Commit Graph

123 Commits

Author SHA1 Message Date
laurentsimon
8c97d46a36
Add custom remediation for workflow permissions/pinned dependencies (#1885)
* draft

* update

* updates

* updates

* updates

* updates

* updates

* updates
2022-05-06 12:52:30 -07:00
naveensrinivasan
2cb654102d ⚠️ Removing the pass field from result (#1853)
- Removing the pass field from result
    - https://github.com/ossf/scorecard/issues/1393

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2022-05-03 11:17:47 -05:00
laurentsimon
05d8c01b1c
🐛 Don't look for secrets in pull_request (#1864)
* Remove pull_request

* updates

* updates

* linter and e2e
2022-04-26 18:27:29 -07:00
laurentsimon
ac88460c75
Raw results for best practices badge (#1795)
* Raw results for best practices badge

* updates

* updates

* tests

* comment
2022-04-25 17:04:21 +00:00
laurentsimon
4622952c85
Raw results for dangerous workflow (#1849)
* draft

* update

* update

* updates

* comments

* comments

* comments
2022-04-21 22:02:18 +00:00
laurentsimon
4d1c531690
Raw results for license (#1790)
* Raw results for license

* tests

* tests

* e2e fix

* comment

* fix

* linter
2022-04-13 18:20:05 -07:00
laurentsimon
27dbf9c7e5
Raw results for Signed-Release check (#1789)
* Raw results for Signed-Releases

* updates

* linter
2022-04-01 23:13:58 +00:00
laurentsimon
037a3f3516
Raw result for Maintained check (#1780)
* draft

* draft

* raw results for Maintained check

* updates

* updates

* missing files

* updates

* unit tests

* e2e tests

* tests

* linter

* updates
2022-03-29 16:35:42 +00:00
laurentsimon
8150ab0f88
Make Vuln ID field lower case in raw results (#1761)
* case sensitive ID

* updates
2022-03-25 00:24:23 +00:00
dependabot[bot]
66b3d8ce5c
🌱 Bump github.com/golangci/golangci-lint from 1.44.2 to 1.45.0 in /tools (#1757)
* 🌱 Bump github.com/golangci/golangci-lint in /tools

Bumps [github.com/golangci/golangci-lint](https://github.com/golangci/golangci-lint) from 1.44.2 to 1.45.0.
- [Release notes](https://github.com/golangci/golangci-lint/releases)
- [Changelog](https://github.com/golangci/golangci-lint/blob/master/CHANGELOG.md)
- [Commits](https://github.com/golangci/golangci-lint/compare/v1.44.2...v1.45.0)

---
updated-dependencies:
- dependency-name: github.com/golangci/golangci-lint
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* golangci-lint: Surface and fix as many lint warnings automatically

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* generated: Run golangci-lint with `fix: true`

Signed-off-by: Stephen Augustus <foo@auggie.dev>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Stephen Augustus <foo@auggie.dev>
2022-03-23 02:23:39 +00:00
laurentsimon
1094680a0f
🐛 Fix schemas from https://github.com/ossf/scorecard/pull/1758 (#1760)
* Fix schemas

* updates

* updates
2022-03-21 21:03:26 +00:00
laurentsimon
ee623e5445
Add schema for the raw JSON (#1758) 2022-03-21 13:08:50 -07:00
laurentsimon
b1ab16e80f
Add raw results to cron scans (#1741)
* draft

* updates

* updates

* updates

* updates

* updates

* comments

* comments

* comments

* comments

* comments

* comments
2022-03-18 19:05:14 -07:00
laurentsimon
d192c8e3ac
Add score to SARIF for all results (#1694)
* add score

* fix unit tests
2022-03-02 17:06:47 -08:00
Naveen
ddb0fe3f31
Changed jsonScorecardResultV2 type Public (#1682)
*  Changed jsonScorecardResultV2 type Public

- Fixes https://github.com/ossf/scorecard/issues/1673

* Update pkg/json.go

Co-authored-by: Stephen Augustus (he/him) <justaugustus@users.noreply.github.com>

* Fixed the govet warning by including nolint

Fixed the govet linter warning by including  nolint.

