-
Notifications
You must be signed in to change notification settings - Fork 474
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
⚠️ Add initial Maintainers Annotation parsing #3905
⚠️ Add initial Maintainers Annotation parsing #3905
Commits on Mar 29, 2024
-
feat: Get maintainers annotation from repo
This commits adds functionality to read a scorecard.yml file from a repository and parse it to get the maintainers annotation. It introduces the concepts of exemptions, annotations, annotated checks, and annotation reasons. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 389e53b - Browse repository at this point
Copy the full SHA 389e53bView commit details -
feat: Hand off maintainers annotation for SARIF
Hnad off maintainers annotation to SARIF formatting so it can decide to skip or not skip checks when creating the output. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for de0d98b - Browse repository at this point
Copy the full SHA de0d98bView commit details -
feat: If check is annotated, skip in SARIF output
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 69c5e28 - Browse repository at this point
Copy the full SHA 69c5e28View commit details -
feat: Add other annotation reasons
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for a345120 - Browse repository at this point
Copy the full SHA a345120View commit details -
feat: Add options to show maintainers annotations in output
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for df0427f - Browse repository at this point
Copy the full SHA df0427fView commit details -
feat: Output maintainers annotations in JSON
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b21bdf7 - Browse repository at this point
Copy the full SHA b21bdf7View commit details -
fix: Remove unnecessary maintainers annotation param in SARIF
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 2ad4fab - Browse repository at this point
Copy the full SHA 2ad4fabView commit details -
feat: Output maintainers annotations in string default result
This commit changes how data is appended to the table rows. Previously, we defined the table columns size and added information to each index. To avoid complicating the calculation of the index now that we are adding another optional column, the data is appended to the row as needed. Also, the maintainers annotation was chosen to be displayed as last column to give space for Scorecard official reasoning and documentation to appear first. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 202005f - Browse repository at this point
Copy the full SHA 202005fView commit details -
feat: Ignore annotation if check has max score
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for dbea46b - Browse repository at this point
Copy the full SHA dbea46bView commit details -
doc: Add documentation for maintainers annotation
Introduce what flag should be used to show maintainers annotation and how to configure maintainers annotation for your repository. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 3df6791 - Browse repository at this point
Copy the full SHA 3df6791View commit details -
refactor: A maintainers annotation obj can verify if a check is exempted
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 765c63d - Browse repository at this point
Copy the full SHA 765c63dView commit details -
refactor: Get annotations function can be private
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 6fe5b31 - Browse repository at this point
Copy the full SHA 6fe5b31View commit details -
refactor: Find scorecard.yml file in the repository's root
Change to "GetFileContent" method since we're looking for a specific file instead of using "OnMatchingFileContentDo" method that looks files with a specific content. This also removes the dependency from "checks/fileparser". This is necessary to move "IsCheckExempted" to checker. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for e41d439 - Browse repository at this point
Copy the full SHA e41d439View commit details -
fix: A check should know if it's exempted or not
Moving the verification "IsCheckExempted" from maintainers_annotation package to checker package. This way a check result will define, consulting maintainers annotation, if it is exempted or not. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for e23bf4a - Browse repository at this point
Copy the full SHA e23bf4aView commit details -
fix: Maintainers annotation can only be used in experimental mode
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for ae9f55a - Browse repository at this point
Copy the full SHA ae9f55aView commit details -
fix: Ignore if scorecard.yml does not exist
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for f55bf70 - Browse repository at this point
Copy the full SHA f55bf70View commit details -
fix: Remove unnecessary maintainers annotation param
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 946bc1c - Browse repository at this point
Copy the full SHA 946bc1cView commit details -
docs: Move complete mantainers annotation doc to feature folder
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 0104fac - Browse repository at this point
Copy the full SHA 0104facView commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 6033a56 - Browse repository at this point
Copy the full SHA 6033a56View commit details -
refactor: Rename AnnotationReason to Reason
Avoid repetition in variable references. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b30dbf4 - Browse repository at this point
