-
Notifications
You must be signed in to change notification settings - Fork 481
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Hook Scorecard as a CI/CD solution, prevent bad deps from being added in code #58
Comments
Great idea! I think we'd have to create a separate hook per language-package-manager that can parse out the dependency files and then call the scorecard tool. It's probably going to be easier to do those hooks in whatever language we're handling. Do we need a separate repo for each of those, or just one to hold them all? |
Probably one to hold them all. By default, we run all the hooks in the CI run. If it does not find package lock file for a particular pkg manager, it bails out. Different hooks can be different jobs in the CI run. |
we need to make atleast one check run in cicd pipeline. |
I think I'd like to start work on this issue. Here are some of my thoughts:
Thoughts on these points? |
Bullets 2 - 4 all make sense to me! For bullet 1, maybe it can be built in such a way to be pluggable so if there are other projects that parse dependency files, users would have options? |
I do like the idea of a pluggable architecture. I think it would be good for our project to compile in parsers for at least the popular dependency files. That way the user can download a single binary, and it will work out of the box. We can then have an option for the user to configure their own parser. I cloned one of the Snyk repos I mentioned, and I don't think that will be useful here. They are interested in constructing a graph of all dependencies which is not exactly useful to us. I did find another project that looks more promising: https://github.com/aquasecurity/go-dep-parser. This can parse dependencies for go.mod, npm, pipenv, composer, and more. Since it's written in Go, we could could easily incorporate it. There are some dependency files that include include the git repo such as composer.lock. For these ones, we might want to write our own parser so it can read the repo directly and not have to look it up with a web call. |
Let's discuss this in our upcoming bi-weekly. |
did we forget to discuss this in the last meeting? |
I saw it wasn't on the agenda, but I didn't bring it up because I'll be working on another issue first. Plus I'll be pretty busy the next few weeks getting our house ready to list.
I'll definitely give that look! |
Is this something that still needs to be discussed or can it be closed until it comes up again? Allowing 7 days for feedback. |
Going to point to ossf/scorecard-action#1070, as that seems to be relevant discussion. This can be re-opened here as needed. |
No description provided.
The text was updated successfully, but these errors were encountered: