega
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github/codeql-action from 2.1.29 to 2.1.30
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.29 to 2.1.30.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/ec3cf9c605b848da5f1e41e8452719eb1ccfb9a6...18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* revert failing unit-test on ci error (#2422)
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :sparkles: Improved Security Policy Check (#2195)
* :sparkles: Improved Security Policy Check (#2137)
* Examines and awards points for linked content (URLs / Emails)
* Examines and awards points for hints of disclosure and vulnerability practices
* Examines and awards points for hints of elaboration of timelines
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Repaired Security Policy to correctly use linked content length for evaluation
Signed-off-by: Scott Hissam <shissam@gmail.com>
* gofmt'ed changes
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Repaired the case in the evaluation which was too sensitive to content length over the length of the linked content for urls and emails
Signed-off-by: Scott Hissam <shissam@gmail.com>
* added unit test cases for the new content-based Security Policy checks
Signed-off-by: Scott Hissam <shissam@gmail.com>
* reverted the direct (mistaken) change to checks.md and updated the checks.yaml for generate-docs
Signed-off-by: Scott Hissam <shissam@gmail.com>
* :sparkles: Improved Security Policy Check (#2137) (revisted based on comments)
* replaced reason strings with log.Info & log.Warn (as seen in --show-details)
* internal assertion check for nil (*pinfo) and empty pfile
* internal switched to FileTypeText over FileTypeSource
* internal implement type SecurityPolicyInformationType/SecurityPolicyInformation revised SecurityPolicyData to support only one file
* revised expected unit-test results and revised unit-test to reflect the new SecurityPolicyData type
Signed-off-by: Scott Hissam <shissam@gmail.com>
* revised the score value based on observation of one *or more* url(s) or one email(s) found; unit tests update accordingly
Signed-off-by: Scott Hissam <shissam@gmail.com>
* revised the score value based on observation of one *or more* url(s) or one email(s) found; unit tests update accordingly
Signed-off-by: Scott Hissam <shissam@gmail.com>
* revised the score value based on observation of one *or more* url(s) or one email(s) found; e2e tests update accordingly
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Addressed PR comments; added telemetry for policy hits in security policy file to track hits by line number
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Resolved merge conflict with checks.yaml
Signed-off-by: Scott Hissam <shissam@gmail.com>
* updated raw results to emit all the raw information for the new security policy check
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Resolved merge conflicts and lint errors with json_raw_results.go
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Addressed review comments to reorganize security policy data struct to support the potential for multiple security policy files.
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Added logic to the security policy to process multiple security policy files only after future improvements to aggregating scoring across such files are designed. For now the security policy behaves as originally designed to stop once one of the expected policy files are found in the repo
Signed-off-by: Scott Hissam <shissam@gmail.com>
* added comments regarding the capacity to support multiple policy files and removed unneeded break statements in the code
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Addressed review comments to remove the dependency on the path in the filename from the code and introduced FileSize to checker.File type and removed the SecurityContentLength which was used to hold that information for the new security policy assessment
Signed-off-by: Scott Hissam <shissam@gmail.com>
* restored reporting full security policy path and filename for policies found in the org level repos
Signed-off-by: Scott Hissam <shissam@gmail.com>
* Resolved conflicts in checks.yaml for documentation
Signed-off-by: Scott Hissam <shissam@gmail.com>
* ✨ CLI for scorecard-attestor (#2309)
* Reorganize
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Working commit
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Compile with local scorecard; go mod tidy
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add signing code
Heavily borrowed from https://github.com/grafeas/kritis/blob/master/cmd/kritis/signer/main.go
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Update deps
* Naming
* Makefile
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Edit license, add lint.yml
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* checks: go mod tidy, license
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Address PR comments
* Split into checker/signer files
* Naming convention
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* License, remove golangci.yml
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Address PR comments
* Use cobra
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add tests for root command
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Filter out checks that aren't needed for policy evaluation
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Add `make` targets for attestor; submit coverage stats
