ossf/scorecard
1
1
Fork 0
mirror of https://github.com/ossf/scorecard.git synced 2024-09-17 11:57:12 +03:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity
1,382 Commits 36 Branches 42 Tags 436 MiB
3b7c46f779
Commit Graph

35 Commits

Author SHA1 Message Date
laurentsimon
27dbf9c7e5
✨ Raw results for Signed-Release check (#1789) 
* Raw results for Signed-Releases

* updates

* linter
 2022-04-01 23:13:58 +00:00
Azeem Shaikh
2b206dc365
Remove Version field from LogMessage (#1640) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2022-02-15 18:26:06 +00:00
Azeem Shaikh
2e3e505a8c
Simplify DetailLogger interface (#1628) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2022-02-11 15:48:58 -08:00
Azeem Shaikh
1c95237e4a
Only run allowed checks in different modes (#1579) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2022-02-07 16:49:49 -08:00
naveen
f7b329e830 ✨ Unit test for all_checks 
Addresses https://github.com/ossf/scorecard/issues/435

Signed-off-by: naveen <172697+naveensrinivasan@users.noreply.github.com>
 2022-01-12 17:24:38 -06:00
Azeem Shaikh
f2c57d2590 ✨ Migrate to v4 2022-01-12 14:12:09 -06:00
Evgeny Vereshchagin
9d2976592f
Signed-Releases: really look for *.sign files (#1298) 
With this patch applied projects like dracut pass the check:
```
  "checks": [
    {
      "details": [
        "Debug: GitHub release found: 055",
        "Info: signed release artifact: dracut-055.tar.sign: https://api.github.com/repos/dracutdevs/dracut/releases/assets/37635937",
        "Debug: GitHub release found: 054",
        "Info: signed release artifact: dracut-054.tar.sign: https://api.github.com/repos/dracutdevs/dracut/releases/assets/36958052",
        "Debug: GitHub release found: 053",
        "Info: signed release artifact: dracut-053.tar.sign: https://api.github.com/repos/dracutdevs/dracut/releases/assets/32484038",
        "Debug: GitHub release found: 052",
        "Info: signed release artifact: dracut-052.tar.sign: https://api.github.com/repos/dracutdevs/dracut/releases/assets/32130796",
        "Debug: GitHub release found: 051",
        "Info: signed release artifact: dracut-051.tar.sign: https://api.github.com/repos/dracutdevs/dracut/releases/assets/31933850"
      ],
      "score": 10,
      "reason": "5 out of 5 artifacts are signed -- score normalized to 10",
      "name": "Signed-Releases",
```
 2021-11-20 00:55:08 +00:00
Naveen
6c1c789dc5
🌱 v3 upgrade changes (#1118) 
v3 go.mod changes
 2021-10-07 18:16:01 -05:00
Azeem Shaikh
e730e911e6
sce.Create -> sce.WithMessage for wrapcheck (#995) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-09-10 15:50:33 +00:00
Azeem Shaikh
d6ba2cd6ac
Fix #890 (#938) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-08-30 20:26:11 -07:00
Azeem Shaikh
e305a94e4f
Use ListReleases API for BranchProtection check (#937) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-08-30 17:52:08 -07:00
laurentsimon
6403eb1382
✨ Transition Packaging, SAST, Security-policy, Signed-releases check to the new structured detail format (#887) 
* move checks to new format

* fix

* comments

* fix

* comments
 2021-08-24 01:44:06 +00:00
Azeem Shaikh
3f9431d08c
Update SignedReleases to use RepoClient API (#844) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-08-12 20:46:06 +00:00
laurentsimon
b2b37161f3
✨ Improve token permission check (#800) 
* draft

* draft 2

* draft3

* fix e2e

* comment

* comment

* check codeql

* missing files

* comments

* nit

* update msg

* msg

* nit

* nit

* msg

* e2e

* update doc
 2021-08-03 00:56:45 +00:00
Azeem Shaikh
83e9f52501
Enable revive linters which are used in google3 (#793) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-07-31 22:31:34 +00:00
Naveen
4d7fb5d748
🌱 Fix the go.mod with v2 upgrade (#716) 
The go.mod and the related files weren't t updated with the v2 upgrade.

https://github.com/ossf/scorecard/issues/711

This fix will address the issue.
 2021-07-26 13:01:25 -05:00
laurentsimon
ae33db624e
✨ [migration to score] 6: signed tags, signed release, PR, fuzzing (#732) 
* yaml file

* sort checks

* comments

* signed tags

* signed release, PR, fuzzing

* typo
 2021-07-21 18:10:47 -07:00
dependabot[bot]
5dd7f118ae
🌱 Bump github.com/golangci/golangci-lint from 1.40.1 to 1.41.1 (#627) 
Bumps [github.com/golangci/golangci-lint](https://github.com/golangci/golangci-lint) from 1.40.1 to 1.41.1.
- [Release notes](https://github.com/golangci/golangci-lint/releases)
- [Changelog](https://github.com/golangci/golangci-lint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/golangci/golangci-lint/compare/v1.40.1...v1.41.1)

---
updated-dependencies:
- dependency-name: github.com/golangci/golangci-lint
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: Azeem Shaikh <azeems@google.com>
Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
Co-authored-by: Naveen <172697+naveensrinivasan@users.noreply.github.com>
 2021-06-29 10:26:16 -07:00
Azeem Shaikh
be8aa3d713
Export registered check names (#518) 
Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-05-27 14:54:34 -07:00
Chris McGehee
6b63f3f963
🌱 Fix lint issues: Replace golint with revive (#493) 
* Fix lint issues: Replace golint with revive
golint is deprecated and recommended to be replaced with revive

