Commit Graph

2450 Commits

Author SHA1 Message Date
Spencer Schrock
69bb742f12
🐛 Dependency-Update-Tool: ignore search commit data for repo clients which dont support it (#3756)
The primary data is the configuration files and the search commit data
is just extra, so better to return some data than no data in this case.

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-29 17:46:10 +00:00
dependabot[bot]
9b5de80264
🌱 Bump github.com/go-logr/logr from 1.3.0 to 1.4.1 (#3758)
Bumps [github.com/go-logr/logr](https://github.com/go-logr/logr) from 1.3.0 to 1.4.1.
- [Release notes](https://github.com/go-logr/logr/releases)
- [Changelog](https://github.com/go-logr/logr/blob/master/CHANGELOG.md)
- [Commits](https://github.com/go-logr/logr/compare/v1.3.0...v1.4.1)

---
updated-dependencies:
- dependency-name: github.com/go-logr/logr
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-29 10:11:02 -06:00
dependabot[bot]
c90e0bb4d3
🌱 Bump the github-actions group with 4 updates (#3747)
Bumps the github-actions group with 4 updates: [tj-actions/changed-files](https://github.com/tj-actions/changed-files), [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `tj-actions/changed-files` from 40.2.2 to 41.0.1
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](9454999946...716b1e1304)

Updates `sigstore/cosign-installer` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](1fc5bd396d...9614fae9e5)

Updates `actions/upload-artifact` from 3.1.3 to 4.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](a8a3f3ad30...c7d193f32e)

Updates `actions/download-artifact` from 3.0.2 to 4.1.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](9bc31d5ccc...f44cd7b40b)

---
updated-dependencies:
- dependency-name: tj-actions/changed-files
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: sigstore/cosign-installer
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 19:26:38 +00:00
dependabot[bot]
3c933895d3
🌱 Bump github.com/jszwec/csvutil from 1.8.0 to 1.9.0 (#3722)
Bumps [github.com/jszwec/csvutil](https://github.com/jszwec/csvutil) from 1.8.0 to 1.9.0.
- [Release notes](https://github.com/jszwec/csvutil/releases)
- [Commits](https://github.com/jszwec/csvutil/compare/v1.8.0...v1.9.0)

---
updated-dependencies:
- dependency-name: github.com/jszwec/csvutil
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 18:59:22 +00:00
dependabot[bot]
90792d995c
🌱 Bump github.com/go-git/go-git/v5 in /tools (#3749)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.7.0 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.7.0...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 18:23:38 +00:00
Naveen
5d8767ebb3
🌱 Update Go version to 1.21 for tools (#3754)
- Update go version from `1.19` to `1.21`

[tools/go.mod]
- Update go version from `1.19` to `1.21`

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2023-12-28 17:55:00 +00:00
dependabot[bot]
0e8dad86a6 🌱 Bump google.golang.org/protobuf from 1.31.0 to 1.32.0
Bumps google.golang.org/protobuf from 1.31.0 to 1.32.0.

---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-28 15:56:22 +00:00
Naveen
2bad4e93c1
🐛 Fix nils (#3750)
* 🐛 Fix nils

- Fixed potential nils.

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>

* Fixed code review comments.

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>

---------

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2023-12-28 15:43:13 +00:00
dependabot[bot]
6a226ce06b
🌱 Bump actions/setup-go from 4.1.0 to 5.0.0 (#3726)
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 4.1.0 to 5.0.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](93397bea11...0c52d547c9)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-28 02:06:04 +00:00
AdamKorcz
2e1059bb76
🌱 Add probes for Branch Protection (#3691)
* 🌱 Add probes for Branch Protection

Signed-off-by: AdamKorcz <adam@adalogics.com>

* specify that Scorecard only considers default and releases branches

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* reduce duplication in blocksDeleteOnBranches

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use helper to test for boolean values

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Fix typo, mention OutcomeNotAvailable

