Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

✨ [experimental] Probe support for security policy check #3241

Merged
merged 32 commits into from
Aug 4, 2023

Conversation

laurentsimon
Copy link
Contributor

Probe support for security policy check

@codecov
Copy link

codecov bot commented Jun 30, 2023

Codecov Report

Merging #3241 (cf69c6a) into main (f30ff23) will increase coverage by 0.16%.
The diff coverage is 81.22%.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3241      +/-   ##
==========================================
+ Coverage   61.73%   61.89%   +0.16%     
==========================================
  Files         173      178       +5     
  Lines       12716    12864     +148     
==========================================
+ Hits         7850     7962     +112     
- Misses       4438     4462      +24     
- Partials      428      440      +12     

@laurentsimon laurentsimon temporarily deployed to integration-test July 6, 2023 18:44 — with GitHub Actions Inactive
e2e/security_policy_test.go Outdated Show resolved Hide resolved
finding/finding.go Outdated Show resolved Hide resolved
probes/securityPolicyPresentInOrg/def.yml Outdated Show resolved Hide resolved
checks/evaluation/security_policy.go Outdated Show resolved Hide resolved
checks/evaluation/security_policy_test.go Show resolved Hide resolved
probes/toolPyUpInstalled/def.yml Outdated Show resolved Hide resolved
probes/toolSonatypeLiftInstalled/def.yml Outdated Show resolved Hide resolved
probes/utils/files.go Outdated Show resolved Hide resolved
probes/utils/files.go Outdated Show resolved Hide resolved
probes/utils/secpolicy.go Outdated Show resolved Hide resolved
@laurentsimon laurentsimon temporarily deployed to integration-test July 14, 2023 18:38 — with GitHub Actions Inactive
@laurentsimon laurentsimon temporarily deployed to gitlab July 22, 2023 00:29 — with GitHub Actions Inactive
@laurentsimon laurentsimon temporarily deployed to integration-test July 22, 2023 00:30 — with GitHub Actions Inactive
@laurentsimon laurentsimon temporarily deployed to gitlab July 27, 2023 00:28 — with GitHub Actions Inactive
@laurentsimon laurentsimon temporarily deployed to integration-test July 27, 2023 00:28 — with GitHub Actions Inactive
Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Main concern is around this raw data issue. I don't think it affects people running the code through pkg.RunScorecard, but it does for anyone running at the check level. This would impact Allstar for example when we got to one of the checks they care about.

checks/evaluation/security_policy.go Show resolved Hide resolved
checks/evaluation/security_policy.go Show resolved Hide resolved
checks/evaluation/security_policy.go Outdated Show resolved Hide resolved
checks/evaluation/security_policy.go Outdated Show resolved Hide resolved
finding/finding.go Show resolved Hide resolved
checks/security_policy.go Outdated Show resolved Hide resolved
probes/securityPolicyContainsLinks/impl.go Show resolved Hide resolved
probes/securityPolicyContainsText/impl.go Show resolved Hide resolved
probes/securityPolicyPresent/impl.go Show resolved Hide resolved
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: laurentsimon <laurentsimon@google.com>
@laurentsimon laurentsimon temporarily deployed to gitlab August 4, 2023 04:43 — with GitHub Actions Inactive
@laurentsimon laurentsimon temporarily deployed to integration-test August 4, 2023 04:43 — with GitHub Actions Inactive
@laurentsimon laurentsimon merged commit a8b255a into ossf:main Aug 4, 2023
ashearin pushed a commit to kgangerlm/scorecard-gitlab that referenced this pull request Nov 13, 2023
* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update

Signed-off-by: laurentsimon <laurentsimon@google.com>

* fix unit tests

Signed-off-by: laurentsimon <laurentsimon@google.com>

* comments

Signed-off-by: laurentsimon <laurentsimon@google.com>

* compilation fix

Signed-off-by: laurentsimon <laurentsimon@google.com>

* missing file

Signed-off-by: laurentsimon <laurentsimon@google.com>

* missing file

Signed-off-by: laurentsimon <laurentsimon@google.com>

* update reason string

Signed-off-by: laurentsimon <laurentsimon@google.com>

* typo

Signed-off-by: laurentsimon <laurentsimon@google.com>

* fix unit tests

Signed-off-by: laurentsimon <laurentsimon@google.com>

* typo

Signed-off-by: laurentsimon <laurentsimon@google.com>

* unit tests and linnter

Signed-off-by: laurentsimon <laurentsimon@google.com>

* comments

Signed-off-by: laurentsimon <laurentsimon@google.com>

* comments

Signed-off-by: laurentsimon <laurentsimon@google.com>

* missing file

Signed-off-by: laurentsimon <laurentsimon@google.com>

* unit tests for probes

Signed-off-by: laurentsimon <laurentsimon@google.com>

* linter

Signed-off-by: laurentsimon <laurentsimon@google.com>

* revert FileSize change

Signed-off-by: laurentsimon <laurentsimon@google.com>

---------

Signed-off-by: laurentsimon <laurentsimon@google.com>
Signed-off-by: Allen Shearin <allen.p.shearin@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants