-
Notifications
You must be signed in to change notification settings - Fork 28
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
fix: github correlator name when run in matrix build #482
base: main
Are you sure you want to change the base?
Conversation
Signed-off-by: Keith Zantow <kzantow@gmail.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com>
submission.detector.version = ""; | ||
|
||
expect(submission.job).toBeDefined() | ||
expect(submission.job.correlator).toContain("my-matrix-build-1") |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a reason not to assert more specifically?
It looks like this will always be my-workflow_default-import-job_my-matrix-build-1
.
@@ -443,10 +450,19 @@ export async function uploadDependencySnapshot(): Promise<void> { | |||
fs.readFileSync(githubDependencySnapshotFile).toString("utf8") | |||
) as DependencySnapshot; | |||
|
|||
let correlator = `${workflow}_${job}`; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think there are 3 paths through here:
dependency-snapshot-correlator
input is definedartifact-name
input is defined- Neither
artifact-name
nordependency-snapshot-correlator
is defined.
Is it worth having a table test to hit all 3 of these? AFAICT, only scenario 2 is currently exercised by tests.
It might be worth extracting a helper method to make the test set up simpler.
// Need to add the job and repo details | ||
snapshot.job = { | ||
correlator: | ||
core.getInput("dependency-snapshot-correlator") || `${workflow}_${job}`, | ||
correlator: core.getInput("dependency-snapshot-correlator") || correlator, |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is there a reason to hide core.getInput("artifact-name")
behind a helper, but not core.getInput("dependency-snapshot-correlator")
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
dependency-snapshot-correlator
should really not ever be used, it's not a supported parameter, it was originally used for testing. I just left it in to not break anyone who may have set it
This PR adjusts the correlator name to be based on the
artifact-name
, if it is specified. This fixes a situation when running thesbom-action
in a matrix build and uploading dependency snapshots to the Github dependency submission API.Fixes #422