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix typo and elaborate on effort

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix typo. Specify which branches the probe considers

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Fix copy paste typo

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove '/en' from url

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change effort from 'High' to 'Low' in the blocksForcePushOnBranches probe def

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix remediation level

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Change probe package name

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* improve probe definitions

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* refactor test names

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Change motivation of two probes

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* downgrade effort of runsStatusChecksBeforeMerging

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* reduce complexity of blocksForcePushOnBranches

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* simplify requiresCodeOwnersReview logic

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix linter issues

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix copy paste error

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* differentiate trueMsg and falseMsg in requiresApproversForPullRequests

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix text in requiresCodeOwnersReview

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change outcome in utils

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix lint issues

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix nit in text

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use standardized messages

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove 'Uint32LargerThan0'

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Add number of required reviewers to values. Refactor to avoid nil-dereference

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix nit log message

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-27 22:33:06 +00:00
dependabot[bot]
c1a0557dbf 🌱 Bump github.com/xanzy/go-gitlab from 0.94.0 to 0.95.2
Bumps [github.com/xanzy/go-gitlab](https://github.com/xanzy/go-gitlab) from 0.94.0 to 0.95.2.
- [Changelog](https://github.com/xanzy/go-gitlab/blob/main/releases_test.go)
- [Commits](https://github.com/xanzy/go-gitlab/compare/v0.94.0...v0.95.2)

---
updated-dependencies:
- dependency-name: github.com/xanzy/go-gitlab
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-27 19:41:39 +00:00
dependabot[bot]
12e4ff127d 🌱 Bump gocloud.dev from 0.34.0 to 0.35.0
Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.34.0 to 0.35.0.
- [Release notes](https://github.com/google/go-cloud/releases)
- [Commits](https://github.com/google/go-cloud/compare/v0.34.0...v0.35.0)

---
updated-dependencies:
- dependency-name: gocloud.dev
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
2023-12-27 19:21:33 +00:00
dependabot[bot]
4fafac9984
🌱 Bump golang.org/x/crypto from 0.15.0 to 0.17.0 in /tools (#3741)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.15.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.15.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-27 13:08:53 -06:00
DavidKorczynski
2ef20f17fb
🌱 SAST: add Snyk probe (#3689)
* SAST: add Snyk probe

Adds Snyk's GitHub action (https://github.com/snyk/actions) as a probe.

Signed-off-by: David Korczynski <david@adalogics.com>

* nit

Signed-off-by: David Korczynski <david@adalogics.com>

* e2e: adjust sast test to additional probe

Signed-off-by: David Korczynski <david@adalogics.com>

* checks: sast: nit, fix e2e test 

Signed-off-by: DavidKorczynski <david@adalogics.com>

* Add test with positive outcome

Signed-off-by: David Korczynski <david@adalogics.com>

* fix comment

Signed-off-by: David Korczynski <david@adalogics.com>

* sast: snyk: add workflow test

Signed-off-by: David Korczynski <david@adalogics.com>

* address review

Signed-off-by: David Korczynski <david@adalogics.com>

* sast: adjust snyk to be the same with sonar

Signed-off-by: David Korczynski <david@adalogics.com>

* provide path to WF file

Signed-off-by: David Korczynski <david@adalogics.com>

* adjust path for finding

Signed-off-by: David Korczynski <david@adalogics.com>

* use prefix rather than contains

Signed-off-by: David Korczynski <david@adalogics.com>

---------

Signed-off-by: David Korczynski <david@adalogics.com>
Signed-off-by: DavidKorczynski <david@adalogics.com>
2023-12-18 22:20:47 -05:00
dependabot[bot]
21bbe80ad6
🌱 Bump golang.org/x/crypto from 0.16.0 to 0.17.0 (#3742)
Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.16.0 to 0.17.0.
- [Commits](https://github.com/golang/crypto/compare/v0.16.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-18 21:38:43 -05:00
Allen Shearin
df7d88898f
🌱 differentiate between refs and sha gitab (#3729)
* fix: differentiate between refs and sha gitab listcheckrunsforref

