mirror of
https://github.com/ossf/scorecard.git
synced 2024-09-11 17:07:53 +03:00
🐛 Support renamed gradle verification action and callers which pin to hash (#4097)
* Support renamed gradle verification action From gradle/wrapper-validation-action's readme: "As of v3 this action has been superceded by gradle/actions/wrapper-validation" Also support actions pinned to a hash. Signed-off-by: Spencer Schrock <sschrock@google.com> * remove unneeded dependency Signed-off-by: Spencer Schrock <sschrock@google.com> --------- Signed-off-by: Spencer Schrock <sschrock@google.com>
This commit is contained in:
parent
f8422929cc
commit
7ce8609469
@ -19,11 +19,9 @@ import (
|
|||||||
"fmt"
|
"fmt"
|
||||||
"io"
|
"io"
|
||||||
"path/filepath"
|
"path/filepath"
|
||||||
"regexp"
|
|
||||||
"strings"
|
"strings"
|
||||||
"unicode/utf8"
|
"unicode/utf8"
|
||||||
|
|
||||||
semver "github.com/Masterminds/semver/v3"
|
|
||||||
"github.com/h2non/filetype"
|
"github.com/h2non/filetype"
|
||||||
"github.com/h2non/filetype/types"
|
"github.com/h2non/filetype/types"
|
||||||
"github.com/rhysd/actionlint"
|
"github.com/rhysd/actionlint"
|
||||||
@ -35,23 +33,9 @@ import (
|
|||||||
"github.com/ossf/scorecard/v5/finding"
|
"github.com/ossf/scorecard/v5/finding"
|
||||||
)
|
)
|
||||||
|
|
||||||
var (
|
|
||||||
gradleWrapperValidationActionRegex = regexp.MustCompile(`^gradle\/wrapper-validation-action@v?(.+)$`)
|
|
||||||
gradleWrapperValidationActionVersionConstraint = mustParseConstraint(`>= 1.0.0`)
|
|
||||||
)
|
|
||||||
|
|
||||||
// how many bytes are considered when determining if a file is text or binary.
|
// how many bytes are considered when determining if a file is text or binary.
|
||||||
const binaryTestLen = 1024
|
const binaryTestLen = 1024
|
||||||
|
|
||||||
// mustParseConstraint attempts parse of semver constraint, panics if fail.
|
|
||||||
func mustParseConstraint(c string) *semver.Constraints {
|
|
||||||
if c, err := semver.NewConstraint(c); err != nil {
|
|
||||||
panic(fmt.Errorf("failed to parse constraint: %w", err))
|
|
||||||
} else {
|
|
||||||
return c
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
// BinaryArtifacts retrieves the raw data for the Binary-Artifacts check.
|
// BinaryArtifacts retrieves the raw data for the Binary-Artifacts check.
|
||||||
func BinaryArtifacts(req *checker.CheckRequest) (checker.BinaryArtifactData, error) {
|
func BinaryArtifacts(req *checker.CheckRequest) (checker.BinaryArtifactData, error) {
|
||||||
c := req.RepoClient
|
c := req.RepoClient
|
||||||
@ -266,18 +250,8 @@ func checkWorkflowValidatesGradleWrapper(path string, content []byte, args ...in
|
|||||||
if ea.Uses == nil {
|
if ea.Uses == nil {
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
sms := gradleWrapperValidationActionRegex.FindStringSubmatch(ea.Uses.Value)
|
if strings.HasPrefix(ea.Uses.Value, "gradle/wrapper-validation-action@") ||
|
||||||
if len(sms) > 1 {
|
strings.HasPrefix(ea.Uses.Value, "gradle/actions/wrapper-validation@") {
|
||||||
v, err := semver.NewVersion(sms[1])
|
|
||||||
if err != nil {
|
|
||||||
// Couldn't parse version, hopefully another step has
|
|
||||||
// a correct one.
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
if !gradleWrapperValidationActionVersionConstraint.Check(v) {
|
|
||||||
// Version out of acceptable range.