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Improvements
* Use sclog instead of glog
* Remove unneeded subcommands
* Formatting
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Flags: Make note-name constant and fix messaging
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Remove SupportedRequestTypes
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* go mod tidy
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* go mod tidy, makefile
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Fix GH actions run
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Scott Hissam <shissam@gmail.com>
* removed whitespace before stanza for Run attestor e2e
Signed-off-by: Scott Hissam <shissam@gmail.com>
* resolved code review and doc review comments
Signed-off-by: Scott Hissam <shissam@gmail.com>
* repaired the link for the maintainer's guide for supporting the coordinated vulnerability disclosure guidelines
Signed-off-by: Scott Hissam <shissam@gmail.com>
Signed-off-by: Scott Hissam <shissam@gmail.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github/codeql-action from 2.1.30 to 2.1.31 (#2431)
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.30 to 2.1.31.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/18fe527fa8b29f134bb91f32f1a5dc5abb15ed7f...c3b6fce4ee2ca25bc1066aa3bf73962fda0e8898)
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* enable more performant isText (#2433)
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* modified tests,InitRepo Function, Added GetCommitDepth Function to Client Interface
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* removed getcommitdepth function
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* added TODO
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/ginkgo/v2 from 2.4.0 to 2.5.0 in /tools (#2436)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.4.0 to 2.5.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.4.0...v2.5.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/onsi/ginkgo/v2 from 2.4.0 to 2.5.0
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.4.0 to 2.5.0.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.4.0...v2.5.0)
---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* 🌱 Code Review: treat merging a PR as code review (#2413)
* Merges on Github count as a code review by the maintainer
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Update Raw Results
* More detailed information for Changesets
* If there's no Revision ID, use the Commit SHA instead
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
* Check that pull request had atleast one reviewer that wasn't its author
* Add field for Pull Request Merged-By to Github and Gitlab
* Note, this check can be bypassed if an author opens a PR with other
people's commits
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Trivial: Fix typo (exepted -> expected) (#2440)
Signed-off-by: Michael Scovetta <michael.scovetta@microsoft.com>
Signed-off-by: Michael Scovetta <michael.scovetta@microsoft.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump step-security/harden-runner from 1.5.0 to 2.0.0 (#2443)
Bumps [step-security/harden-runner](https://github.com/step-security/harden-runner) from 1.5.0 to 2.0.0.
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](https://github.com/step-security/harden-runner/compare/2e205a28d0e1da00c5f53b161f4067b052c61f34...ebacdc22ef6c2cfb85ee5ded8f2e640f4c776dd5)
---
updated-dependencies:
- dependency-name: step-security/harden-runner
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* 🌱 cron: support reading prefix from file for controller input files (7/n) (#2445)
* add prefix marker file to config
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Read the new config values, if they exist.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add function to fetch prefix file config value.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Read prefix file if prefix not set.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add tests to verify how List works with various prefixes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Add tests for getPrefix
Signed-off-by: Spencer Schrock <sschrock@google.com>
* Remove panics from iterator helper functions
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Detect SECURITY.markdown in addition to SECURITY.md (#2447)
GitHub probably supports many more file extensions for Markdown
files, but at the very least, `.md` and `.markdown` have been
standardized in RFC 7763.
Signed-off-by: favonia <favonia@gmail.com>
Signed-off-by: favonia <favonia@gmail.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Add Pinned-Dependency, Vulnerability, and Code-Review checks to attestor (#2430)
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: cron: expose the stackdriver prefix as a config variable so it can be changed. (#2446)
* Expose the stackdriver prefix as a config variable so it can be changed.
Signed-off-by: Caleb Brown <calebbrown@google.com>
* fix linter warning
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
Co-authored-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Only write to the rawBucket if the value exists. (#2451)
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump golang.org/x/tools from 0.2.0 to 0.3.0 (#2448)
* :seedling: Bump golang.org/x/tools from 0.2.0 to 0.3.0
Bumps [golang.org/x/tools](https://github.com/golang/tools) from 0.2.0 to 0.3.0.