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* address pr comments

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* style: move gitlab call to one line

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* update gitlab api comments

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

---------

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
2023-12-18 20:51:25 +00:00
David E Worth
f4bf574c86
📖 fixup transposition typos in remediation package (#3734)
Signed-off-by: Dave Worth <dave@ensignia.co>
2023-12-18 15:10:12 -05:00
dependabot[bot]
d5900ed549
🌱 Bump github.com/go-git/go-git/v5 from 5.10.1 to 5.11.0 (#3723)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.10.1 to 5.11.0.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.10.1...v5.11.0)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-14 08:40:44 +00:00
Spencer Schrock
eefb6bfe4e
🌱 fix rangeValCopy linter issues (#3735)
Adding the Required field to PullRequestReviewRule made BranchRef slightly too big for the linter.
This code isn't highly used, so just ignoring the inefficiency for now.

Not sure why the staticcheck linter started complaining about the date error checking,
but fixed it while I was here.

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-13 21:47:16 +00:00
dependabot[bot]
39d1b33a19
🌱 Bump the github-actions group with 2 updates (#3725)
Bumps the github-actions group with 2 updates: [tj-actions/changed-files](https://github.com/tj-actions/changed-files) and [actions/stale](https://github.com/actions/stale).


Updates `tj-actions/changed-files` from 40.2.1 to 40.2.2
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](1c938490c8...9454999946)

Updates `actions/stale` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/stale/releases)
- [Changelog](https://github.com/actions/stale/blob/main/CHANGELOG.md)
- [Commits](1160a22402...28ca103628)

---
updated-dependencies:
- dependency-name: tj-actions/changed-files
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/stale
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-13 21:35:02 +00:00
AdamKorcz
2c20be03cb
convert Signed Releases to probes (#3610)
* convert Signed Releases to probes

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Specify that probe is for Github and Gitlab only

Signed-off-by: AdamKorcz <adam@adalogics.com>

* use  in loop instead of

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix linter issues

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix more linter issues

Signed-off-by: AdamKorcz <adam@adalogics.com>

* specify Github and Gitlab in provenance def.yml

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Add link to slsa-github-generator

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Add instructions on signing with Cosign

Signed-off-by: AdamKorcz <adam@adalogics.com>

* refactor evaluation

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* debug failing integration test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove unused nolints

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* expose release name asset names in finding values

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix failed integration test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove 'totalReleases' value from findings

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove left-over cases of "totalReleases" values in findings

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove remaining totalReleases values

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use const probe names instead of hard-coded strings

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove totalReleases from test helper arguments

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* merge test helpers

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-13 07:51:32 -08:00
Spencer Schrock
d03c8cbb43
🐛 revert making RequiredPullRequestReviews a pointer (#3728)
* revert the change which made RequiredPullRequestReviews a pointer

While the current approach works with the tiered scoring,
it wont work for probes or if we remove tiers. Making the struct nil to
signal that PRs aren't required hides some of the data we do have.

This is especially problematic for repo rules, where we can infer all
settings by what we see or dont see.

Signed-off-by: Spencer Schrock <sschrock@google.com>

* add helper to deref pointers

Signed-off-by: Spencer Schrock <sschrock@google.com>

* clarify comments and keep code consistent

Signed-off-by: Spencer Schrock <sschrock@google.com>

---------

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-13 00:26:35 +00:00
Pedro Kaj Kjellerup Nacht
663e1a9bad
🌱 Use backlog and "help wanted" labels on issues/PRs to keep stale-bot away (#3690)
* Use "never stale" tag on issues/PRs to keep stale-bot away

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

* Replace 'never stale' with 'icebox', 'help wanted'

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

* Replace "icebox,help needed" with "backlog,help wanted"