Co-authored-by: Stephen Augustus (he/him) <justaugustus@users.noreply.github.com>
2022-02-28 15:20:07 -05:00
Stephen Augustus (he/him)
7956ff4fe7
Miscellaneous refactors to ease downstream consumption (#1645)
* checker: Add `NewLogger` constructor for `DetailLogger` impl
* checker: Add `NewRunner` constructor for `Runner`
* cmd: Update to use refactored packages
* cmd: Move command flags and validation into an `options` package
* cmd: Move client accessors to `githubrepo` package
* cmd: Move policy and enabled checks to `policy` package
* cmd: Move results formatting to `format` package
* checker: Prefer `Set` prefixes for setters
* checker: Use `DetailLogger` return value for `NewLogger()`
* checker: Add `GetClients` accessor
* Move `FormatResults` to `pkg/`
* checks: Add getter for all checks

Signed-off-by: Stephen Augustus <foo@auggie.dev>
2022-02-27 02:09:21 +00:00
Azeem Shaikh
2b206dc365
Remove Version field from LogMessage (#1640)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2022-02-15 18:26:06 +00:00
Azeem Shaikh
2e3e505a8c
Simplify DetailLogger interface (#1628)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2022-02-11 15:48:58 -08:00
Azeem Shaikh
6930c3ab3b
Add support for commit-based Scorecard (#1613)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2022-02-07 19:03:36 -08:00
laurentsimon
9037444513
Raw data for code review check (#1505)
* separate code review's eval and check

* missing file

* add comments

* fix

* fix

* linter

* fixes

* fix

* linter

* linter

* linter

* draft

* fixes

* fixes

* simplify

* update date

* rem comments

* typo

* linter

* typo

* linter
2022-02-02 19:51:38 +00:00
laurentsimon
0670b8bdee
pkg/sarif.go: Add score in message (#1593)
pkg/testdata/check6.sarif: Update message
2022-02-02 18:30:04 +00:00
dependabot[bot]
bd2171b53a
🌱 Bump github.com/golangci/golangci-lint from 1.42.1 to 1.44.0 in /tools (#1540) 2022-01-27 02:56:56 +00:00
laurentsimon
5f9fff3b20
Separate check from policies for the Vulnerabilities check (#1532)
* raw vulnerabilities seperation
* update year
* missing files
* tests
2022-01-26 15:45:39 -05:00
Stephen Augustus (he/him)
13b78ab010
⚠️ Create a dedicated logging package to encapsulate calls to zap (#1502)
* log: Init log package

Creates a wrapper around existing `zap.Logger` to make it easier
to replace/extend with scorecard logging.

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* log: Replace instances of `zap.Logger` with `log.Logger`

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* log: Add logic to parse `zapcore.Level`s as strings

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* log: Express log levels

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* log: Replace instances of `zapcore.Level` with `log.Level`

Signed-off-by: Stephen Augustus <foo@auggie.dev>

* log: Fixup comments for exported functions

Signed-off-by: Stephen Augustus <foo@auggie.dev>
2022-01-20 15:57:39 -08:00
Azeem Shaikh
f2c57d2590 Migrate to v4 2022-01-12 14:12:09 -06:00
laurentsimon
460d34aa2d
Change filename when no file is available (#1445)
* change filename when no file is available

* fixes

* e2e tests

* update message

* comment
2022-01-11 23:29:47 +00:00
laurentsimon
b79b3c357c
Add startLine to sarif for binary files (#1458)
* add line to sarif

* remove comments
2022-01-10 17:48:20 -08:00
laurentsimon
e2d3e8e1a5
inconclusive results should not be reported (#1443) 2022-01-06 20:40:16 +00:00
laurentsimon
7a91384f8d
Add line numbers for insecure downloads (#1413)
* add lines for docker files

* support for other constructs

* other insecure patterns

* fixes

* fixes

* comments
2022-01-06 00:13:53 +00:00
naveen
25cfdb7b13 Fixed the long lines 2022-01-04 13:55:58 -06:00
naveen
de39061cc5 🌱 Refactor vulnerabilities client 2022-01-04 13:55:58 -06:00
laurentsimon
cf71c9539c
Add details to message for default location in SARIF (#1414)
* add details to message

* fix
2021-12-23 19:06:02 +00:00
laurentsimon
3d9b1d2900
[RAW] Branch Protection support (#1396)
* raw bp