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](https://github.com/golang/tools/compare/v0.2.0...v0.3.0)
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* bump attestor modules
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Move cron monitoring to a non-internal location. (#2453)
This allows external workers (e.g. criticality_score) to use the same
monitoring code.
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump actions/dependency-review-action from 2.5.1 to 3.0.0 (#2455)
Bumps [actions/dependency-review-action](https://github.com/actions/dependency-review-action) from 2.5.1 to 3.0.0.
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](https://github.com/actions/dependency-review-action/compare/0efb1d1d84fc9633afcdaad14c485cbbc90ef46c...30d582111533d59ab793fd9f971817241654f3ec)
---
updated-dependencies:
- dependency-name: actions/dependency-review-action
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* 🌱 [cron] generalize some of the transfer logic so it is easy to build new transfer agents (#2454)
* Generalize the transfer logic so it is easy to build new transfer agents
This change moves code that reads shards and produces summaries into the
data package so that it can be reused to create new transfer agents,
similar to the BigQuery transfer agent in cron/internal/bq.
Signed-off-by: Caleb Brown <calebbrown@google.com>
* Lint fix and commentary.
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/google/addlicense in /tools (#2459)
Bumps [github.com/google/addlicense](https://github.com/google/addlicense) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/google/addlicense/releases)
- [Changelog](https://github.com/google/addlicense/blob/master/.goreleaser.yaml)
- [Commits](https://github.com/google/addlicense/compare/v1.0.0...v1.1.0)
---
updated-dependencies:
- dependency-name: github.com/google/addlicense
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* :seedling: Bump github.com/google/go-containerregistry
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.12.0 to 0.12.1.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.12.0...v0.12.1)
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* go mod tidy
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* Added <= instead of == incase negative int is passed
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
* missed test fix
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: latortuga71 <christopheralonso1@gmail.com>
Signed-off-by: Raghav Kaul <raghavkaul@google.com>
Signed-off-by: Spencer Schrock <sschrock@google.com>
Signed-off-by: Scott Hissam <shissam@gmail.com>
Signed-off-by: Michael Scovetta <michael.scovetta@microsoft.com>
Signed-off-by: favonia <favonia@gmail.com>
Signed-off-by: Caleb Brown <calebbrown@google.com>
Signed-off-by: Latortuga <42878263+latortuga71@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: raghavkaul <8695110+raghavkaul@users.noreply.github.com>
Co-authored-by: Spencer Schrock <sschrock@google.com>
Co-authored-by: scott hissam <shissam@users.noreply.github.com>
Co-authored-by: Michael Scovetta <michael.scovetta@microsoft.com>
Co-authored-by: favonia <favonia@gmail.com>
Co-authored-by: Caleb Brown <calebbrown@google.com>
2022-11-22 19:11:36 +03:00
|
|
|
|
2022-11-18 03:49:06 +03:00
|
|
|
build-attestor-docker: ## Build scorecard-attestor Docker image
|
|
|
|
build-attestor-docker:
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file attestor/Dockerfile \
|
|
|
|