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>

---------

Signed-off-by: Pedro Kaj Kjellerup Nacht <pnacht@google.com>
2023-12-12 19:01:00 +00:00
AdamKorcz
3ce1daa74a
🌱 Add probes to main call (#3688)
* 🌱 Add probes to main call

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix linter issues

Signed-off-by: AdamKorcz <adam@adalogics.com>

* add test

Signed-off-by: AdamKorcz <adam@adalogics.com>

* add test coverage

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* WIP

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change comment for 'ExperimentalRunProbes'

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix linter issues

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* make only one in root.go

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* relocate printing of output

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove FormatPJSON

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* reduce complexity of rootCmd

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* assign findings in runEnabledProbes

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change name of probe map

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* unwrap error

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-12 09:38:50 -08:00
Diogo Teles Sant'Anna
db7b6e70af
branch protection: requiring PRs gives partial credit (#3499)
* feat(branch-protection): consider if project requires PRs prior to make changes

As discussed at the issue #2727, we're adding the "require PRs prior
to make changes" as another requirement to tier 2. In addition to that,
we're changing the weight of the tier 2 requirements so that
"requiring 1 reviewer" has weight 2, while the other tier 2 requirements
have weight 1

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): increment and adapt testing

1. Adapt previous test cases to consider that now we'll have an aditional
Info log telling that the project requires PRs to make changes.
2. Add more cases to test relevant use cases on the tier 2 level of
branch protection

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* docs(branch-protection-check): adapt check description to consider requirement of require PRs to make changes

It adds the new tier 2 requirement, but also specify that the
"require at least 1 reviewer" will have doubled weight.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection-check): avoid duplicate funcions and enhance readability

Made some nice-to-have improvements on project readability,
making it easier easier to  understand how the branch-protection
score is computed. Also unified 8 different functions that were
doing basically the same thing.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>


* feat(branch-protection): standardize values received on evaluation

Previously, at the evaluation part of branch protetion, the
values nil and false or zero were sort of interchangeble. This commit
changes the code to set as nil only the data that could not be retrieved
from github -- all the others would have values as false, zero, true, etc

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(github-client): adapt and add tests to check if nil values are coherent

1. Add new test to evaluate how we're interpreting a rule with all
checkboxes unchecked (most shouldn't be nil)
2. Adapt existent tests to expect non-nil values for unchecked
   checkboxes

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* feat(client-github): avoid reusing bool pointers

Changes some pieces of code to prefer using pointers of
bool instantiated independently. If reusing bool pointers, at some piece
of code the value of the bool could inadvertently changed and it would change the
value of all other fields reusing that pointer.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* feat(branch-protection): enhance evaluation if scorecard was run by admin

At the evaluation step we were using some non untrusted fieldds of the
resposte to evaluate if Scorecard was run as admin or not. Now we're
using a field provided directly from the client file.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): adapt testings to say if they have admin info or not

After last commit, the client will tell the evaluation files if
Scorecard was run by administrator or not (i.e., if we have all the
infos). This commit adapts the testings to also provide this info.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(e2e-branch-protection): adapt number of logs after changes

- 2 warns (for 'last push approval' and 'codeowners review' disabled) were added because now those informations come as 'not-nil' at the evaluation part.
- 1 info was added to say that PRs are required to make changes
- 1 debug was removed because it said that we couldn't retrieve 'last push approval' information, but we actually can. It was just incorrectly set as nil

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* Revert the 2 commits with changes around how Scorecard detects admin run

Reverts commit 64c3521d89a6493e0d8c7527aa011f98c3e35719 and commit e2662b7173ef90b44b2d72c37614230440e8a919.
Both had chances around using clients/branch.go scructur to store the
information of whether Scorecard was being run by admin or not. We
decided to not change this structure for this purpose.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): change data structure to use pointer instead of value

At clients.BranchProtectionRule struct, changing
RequiredPullRequestReviews to be a pointer instead of a struct value.
This will allow the usage of the nil value of this structure to mean
that we can't say if the repository requires reviews or not.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* feat(branch-protection): use nil pointer on reviewers struct to mean
we don't know if they require PRs

The nil value of the struct RequiredPullRequestReviews will now mean
that we can't tell whether the project requires PRs to make changes or not.