* missing files

* context never nil

* support raw bp

* unit tests

* remove comments

* merging

* linter
2021-12-16 21:42:05 +00:00
laurentsimon
f2cee41ca9
[RAW]: dependency update tool (#1391)
* dependency update tool

* rename

* missing files

* add fields

* rm field
2021-12-15 17:02:31 +00:00
laurentsimon
46e94eb925
[DRAFT: RAW]: Security policy support (#1372)
* raw sec policy

* missing file

* fix validation of check.yml

* updates

* comments

* dea code

* comments
2021-12-14 23:51:42 +00:00
laurentsimon
551961718d
[RAW] End-to-end support for raw results for Binary-Artifacts (#1255)
* split binary artifact check

* fix

* missing file

* comments

* fix

* comments

* draft

* merge fix

* fix merge

* add indirection

* comments

* comments

* linter

* comments

* updates

* updates

* updates

* linter

* comments
2021-12-14 21:10:24 +00:00
laurentsimon
ca97581538
Comply with GH-specific rules for SARIF (#1379)
* GH-specific validation rules

* fix

* fix
2021-12-14 01:47:57 +00:00
laurentsimon
86fd966dc4
Don't use the policy filename in SARIF results (#1373)
* don't display a policy file

* fix utests

* update msg

* update test
2021-12-10 17:07:32 -08:00
Azeem Shaikh
2375ae2812
Add a OssFuzzRepoClient (#1280)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-11-17 03:04:37 +00:00
Azeem Shaikh
6223b6620a
Add CIIClient interface (#1262)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-11-15 02:46:41 +00:00
Eng Zer Jun
177502552a
🌱 Move from io/ioutil to io and os packages (#1250)
The io/ioutil package has been deprecated as of Go 1.16, see
https://golang.org/doc/go1.16#ioutil. This commit replaces the existing
io/ioutil functions with their new definitions in io and os packages.

Signed-off-by: Eng Zer Jun <zerjun@eta-hd.com>

Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
2021-11-12 19:34:46 +00:00
laurentsimon
929fd6e9e4
deterministic sarif gen (#1233) 2021-11-10 16:33:21 +00:00
laurentsimon
09b7b3bd3d
Pull request support for GitHub action (#1222)
* draft

* updates

* PR support

* comments

* comment

* category

* fix rule ID

* typo

* always populate rules

* typo
2021-11-08 23:30:37 +00:00
laurentsimon
8805ac54d0
Add --local option to CLI (#1211)
* unit tests

* remove log

* fix

* gate local access

* comment
2021-11-03 15:17:58 +00:00
laurentsimon
a6d298a60a
Use checks.yaml to store which repo types are supported by each check (#1195)
* draft

* draft 2

* remove enum

* update

* mock doc

* fix
2021-11-02 01:43:22 +00:00
Azeem Shaikh
83649a799e
Remove repos package (#1191)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-10-29 16:07:46 +00:00
Azeem Shaikh
138552848d
Remove Repo CPU runtime stat logging (#1186)
Co-authored-by: Azeem Shaikh <azeems@google.com>
2021-10-29 04:37:44 +00:00
Azeem Shaikh
c73c5628ea
Fix GitHub workflows failing (#1172)
Co-authored-by: Azeem Shaikh <azeems@google.com>
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
2021-10-28 18:42:55 +00:00
laurentsimon
4cca9b4960
Implement local repo client for local folders (#1146)
* draft

* draft

* docker file

* error

* fix

* fix

* bug

* comments

* missing merge

* fix

* merge issue

* fix

* validate format early

* comments

* fix

* fixes

* uncomment

* gate code for v4 code

* draft

* draft 2

* fix security-policy check

* fix

* merge fixes

* fixes

* fixes

* fixes

* fixes

* mock repo

* linter

* comments

* unit tests

* comments
2021-10-28 18:30:02 +00:00
laurentsimon
950e0e3d2d
Add support for file-based repo URIs (#1113)
* draft

* draft

* docker file

* error

* fix

* fix

* fixa

* bug

* comments

* missing merge

* fix

* fix rebase

* merge issue

* fix

* validate format early

* fix

* fix2

* comments

* fix
2021-10-21 20:08:56 +00:00