--tag scorecard-attestor:latest \
|
|
|
|
--tag scorecard-atttestor:$(GIT_HASH)
|
|
|
|
|
2022-09-24 22:58:50 +03:00
|
|
|
TOKEN_SERVER_DEPS = $(shell find clients/githubrepo/roundtripper/tokens/ -iname "*.go")
|
|
|
|
build-github-server: ## Build GitHub token server
|
|
|
|
build-github-server: clients/githubrepo/roundtripper/tokens/server/github-auth-server
|
|
|
|
clients/githubrepo/roundtripper/tokens/server/github-auth-server: $(TOKEN_SERVER_DEPS)
|
2021-10-15 06:03:51 +03:00
|
|
|
# Run go build on the GitHub auth server
|
|
|
|
cd clients/githubrepo/roundtripper/tokens/server && \
|
|
|
|
CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o github-auth-server
|
2022-09-24 22:58:50 +03:00
|
|
|
cron-github-server-docker: ## Build GitHub token server Docker image
|
|
|
|
cron-github-server-docker: clients/githubrepo/roundtripper/tokens/server/github-auth-server.docker
|
|
|
|
clients/githubrepo/roundtripper/tokens/server/github-auth-server.docker: \
|
|
|
|
clients/githubrepo/roundtripper/tokens/server/Dockerfile $(TOKEN_SERVER_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . \
|
|
|
|
--file clients/githubrepo/roundtripper/tokens/server/Dockerfile \
|
|
|
|
--tag ${IMAGE_NAME}-github-server && \
|
|
|
|
touch clients/githubrepo/roundtripper/tokens/server/github-auth-server.docker
|
|
|
|
|
2022-10-20 00:01:42 +03:00
|
|
|
CRON_WEBHOOK_DEPS = $(shell find cron/internal/webhook/ cron/data/ -iname "*.go")
|
2022-09-24 22:58:50 +03:00
|
|
|
build-webhook: ## Build cron webhook server
|
|
|
|
build-webhook: cron/internal/webhook/webhook
|
|
|
|
cron/internal/webhook/webhook: $(CRON_WEBHOOK_DEPS)
|
2021-08-11 04:45:01 +03:00
|
|
|
# Run go build on the cron webhook
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/webhook && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o webhook
|
2022-09-24 22:58:50 +03:00
|
|
|
cron-webhook-docker: ## Build cron webhook server Docker image
|
|
|
|
cron-webhook-docker: cron/internal/webhook/webhook.docker
|
|
|
|
cron/internal/webhook/webhook.docker: cron/internal/webhook/Dockerfile $(CRON_WEBHOOK_DEPS)
|
|
|
|
DOCKER_BUILDKIT=1 docker build . --file cron/internal/webhook/Dockerfile \
|
|
|
|
--tag ${IMAGE_NAME}-webhook && \
|
|
|
|
touch cron/internal/webhook/webhook.docker
|
|
|
|
|
2021-08-11 04:45:01 +03:00
|
|
|
|
2021-06-10 23:24:33 +03:00
|
|
|
build-add-script: ## Runs go build on the add script
|
2022-05-26 01:37:22 +03:00
|
|
|
build-add-script: cron/internal/data/add/add
|
2022-10-20 00:01:42 +03:00
|
|
|
cron/internal/data/add/add: cron/internal/data/add/*.go cron/data/*.go cron/internal/data/projects.csv
|
2021-06-10 23:24:33 +03:00
|
|
|
# Run go build on the add script
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/data/add && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o add
|
2021-06-10 23:24:33 +03:00
|
|
|
|
2021-06-09 02:55:43 +03:00
|
|
|
build-validate-script: ## Runs go build on the validate script
|
2022-05-26 01:37:22 +03:00
|
|
|
build-validate-script: cron/internal/data/validate/validate
|
2022-10-20 00:01:42 +03:00
|
|
|
cron/internal/data/validate/validate: cron/internal/data/validate/*.go cron/data/*.go cron/internal/data/projects.csv
|
2021-06-09 02:55:43 +03:00
|
|
|
# Run go build on the validate script
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/data/validate && CGO_ENABLED=0 go build -trimpath -a -ldflags '$(LDFLAGS)' -o validate
|
2021-06-09 02:55:43 +03:00
|
|
|
|
|
|
|
build-update-script: ## Runs go build on the update script
