Spencer Schrock
0b9dfb656f
⚠️ Replace v4 module references with v5 ( #4027 )
...
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-04-12 14:51:50 -07:00
Spencer Schrock
96452d99ab
📖 Review and update some probe documentation ( #4023 )
...
* polish some probe yaml definitions
Signed-off-by: Spencer Schrock <sschrock@google.com>
* update references to probe naming and outcomes
now that #3654 is addressed, the naming restrictions can be relaxed.
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-04-11 22:08:55 -07:00
Spencer Schrock
6b071eddeb
⚠️ Allow probes to specify their own bad outcomes ( #4020 )
...
* merge probe and finding packages
No one interacts with the probes directly,
and having them in the same package helps with follow up commits
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add extra field to indicate the outcome a probe should show remediation for
Signed-off-by: Spencer Schrock <sschrock@google.com>
* start all probes with remediate on 'False'
Signed-off-by: Spencer Schrock <sschrock@google.com>
* make OutcomeTrue bad for hasOSVVulnerabilities
Signed-off-by: Spencer Schrock <sschrock@google.com>
* nest outcome trigger under remediation in yaml
Signed-off-by: Spencer Schrock <sschrock@google.com>
* invert outcomes for dangerous workflow probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* rename notArchived probe to archived
with the swap, the true outcome is now the bad outcome.
Signed-off-by: Spencer Schrock <sschrock@google.com>
* rename notCreatedRecently probe to createRecently
with the rename, the true outcome is now bad
Signed-off-by: Spencer Schrock <sschrock@google.com>
* switch binary artifact probes so detecting binaries is a true outcome
Signed-off-by: Spencer Schrock <sschrock@google.com>
* appease the linter
Signed-off-by: Spencer Schrock <sschrock@google.com>
* dont export probe type
we can always make it public again later
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-04-10 14:12:53 -07:00
Spencer Schrock
b577d79c96
⚠️ Replace Positive and Negative outcomes with True and False ( #4017 )
...
* rename positive to true
Signed-off-by: Spencer Schrock <sschrock@google.com>
* rename negative to false
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-04-08 15:36:11 -07:00
Spencer Schrock
b3ad602a59
🌱 Add probe registration mechanism ( #3876 )
...
* add basic probe registration function
Signed-off-by: Spencer Schrock <sschrock@google.com>
* ignore probes which call init to register the probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* redefine probeimpl to avoid circular imports
Signed-off-by: Spencer Schrock <sschrock@google.com>
* register all probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* experiment with a probe struct
Signed-off-by: Spencer Schrock <sschrock@google.com>
* make check name constants
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert branch protection probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert binary artifact probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert cii probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert ci test probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert code review probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert contributor probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert dangerous workflow probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert dep update tool probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert fuzzing probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert license probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert maintained probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert packaging probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert sast probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert security policy probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert signed releases probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert vuln probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* try using probe registration data
Signed-off-by: Spencer Schrock <sschrock@google.com>
* blank import unused probe
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add uncategorized group
Signed-off-by: Spencer Schrock <sschrock@google.com>
* ensure All list is up-to-date
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add reason behind uncategorized group
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fix linter yaml parse error
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fix linter
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add webhook data
Signed-off-by: Spencer Schrock <sschrock@google.com>
* convert probe registration to Must pattern
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add registration for new probes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add missing license header
Signed-off-by: Spencer Schrock <sschrock@google.com>
* revert changing wrapcheck linter config
Signed-off-by: Spencer Schrock <sschrock@google.com>
* use error func which doesnt need wrapped
Signed-off-by: Spencer Schrock <sschrock@google.com>
* add test for probe registration
Signed-off-by: Spencer Schrock <sschrock@google.com>
* restore trailing newline
Signed-off-by: Spencer Schrock <sschrock@google.com>
* order probe category list
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-03-19 13:10:11 -07:00
AdamKorcz
6fc7d4c061
✨ Add probe metadata about supported ecosystems ( #3797 )
...
* 🌱 Add probe metadata about supported ecosystems
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* Add metadata for the rest of the probes
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* fix wrong formatting
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* remove oss-fuzz, osv, cii_blob, cii_http clients
Signed-off-by: Adam Korczynski <adam@adalogics.com>
* add github and gitlab clients for 2 probes
Signed-off-by: Adam Korczynski <adam@adalogics.com>
---------
Signed-off-by: Adam Korczynski <adam@adalogics.com>
2024-02-08 10:20:07 -08:00
Spencer Schrock
c59e93b9b2
🌱 Switch probe tests to helper func ( #3782 )
...
* simplify test helper to verify finding outcomes
Signed-off-by: Spencer Schrock <sschrock@google.com>
* switch existing callers to helper func
Signed-off-by: Spencer Schrock <sschrock@google.com>
* remove TODO comments
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fixup doc string
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2024-01-10 10:00:04 -08:00
Spencer Schrock
92470deac3
🌱 enable nolintlint linter and fix violations ( #3650 )
...
* enable nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* first chunk of fixing nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* second chunk of fixing nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* third chunk of fixing nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fourth chunk of fixing nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* include reason for the specific linter config
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fifth chunk of fixing nolintlint
Signed-off-by: Spencer Schrock <sschrock@google.com>
* fix linter errors that are somehow still triggering
Signed-off-by: Spencer Schrock <sschrock@google.com>
---------
Signed-off-by: Spencer Schrock <sschrock@google.com>
2023-11-15 11:44:28 -08:00
laurentsimon
f05496b994
✨ Re-factor probe utils ( #3408 )
...
* re-factor probe utils
Signed-off-by: laurentsimon <laurentsimon@google.com>
* missing error.go file
Signed-off-by: laurentsimon <laurentsimon@google.com>
---------
Signed-off-by: laurentsimon <laurentsimon@google.com>
2023-08-21 13:16:41 -07:00
laurentsimon
a8b255a224
✨ [experimental] Probe support for security policy check ( #3241 )
...
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update
Signed-off-by: laurentsimon <laurentsimon@google.com>
* fix unit tests
Signed-off-by: laurentsimon <laurentsimon@google.com>
* comments
Signed-off-by: laurentsimon <laurentsimon@google.com>
* compilation fix
Signed-off-by: laurentsimon <laurentsimon@google.com>
* missing file
Signed-off-by: laurentsimon <laurentsimon@google.com>
* missing file
Signed-off-by: laurentsimon <laurentsimon@google.com>
* update reason string
Signed-off-by: laurentsimon <laurentsimon@google.com>
* typo
Signed-off-by: laurentsimon <laurentsimon@google.com>
* fix unit tests
Signed-off-by: laurentsimon <laurentsimon@google.com>
* typo
Signed-off-by: laurentsimon <laurentsimon@google.com>
* unit tests and linnter
Signed-off-by: laurentsimon <laurentsimon@google.com>
* comments
Signed-off-by: laurentsimon <laurentsimon@google.com>
* comments
Signed-off-by: laurentsimon <laurentsimon@google.com>
* missing file
Signed-off-by: laurentsimon <laurentsimon@google.com>
* unit tests for probes
Signed-off-by: laurentsimon <laurentsimon@google.com>
* linter
Signed-off-by: laurentsimon <laurentsimon@google.com>
* revert FileSize change
Signed-off-by: laurentsimon <laurentsimon@google.com>
---------
Signed-off-by: laurentsimon <laurentsimon@google.com>
2023-08-04 04:52:15 +00:00