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
// OK! This is it.
|
// OK! This is it.
|
||||||
*validatingWorkflowFile = filepath.Base(path)
|
*validatingWorkflowFile = filepath.Base(path)
|
||||||
return false, nil
|
return false, nil
|
||||||
|
@ -164,13 +164,26 @@ func TestBinaryArtifacts(t *testing.T) {
|
|||||||
expect: 1,
|
expect: 1,
|
||||||
},
|
},
|
||||||
{
|
{
|
||||||
name: "gradle-wrapper.jar with outdated verification action",
|
name: "gradle-wrapper.jar with new verification action",
|
||||||
err: nil,
|
err: nil,
|
||||||
files: [][]string{
|
files: [][]string{
|
||||||
{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
|
{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
|
||||||
{
|
{
|
||||||
"../testdata/binaryartifacts/workflows/nonverify.yaml",
|
"../testdata/binaryartifacts/workflows/nonverify.yaml",
|
||||||
"../testdata/binaryartifacts/workflows/verify-outdated-action.yaml",
|
"../testdata/binaryartifacts/workflows/verify-new-gradle-name.yaml",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
successfulWorkflowRuns: []clients.WorkflowRun{
|
||||||
|
{
|
||||||
|
HeadSHA: strptr("sha-a"),
|
||||||
|
},
|
||||||
|
},
|
||||||
|
commits: []clients.Commit{
|
||||||
|
{
|
||||||
|
SHA: "sha-a",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
SHA: "sha-old",
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
getFileContentCount: 3,
|
getFileContentCount: 3,
|
||||||
|
@ -6,7 +6,6 @@ jobs:
|
|||||||
name: "GW Validate Job"
|
name: "GW Validate Job"
|
||||||
runs-on: ubuntu-latest
|
runs-on: ubuntu-latest
|
||||||
steps:
|
steps:
|
||||||
- uses: actions/checkout@v2
|
- uses: actions/checkout@v4
|
||||||
- name: GW Validate Step
|
- name: GW Validate Step
|
||||||
# this is a made-up outdated version of the action:
|
uses: gradle/actions/wrapper-validation@v3
|
||||||
uses: gradle/wrapper-validation-action@v0.1.0
|
|
1
go.mod
1
go.mod
@ -39,7 +39,6 @@ require (
|
|||||||
)
|
)
|
||||||
|
|
||||||
require (
|
require (
|
||||||
github.com/Masterminds/semver/v3 v3.2.1
|
|
||||||
github.com/caarlos0/env/v6 v6.10.0
|
github.com/caarlos0/env/v6 v6.10.0
|
||||||
github.com/gobwas/glob v0.2.3
|
github.com/gobwas/glob v0.2.3
|
||||||
github.com/google/go-github/v53 v53.2.0
|
github.com/google/go-github/v53 v53.2.0
|
||||||
|
2
go.sum
2
go.sum
@ -89,8 +89,6 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
|
|||||||
github.com/CycloneDX/cyclonedx-go v0.8.0 h1:FyWVj6x6hoJrui5uRQdYZcSievw3Z32Z88uYzG/0D6M=
|
github.com/CycloneDX/cyclonedx-go v0.8.0 h1:FyWVj6x6hoJrui5uRQdYZcSievw3Z32Z88uYzG/0D6M=
|
||||||
github.com/CycloneDX/cyclonedx-go v0.8.0/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
|
github.com/CycloneDX/cyclonedx-go v0.8.0/go.mod h1:K2bA+324+Og0X84fA8HhN2X066K7Bxz4rpMQ4ZhjtSk=
|
||||||
github.com/GoogleCloudPlatform/k8s-cloud-provider v0.0.0-20190822182118-27a4ced34534/go.mod h1:iroGtC8B3tQiqtds1l+mgk/BBOrxbqjH+eUfFQYRc14=
|
github.com/GoogleCloudPlatform/k8s-cloud-provider v0.0.0-20190822182118-27a4ced34534/go.mod h1:iroGtC8B3tQiqtds1l+mgk/BBOrxbqjH+eUfFQYRc14=
|
||||||
github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
|
|
||||||
github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
|
|
||||||
github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
|
github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
|
||||||
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
|
github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
|
||||||
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
|
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
|
||||||
|
Loading…
Reference in New Issue
Block a user