|
2022-05-26 01:37:22 +03:00
|
|
|
build-update-script: cron/internal/data/update/projects-update
|
2022-10-20 00:01:42 +03:00
|
|
|
cron/internal/data/update/projects-update: cron/internal/data/update/*.go cron/data/*.go
|
2021-06-09 02:55:43 +03:00
|
|
|
# Run go build on the update script
|
2022-05-26 01:37:22 +03:00
|
|
|
cd cron/internal/data/update && CGO_ENABLED=0 go build -trimpath -a -tags netgo -ldflags '$(LDFLAGS)' -o projects-update
|
2020-12-23 00:43:24 +03:00
|
|
|
|
2021-12-02 23:20:27 +03:00
|
|
|
docker-targets = scorecard-docker cron-controller-docker cron-worker-docker cron-cii-worker-docker cron-bq-transfer-docker cron-webhook-docker cron-github-server-docker
|
|
|
|
.PHONY: dockerbuild $(docker-targets)
|
|
|
|
dockerbuild: $(docker-targets)
|
|
|
|
|
|
|
|
cron-worker-docker:
|
2022-05-26 01:37:22 +03:00
|
|
|
DOCKER_BUILDKIT=1 docker build . --file cron/internal/worker/Dockerfile --tag $(IMAGE_NAME)-batch-worker
|
2021-05-15 23:58:01 +03:00
|
|
|
###############################################################################
|
2020-12-23 00:43:24 +03:00
|
|
|
|
2022-01-31 05:23:40 +03:00
|
|
|
##@ Tests
|
2021-05-15 23:58:01 +03:00
|
|
|
################################# make test ###################################
|
2022-11-30 21:22:00 +03:00
|
|
|
test-targets = unit-test e2e-pat e2e-gh-token ci-e2e
|
2021-05-15 23:58:01 +03:00
|
|
|
.PHONY: test $(test-targets)
|
|
|
|
test: $(test-targets)
|
2020-12-23 00:43:24 +03:00
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
unit-test: ## Runs unit test without e2e
|
|
|
|
# Run unit tests, ignoring e2e tests
|
2022-01-20 00:52:45 +03:00
|
|
|
# run the go tests and gen the file coverage-all used to do the integration with codecov
|
2023-03-08 01:26:58 +03:00
|
|
|
SKIP_GINKGO=1 go test -race -covermode=atomic -coverprofile=unit-coverage.out -coverpkg=./... `go list ./...`
|
2021-02-13 00:54:06 +03:00
|
|
|
|
2022-09-12 23:33:52 +03:00
|
|
|
unit-test-attestor: ## Runs unit tests on scorecard-attestor
|
2022-09-19 18:26:13 +03:00
|
|
|
cd attestor; SKIP_GINKGO=1 go test -covermode=atomic -coverprofile=unit-coverage.out `go list ./...`; cd ..;
|
2022-09-12 23:33:52 +03:00
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
check-env:
|
|
|
|
ifndef GITHUB_AUTH_TOKEN
|
|
|
|
$(error GITHUB_AUTH_TOKEN is undefined)
|
|
|
|
endif
|
2022-02-15 22:27:45 +03:00
|
|
|
|
2023-04-24 20:58:27 +03:00
|
|
|
check-env-gitlab:
|
|
|
|
ifndef GITLAB_AUTH_TOKEN
|
|
|
|
$(error GITLAB_AUTH_TOKEN is undefined)
|
|
|
|
endif
|
|
|
|
|
2022-04-12 03:35:44 +03:00
|
|
|
e2e-pat: ## Runs e2e tests. Requires GITHUB_AUTH_TOKEN env var to be set to GitHub personal access token
|
|
|
|
e2e-pat: build-scorecard check-env | $(GINKGO)
|
2022-02-15 22:27:45 +03:00
|
|
|
# Run e2e tests. GITHUB_AUTH_TOKEN with personal access token must be exported to run this
|
2022-09-19 18:26:13 +03:00
|
|
|
TOKEN_TYPE="PAT" $(GINKGO) --race -p -v -cover -coverprofile=e2e-coverage.out --keep-separate-coverprofiles ./...
|
2022-04-12 03:35:44 +03:00
|
|
|
|
|
|
|
e2e-gh-token: ## Runs e2e tests. Requires GITHUB_AUTH_TOKEN env var to be set to default GITHUB_TOKEN
|
|
|
|
e2e-gh-token: build-scorecard check-env | $(GINKGO)
|
|
|
|
# Run e2e tests. GITHUB_AUTH_TOKEN set to secrets.GITHUB_TOKEN must be used to run this.
|
2022-09-19 18:26:13 +03:00
|
|
|
TOKEN_TYPE="GITHUB_TOKEN" $(GINKGO) --race -p -v -cover -coverprofile=e2e-coverage.out --keep-separate-coverprofiles ./...