When we get this case, we're printing a debug informing that we don't have
this data, but also printing a warn saying that they don't require
reviews, because that will be true at this case.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): if we're setting the reviewers struct to nil
when needed

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* doc(branch-protection): add code comment explaining different weight on tier 2 scores

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): avoid duplicate if branches on reviewers num comparation

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* docs(branch-protection): clarify commentings around data structure

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor: clean code on parsing GitHub BP data

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* feat(branch-protection): ressignify the nil PullRequestReviewRule to mean PR not required

Adapt translation of data from GitHub API, now for our internal data
modeling, having a nil PullRequestReviewRule structure will mean that
PRs are not required on the repo (can also mean we don't have data to
ensure that).

It also changes the order of the calls of copyNonAdminSettings and
copyAdminSettings to make the first one be called first. This eases the
code because the PullRequestReviewRule can be always instantiated at
this function.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): ensure we translate GitHub BP data as expected

Ensure we're correctly translating GitHub data from the old Branch
Protection config.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* feat(branch-protection): adapt score evaluation after 2efeee6512

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): adapt testings to changes of last commits

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* docs(branch-protection): add TODO comments pointing refactor opportunities

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* fix: avoid penalyzing non-admin for dismissStaleReview

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* fix(branch-protection): prevent false value from API field to become nil

When translating the API results, if the specific field `DismissesStaleReviews`
had a false value, it was not being initiated in our data model and was
remaining nil.

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor: clarify different weight on first reviewer

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor: enhance clarity of loggings and comments

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): new test to cover different rules affecting same branch

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* docs(branch-protection): change requirements ordering to keep admin ones together

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): simplify auxiliary function

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): fix code format to linter requirements

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): avoid unnecessary initializations and rename function

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): adapt test that was forgotten on commit 6858790a3e

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): use enums to represent tiers

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): remove nil fields of struct initialization when they dont contribute for clarification

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): simplify functions by using generics

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* docs(branch-protection): update docs after generate-docs run

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* fix(branch-protection): fix duplicated line on code

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* fix(branch-protection): stop exporting Tier enum

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* refactor(branch-protection): changing unchanged var to const

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

* test(branch-protection): Rename test and adapt it to be consistent with its purpose

I also changed the test to not require PRs, as it's how it is when a new GitHub
Branch Protection config is created. The changes on the loggings numbers are due
to:
1. A warning for not having DismissStaleReviews became a debug
2. Removed the warning we had for not requiring CodeOwners
3. Have a new warning for not requiring PRe

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>

---------

Signed-off-by: Diogo Teles Sant'Anna <diogoteles@google.com>
2023-12-11 22:39:02 -08:00
AdamKorcz
30ef6b1026
🌱 convert CI-Tests check to probes (#3621)
* 🌱 convert CITest check to probes

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix lint issues

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* debug failing integration test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Add negative outcome to test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove 'totalTested' and 'totalMerged' values from findings

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Log at debug level

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-11 10:15:50 -08:00
dependabot[bot]
5dc03b72e1
🌱 Bump github.com/google/osv-scanner from 1.4.3 to 1.5.0 (#3716)
Bumps [github.com/google/osv-scanner](https://github.com/google/osv-scanner) from 1.4.3 to 1.5.0.
- [Release notes](https://github.com/google/osv-scanner/releases)
- [Changelog](https://github.com/google/osv-scanner/blob/main/CHANGELOG.md)
- [Commits](https://github.com/google/osv-scanner/compare/v1.4.3...v1.5.0)

---
updated-dependencies:
- dependency-name: github.com/google/osv-scanner
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-06 10:52:09 -08:00
AdamKorcz
6ea9c8d2a2
🌱 Pinned dependencies: create findings from processing errors (#3711)
* 🌱 refactor pinned dependencies

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove remediation from test

Signed-off-by: AdamKorcz <adam@adalogics.com>

* 🌱 create findings from processing errors

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* correct style of loop

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-06 00:08:19 +00:00
dependabot[bot]
320ce05868
🌱 Bump the github-actions group with 3 updates (#3715)
Bumps the github-actions group with 3 updates: [actions/dependency-review-action](https://github.com/actions/dependency-review-action), [tj-actions/changed-files](https://github.com/tj-actions/changed-files) and [kubernetes-sigs/kubebuilder-release-tools](https://github.com/kubernetes-sigs/kubebuilder-release-tools).


Updates `actions/dependency-review-action` from 3.1.3 to 3.1.4
- [Release notes](https://github.com/actions/dependency-review-action/releases)
- [Commits](7bbfa034e7...01bc87099b)

Updates `tj-actions/changed-files` from 40.1.1 to 40.2.1
- [Release notes](https://github.com/tj-actions/changed-files/releases)
- [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md)
- [Commits](25ef3926d1...1c938490c8)

Updates `kubernetes-sigs/kubebuilder-release-tools` from 0.4.2 to 0.4.3
- [Release notes](https://github.com/kubernetes-sigs/kubebuilder-release-tools/releases)
- [Changelog](https://github.com/kubernetes-sigs/kubebuilder-release-tools/blob/master/RELEASE.md)
- [Commits](3c3411345e...012269a88f)

---
updated-dependencies:
- dependency-name: actions/dependency-review-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: tj-actions/changed-files
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: kubernetes-sigs/kubebuilder-release-tools
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-05 22:25:19 +00:00
AdamKorcz
ec36916c10
🌱 convert Webhook check to probes (#3522)
* 🌱 convert Webhook check to probes

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Add test + nits

Signed-off-by: AdamKorcz <adam@adalogics.com>

* replace probe with OutcomeNotApplicable

Signed-off-by: AdamKorcz <adam@adalogics.com>

* return one finding per webhook

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change wording in def.yml

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change wording in def.yml and checks.md

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove unused struct in test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* align checks.md with checks.yaml

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* bring back experimental for webhooks

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change 'token' to 'secret' in probe

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use checker.MinResultScore instead of 0

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Change test name

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use checker.MinResultScore instead of 0

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* fix typo

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* Use checker.MaxResultScore instead of 10

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* rename probe

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove the 'totalWebhooks' value from findings

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-05 18:59:42 +00:00
Spencer Schrock
c089856d5f
remove ununsed directives (#3713)
Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-05 16:18:57 +00:00
AdamKorcz
cb721a8526
🌱 convert binary artifact check to probe (#3508)
* 🌱 convert binary artifact check to probe

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Reword motivation

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove unused variable in test

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove positiveOutcome() and length check

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix wrong check name

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Split into two probes: One with and one without gradle-wrappers

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Add description about what Scorecard considers a verified binary

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change 'trusted' to 'verified'

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove nil check

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove filtering

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* use const scores in tests

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* rename test

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* add sanity check in loop

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* rename binary file const

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-12-05 00:24:16 -08:00
dependabot[bot]
483cc31b60
🌱 Bump github.com/moby/buildkit from 0.12.3 to 0.12.4 (#3710)
Bumps [github.com/moby/buildkit](https://github.com/moby/buildkit) from 0.12.3 to 0.12.4.
- [Release notes](https://github.com/moby/buildkit/releases)
- [Commits](https://github.com/moby/buildkit/compare/v0.12.3...v0.12.4)

