* Support renamed gradle verification action
From gradle/wrapper-validation-action's readme:
"As of v3 this action has been superceded by
gradle/actions/wrapper-validation"
Also support actions pinned to a hash.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* remove unneeded dependency
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
* change file access method to io.ReadCloser
callers don't always need the full file.
large files are slow and can cause crashes.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* switch tests to hardcoded readers
Previously they returned bytes or strings, which have corresponding NewReader types.
Since they don't need to be closed, io.NopCloser works well to give them a fake Close.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* switch tests which called os.ReadFile to os.Open
os.File fufills io.ReadCloser, so this is an easy change
Signed-off-by: Spencer Schrock <sschrock@google.com>
* break tarball tests into two steps: reader and read
The rest of the test was kept the same to minimize the change.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* ossfuzz doesn't implement GetFileReader
Signed-off-by: Spencer Schrock <sschrock@google.com>
* appease linter during refactor
Signed-off-by: Spencer Schrock <sschrock@google.com>
* switch git client to new method
add check which ensures git client fulfills the interface
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
* 🌱 convert binary artifact check to probe
Signed-off-by: AdamKorcz <adam@adalogics.com>
* Reword motivation
Signed-off-by: AdamKorcz <adam@adalogics.com>
* remove unused variable in test
Signed-off-by: AdamKorcz <adam@adalogics.com>
* remove positiveOutcome() and length check
Signed-off-by: AdamKorcz <adam@adalogics.com>
* fix wrong check name
Signed-off-by: AdamKorcz <adam@adalogics.com>
* Split into two probes: One with and one without gradle-wrappers
Signed-off-by: AdamKorcz <adam@adalogics.com>
* Add description about what Scorecard considers a verified binary
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* change 'trusted' to 'verified'
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* remove nil check
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* remove filtering
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* use const scores in tests
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* rename test
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* add sanity check in loop
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* rename binary file const
Signed-off-by: Adam Korczynski <adam@adalogics.com>
---------
Signed-off-by: AdamKorcz <adam@adalogics.com>
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* invert workflow check and explain early exit.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* make workflow run validation optional.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* mark binary artifacts as local file friendly.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add test for gradle wrapper without workflow run support
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fix policy tests and make their names more clear.
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
* implement binary artifacts exception for validated gradle-wrapper.jar files
* add tests for binary artifact gradle wrapper verification exception
* fix issues for linter
* expect added jar in TestBinaryArtifacts Jar file test
* improve readability of raw/binary_artifact
* Binary-Artifact request types no longer includes FileBased
* add version requirement capability to gradle action check
* Refactor exception from checks/raw to checks/evaluation
* remove unnecessary len(files)
* flatten application of exception by moving to another function
* revert refactor to checks/evaluation
* flatten removal of validated wrappers
* create fileExists function
Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com>