|
2022-11-01 21:30:17 +03:00
|
|
|
|
2023-03-13 18:13:50 +03:00
|
|
|
e2e-gitlab-token: ## Runs e2e tests that require a GITLAB_TOKEN
|
2023-04-24 20:58:27 +03:00
|
|
|
e2e-gitlab-token: build-scorecard check-env-gitlab | $(GINKGO)
|
|
|
|
TEST_GITLAB_EXTERNAL=1 TOKEN_TYPE="GITLAB_PAT" $(GINKGO) --race -p -vv --focus '.*GitLab' ./...
|
2023-03-13 18:13:50 +03:00
|
|
|
|
|
|
|
e2e-gitlab: ## Runs e2e tests for GitLab only. TOKEN_TYPE is not used (since these are public APIs), but must be set to something
|
2023-04-24 20:58:27 +03:00
|
|
|
e2e-gitlab: build-scorecard | $(GINKGO)
|
|
|
|
TEST_GITLAB_EXTERNAL=1 TOKEN_TYPE="PAT" $(GINKGO) --race -p -vv --focus ".*GitLab" ./...
|
2023-03-13 18:13:50 +03:00
|
|
|
|
2022-11-01 21:30:17 +03:00
|
|
|
e2e-attestor: ## Runs e2e tests for scorecard-attestor
|
|
|
|
cd attestor/e2e; go test -covermode=atomic -coverprofile=e2e-coverage.out; cd ../..
|
|
|
|
|
2021-05-15 23:58:01 +03:00
|
|
|
###############################################################################
|
2022-09-22 18:58:10 +03:00
|
|
|
|
|
|
|
##@ TODO(#744)
|
|
|
|
################################## make ko-images #############################
|
|
|
|
ko-targets = scorecard-ko cron-controller-ko cron-worker-ko cron-cii-worker-ko cron-bq-transfer-ko cron-webhook-ko cron-github-server-ko
|
|
|
|
.PHONY: ko-images $(ko-targets)
|
|
|
|
ko-images: $(ko-targets)
|
|
|
|
|
|
|
|
KOCACHE_PATH=/tmp/ko
|
|
|
|
|
|
|
|
$(KOCACHE_PATH):
|
|
|
|
mkdir -p $(KOCACHE_PATH)
|
|
|
|
|
|
|
|
scorecard-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/${IMAGE_NAME}
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KO_CACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4
|
|
|
|
|
|
|
|
cron-controller-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-batch-controller \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/cron/internal/controller
|
|
|
|
|
|
|
|
cron-worker-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-batch-worker \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/cron/internal/worker
|
|
|
|
|
|
|
|
cron-cii-worker-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-cii-worker \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM)\
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/cron/internal/cii
|
|
|
|
|
|
|
|
cron-bq-transfer-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-bq-transfer \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/cron/internal/bq
|
|
|
|
|
|
|
|
cron-webhook-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-cron-webhook \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/cron/internal/webhook
|
|
|
|
|
|
|
|
cron-github-server-ko: | $(KO) $(KOCACHE_PATH)
|
|
|
|
KO_DATA_DATE_EPOCH=$(SOURCE_DATE_EPOCH) \
|
|
|
|
KO_DOCKER_REPO=${KO_PREFIX}/$(IMAGE_NAME)-github-server \
|
|
|
|
LDFLAGS="$(LDFLAGS)" \
|
|
|
|
KOCACHE=$(KOCACHE_PATH) \
|
|
|
|
$(KO) build -B \
|
|
|
|
--push=false \
|
|
|
|
--sbom=none \
|
|
|
|
--platform=$(PLATFORM) \
|
|
|
|
--tags latest,$(GIT_VERSION),$(GIT_HASH) \
|
|
|
|
github.com/ossf/scorecard/v4/clients/githubrepo/roundtripper/tokens/server
|
|
|
|
|
2023-04-24 20:58:27 +03:00
|
|
|
###############################################################################
|