---
updated-dependencies:
- dependency-name: github.com/moby/buildkit
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 14:39:48 -08:00
dependabot[bot]
7656dc7e4e
🌱 Bump github.com/onsi/ginkgo/v2 in /tools (#3703)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.13.1 to 2.13.2.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.13.1...v2.13.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-12-04 18:56:30 +00:00
Allen Shearin
e4fc8150b0
🐛 Parse Gitlab Status fields to align w/Github Status and Conclusion (#3706)
* fix: parse gitlab pipeline status to their GitHub equivalent

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

* change completed string to const

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>

---------

Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
2023-12-04 09:59:02 -08:00
Spencer Schrock
d882fc73e1
🌱 re-enable paralleltest linter (#3705)
Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-04 02:25:03 +00:00
Spencer Schrock
1625b0c578
🌱 Disable more style linters for test files (#3707)
* disable lll linter for test files
* disable goerr113 linter for tests
* disable wrapcheck linter for tests
* fix easy linter issues in tests

---------

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-12-04 02:14:01 +00:00
dependabot[bot]
4d1621b92e
🌱 Bump github.com/google/go-containerregistry (#3708)
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.16.1 to 0.17.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.16.1...v0.17.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-30 20:45:41 +00:00
Martin Costello
0c40e14b75
🐛 Trust pinned GitHub download URLs (#3694)
* Trust pinned GitHub download URLs

 Trust files that are downloaded from `raw.githubusercontent.com` where the file's ref is a Git SHA and therefore immutable.
Resolves #3339.
Signed-off-by: martincostello <martin@martincostello.com>

* Move logic to function

- Add `hasUnpinnedURLs` function.
- Add test cases for different URLs.
Signed-off-by: martincostello <martin@martincostello.com>

* Fix formatting

Appease the linter.
Signed-off-by: martincostello <martin@martincostello.com>

* Suppress lint warnings

Suppress warning on three long URLs.
Signed-off-by: martincostello <martin@martincostello.com>

* Address peer review

Address peer review feedback.
Signed-off-by: martincostello <martin@martincostello.com>

* Fix lint warning

Fix lint warning.
Signed-off-by: martincostello <martin@martincostello.com>
2023-11-30 11:26:47 -08:00
ariathaker
ce0b54efe0
📖 Add beginner's guide to scorecard checks docs (#3617)
* -Added beginner's guide to scorecard checks doc
-Edited README to link to the beginner's guide

Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update beginner-checks.md

Incorporating Spencer's edits.

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update docs/beginner-checks.md

Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update beginner-checks.md

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Signed-off-by: ariathaker <ariathaker@gmail.com>

* Update beginner-checks.md

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>

* Update beginner-checks.md

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>

* Update beginner-checks.md

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>

* Update beginner-checks.md

Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>

---------

Signed-off-by: ariathaker <ariathaker@gmail.com>
Signed-off-by: ariathaker <51683211+ariathaker@users.noreply.github.com>
Co-authored-by: olivekl <83081275+olivekl@users.noreply.github.com>
2023-11-29 21:17:56 +00:00
dependabot[bot]
0e7e58a369
🌱 Bump github.com/onsi/ginkgo/v2 from 2.13.1 to 2.13.2 (#3704)
Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.13.1 to 2.13.2.
- [Release notes](https://github.com/onsi/ginkgo/releases)
- [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md)
- [Commits](https://github.com/onsi/ginkgo/compare/v2.13.1...v2.13.2)

---
updated-dependencies:
- dependency-name: github.com/onsi/ginkgo/v2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-29 13:35:39 -05:00
AdamKorcz
3cbafa9012
📖 fix typo (#3699)
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-11-28 20:59:35 +00:00
dependabot[bot]
fea2f45dd8
🌱 Bump golang.org/x/oauth2 from 0.14.0 to 0.15.0 (#3697)
Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.14.0 to 0.15.0.
- [Commits](https://github.com/golang/oauth2/compare/v0.14.0...v0.15.0)

