This commits adds functionality to read a scorecard.yml file from a repository and parse it to get the maintainers annotation. It introduces the concepts of exemptions, annotations, annotated checks, and annotation reasons.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Hnad off maintainers annotation to SARIF formatting so it can decide to skip or not skip checks when creating the output.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

This commit changes how data is appended to the table rows. Previously, we defined the table columns size and added information to each index. To avoid complicating the calculation of the index now that we are adding another optional column, the data is appended to the row as needed.

Also, the maintainers annotation was chosen to be displayed as last column to give space for Scorecard official reasoning and documentation to appear first.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Introduce what flag should be used to show maintainers annotation and how to configure maintainers annotation for your repository.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Change to "GetFileContent" method since we're looking for a specific file instead of using "OnMatchingFileContentDo" method that looks files with a specific content.
This also removes the dependency from "checks/fileparser". This is necessary to move "IsCheckExempted" to checker.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Moving the verification "IsCheckExempted" from maintainers_annotation package to checker package. This way a check result will define, consulting maintainers annotation, if it is exempted or not.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Avoid repetition in variable references.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Redo reason documentation as a switch case to be called when necessary instead of defining a global map. Another reason to redo this logic as switch is that switch should be more performatic then instantiating a local map.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

This is a better generic name to reference Scorecard configuration file and leave the file format for the implementation.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

The EqualFold comparison is already case insensitive.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Fix config struture renaming and collect all annotation reasons for a check. Don't stop in the first annotation that the check is exempted.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Renaming flags, function params, docs and fixing config renamings.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

We log the error to the user but continue execution with empty config.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

This method is necessary to validate if experimental feature is enabled so it can activate show annotations feature.

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

Signed-off-by: Spencer Schrock <sschrock@google.com>