* Updating comments to be more accurate

* Updating comments again

Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
 2021-05-24 11:34:33 -07:00
Chris McGehee
61ecad3151
Add new linter: gci (#498) 2021-05-23 20:51:52 -07:00
Chris McGehee
2e7a71fbf2
Fix lint issues: goerr113 linter (#491) 
Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com>
 2021-05-22 12:36:47 -07:00
Chris McGehee
50f7ed8519
🌱Fix lint issues: gochecknoinits linter (#485) 
* Fix lint issues: gochecknoinits linter

* Fix lint issues: gochecknoinits linter
 2021-05-22 13:19:52 -04:00
Abhishek Arya
5f82d2b9c0
✨ Add checks for workflow action pinning (#466) 
Patch by Laurent Simon <laurentsimon@google.com>

Co-authored-by: Laurent Simon <laurentsimon@google.com>
 2021-05-17 13:03:39 -07:00
Chris McGehee
06993b72ce
🐛 Fix linting issues (1 of n) (#348) 
* Fix lint issues: whitespace linter

* Fix lint issues: wrapcheck linter

* Fix lint issues: errcheck linter

* Fix lint issues: paralleltest linter

* Fix lint issues: gocritic linter
Most changes from this commit are from passing checker.CheckResult by reference and not by value. gocritic identified that as a huge parameter.
gocritic also prefers regexp.MustCompile over Compile when the pattern is a const
 2021-04-19 12:18:34 -07:00
Azeem Shaikh
a58818d258
🌱 : Reduce code duplication for follow-up cron refactoring (#338) 
* ✨ Refactor to reduce code duplication

* ✨

* Move lib/ back to checker/

* Move lib/ back to checker/

* Move lib/ back to checker/

* Address PR comments.

* Addressing PR comments.

* Avoid printing `ShouldRetry` and `Error` in output JSON.

* Fix JSON output.

Co-authored-by: Azeem Shaikh <azeems@google.com>
 2021-04-10 07:26:56 -05:00
Cameron Moore
88d521821c
Use release tag name instead of name in log messages 
Use the release TagName instead of Name when reporting found releases.
An example of the problem using Name:

$ go run . --repo=github.com/magefile/mage --show-details --checks=Signed-Releases
Starting [Signed-Releases]
Finished [Signed-Releases]

RESULTS
-------
Signed-Releases: Fail 10
    release found: Colors, working directory, some better errors
    !! release Colors, working directory, some better errors has no signed artifacts
    release found: Modules and go1.13 Fixes
    !! release Modules and go1.13 Fixes has no signed artifacts
    release found: v1.8.0 - Papercuts and Bug Fixes
    !! release v1.8.0 - Papercuts and Bug Fixes has no signed artifacts
    release found: v1.7.1
    !! release v1.7.1 has no signed artifacts
    release found: v1.7.0 Mage Imports
    !! release v1.7.0 Mage Imports has no signed artifacts
    release found: v1.6.2 Bug Fixes
    !! release v1.6.2 Bug Fixes has no signed artifacts
    found signed artifacts for 0 out of 6 releases

With this commit:

Signed-Releases: Fail 10
    release found: v1.10.0
    !! release v1.10.0 has no signed artifacts
    release found: v1.9.0
    !! release v1.9.0 has no signed artifacts
    release found: v1.8.0
    !! release v1.8.0 has no signed artifacts
    release found: v1.7.1
    !! release v1.7.1 has no signed artifacts
    release found: v1.7.0
    !! release v1.7.0 has no signed artifacts
    release found: v1.6.2
    !! release v1.6.2 has no signed artifacts
    found signed artifacts for 0 out of 6 releases
 2020-12-23 15:32:40 -06:00
Cameron Moore
ac55575713 Adjust details logging on a few checks 
Log positive results in Pull-Requests and update log messages in
Signed-Releases and Signed-Tags.
 2020-12-20 16:12:31 -06:00
Cameron Moore
348bedb0bf Show negative results in Signed-Releases details 
Negative results logged with a "!!" prefix.

Updates #95

$ go run . --repo=github.com/gohugoio/hugo --show-details --checks=Signed-Releases
Starting [Signed-Releases]
Finished [Signed-Releases]

RESULTS
-------
Signed-Releases: Fail 10
    release found: v0.79.1
    !! release v0.79.1 has no signed artifacts
    release found: v0.79.0
    !! release v0.79.0 has no signed artifacts
    release found: v0.78.2
    !! release v0.78.2 has no signed artifacts
    release found: v0.78.1
    !! release v0.78.1 has no signed artifacts
    release found: v0.78.0
    !! release v0.78.0 has no signed artifacts
    release found: v0.77.0
    !! release v0.77.0 has no signed artifacts
    found signed artifacts for 0 of 6 releases
 2020-12-20 14:32:16 -06:00
Abhishek Arya
f05d75cc1a Add log message when regular release is found. 2020-11-24 06:50:52 -08:00
Dan Lorenc
9f686dc707 Rename repo/modules. 2020-10-27 14:23:48 -05:00
Abhishek Arya
81eab9d2d8
Add license header and code of conduct files. (#34) 
* Add license header and code of conduct files.

* Fill missing field.
 2020-10-26 15:22:13 -05:00
Abhishek Arya
6c790d84da Add some missing detail messages, improve others. 2020-10-24 10:20:49 -07:00
Abhishek Arya
2ceadcd253
Fixes for signed releases. (#16) 
* Fixes for signed releases.

* Fmt.
 2020-10-16 15:09:20 -05:00
Abhishek Arya
6e5ce52cae
Fix filenames to match check names, remove unneeded repos.txt. (#15) 
* Fix filenames to match check names, remove unneeded repos.txt.

* Fix conflict.

* Minor fix.
 2020-10-16 13:22:28 -05:00