---
updated-dependencies:
- dependency-name: golang.org/x/oauth2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-28 20:50:07 +00:00
AdamKorcz
9b5d762a7d
🌱 convert CII Best Practices check to probes (#3520)
* 🌱 convert CII Best Practices check to probes

Signed-off-by: AdamKorcz <adam@adalogics.com>

* change 'NOT' to 'not'

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Change wording in probes

Signed-off-by: AdamKorcz <adam@adalogics.com>

* add links to text

Signed-off-by: AdamKorcz <adam@adalogics.com>

* fix typo

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Edit text in def.yml

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove hasBadgeNotFound probe

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove 'that' from text

Signed-off-by: AdamKorcz <adam@adalogics.com>

* use CreateMinScoreResult instead of CreateResultWithScore

Signed-off-by: AdamKorcz <adam@adalogics.com>

* use MaxResultScore instead of maxScore

Signed-off-by: AdamKorcz <adam@adalogics.com>

* return CreateRuntimeErrorResult sooner rather than later

Signed-off-by: AdamKorcz <adam@adalogics.com>

* Combine probes into one

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove minScore variable

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* remove 'hasInProgressBadge' probe

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* make badge levels global variables

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* return -1 for unsupported badge

Signed-off-by: Adam Korczynski <adam@adalogics.com>

* change text for unknown and unsupported badges

Signed-off-by: Adam Korczynski <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2023-11-28 12:02:26 -08:00
AdamKorcz
68573209d6
🌱 make maintained values keys constants (#3700)
Signed-off-by: Adam Korczynski <adam@adalogics.com>
Co-authored-by: Raghav Kaul <8695110+raghavkaul@users.noreply.github.com>
2023-11-28 17:30:06 +00:00
dependabot[bot]
04ea8bee48
🌱 Bump github.com/go-git/go-git/v5 from 5.10.0 to 5.10.1 (#3698)
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.10.0 to 5.10.1.
- [Release notes](https://github.com/go-git/go-git/releases)
- [Commits](https://github.com/go-git/go-git/compare/v5.10.0...v5.10.1)

---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-28 11:26:49 -05:00
Spencer Schrock
84bd607ae8
🌱 fix script injection (#3695)
Thanks to @AdnaneKhan for the report.

* start with reporter patch
* use env variable for bash step too

Signed-off-by: Spencer Schrock <sschrock@google.com>

---------

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-11-27 23:10:51 +00:00
AdamKorcz
f8198b0621
🌱 refactor pinned dependencies (#3667)
* 🌱 refactor pinned dependencies

Signed-off-by: AdamKorcz <adam@adalogics.com>

* remove remediation from test

Signed-off-by: AdamKorcz <adam@adalogics.com>

---------

Signed-off-by: AdamKorcz <adam@adalogics.com>
2023-11-27 10:10:09 -08:00
Spencer Schrock
1a17bb812f
🐛 add retry loop to graphQL commit queries which timeout on large github repos (#3680)
* try to always paginate

in the event of timeouts, make our pagination smaller

Signed-off-by: Spencer Schrock <sschrock@google.com>

* add retry test

Signed-off-by: Spencer Schrock <sschrock@google.com>

---------

Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-11-20 21:12:09 +00:00
dependabot[bot]
76878e5b4d
🌱 Bump the github-actions group with 2 updates (#3686)
Bumps the github-actions group with 2 updates: [step-security/harden-runner](https://github.com/step-security/harden-runner) and [actions/github-script](https://github.com/actions/github-script).


Updates `step-security/harden-runner` from 2.6.0 to 2.6.1
- [Release notes](https://github.com/step-security/harden-runner/releases)
- [Commits](1b05615854...eb238b55ef)

Updates `actions/github-script` from 6.4.1 to 7.0.1
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](d7906e4ad0...60a0d83039)

---
updated-dependencies:
- dependency-name: step-security/harden-runner
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/github-script
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2023-11-20 12:16:39 -05:00