Copy the full SHA b30dbf4View commit details -
refactor: Reason documentation
Redo reason documentation as a switch case to be called when necessary instead of defining a global map. Another reason to redo this logic as switch is that switch should be more performatic then instantiating a local map. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for d3ef155 - Browse repository at this point
Copy the full SHA d3ef155View commit details -
refactor: Rename ScorecardYml to ScorecardConfig
This is a better generic name to reference Scorecard configuration file and leave the file format for the implementation. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 258e896 - Browse repository at this point
Copy the full SHA 258e896View commit details -
The EqualFold comparison is already case insensitive. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b2ff1ad - Browse repository at this point
Copy the full SHA b2ff1adView commit details -
refactor: Rename maintainers annotation folder/file to config
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 362c05f - Browse repository at this point
Copy the full SHA 362c05fView commit details -
refactor: Rename and simplify parsing the config
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 472601e - Browse repository at this point
Copy the full SHA 472601eView commit details -
refactor: Check parses its reasons
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 6d60fc3 - Browse repository at this point
Copy the full SHA 6d60fc3View commit details -
Fix config struture renaming and collect all annotation reasons for a check. Don't stop in the first annotation that the check is exempted. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 84d659d - Browse repository at this point
Copy the full SHA 84d659dView commit details -
refactor: Rename maintainers annotation to annotations
Renaming flags, function params, docs and fixing config renamings. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for cd9266a - Browse repository at this point
Copy the full SHA cd9266aView commit details -
refactor: Separate annotations content from config parsing
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 696b76b - Browse repository at this point
Copy the full SHA 696b76bView commit details -
fix: Omit empty annotations in JSON results
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 37d77b2 - Browse repository at this point
Copy the full SHA 37d77b2View commit details -
refactor: Read config file content
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 4ae0b28 - Browse repository at this point
Copy the full SHA 4ae0b28View commit details -
refactor: JSON2 result options
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 6edd500 - Browse repository at this point
Copy the full SHA 6edd500View commit details -
refactor: String result options
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for cbda605 - Browse repository at this point
Copy the full SHA cbda605View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 54fde87 - Browse repository at this point
Copy the full SHA 54fde87View commit details -
test: Annotation on Binary-Artifacts check
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for de8a965 - Browse repository at this point
Copy the full SHA de8a965View commit details -
feat: Validate annotated checks
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 952ca41 - Browse repository at this point
Copy the full SHA 952ca41View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for e5a6f6c - Browse repository at this point
Copy the full SHA e5a6f6cView commit details -
feat: Validate annotated reasons
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for bdb4407 - Browse repository at this point
Copy the full SHA bdb4407View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 2de2869 - Browse repository at this point
Copy the full SHA 2de2869View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 0e70141 - Browse repository at this point
Copy the full SHA 0e70141View commit details
Commits on Apr 1, 2024
-
test: Binary-Artifacts exempted for testing
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 17e58c3 - Browse repository at this point
Copy the full SHA 17e58c3View commit details -
test: Binary-Artifacts not exempted
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for d9ad34c - Browse repository at this point
Copy the full SHA d9ad34cView commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b171872 - Browse repository at this point
Copy the full SHA b171872View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for ceab1dd - Browse repository at this point
Copy the full SHA ceab1ddView commit details -
test: Improve reasons error comparison
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for ea1ca56 - Browse repository at this point
Copy the full SHA ea1ca56View commit details -
test: Multiple exemption reasons in a single annotation
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b7a5d3f - Browse repository at this point
Copy the full SHA b7a5d3fView commit details -
test: Multiple exemption reasons across annotations
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b3950ab - Browse repository at this point
Copy the full SHA b3950abView commit details -
fix: cmd show annotations flag doc
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 8ca4fc7 - Browse repository at this point
Copy the full SHA 8ca4fc7View commit details -
test: Add show annotations flag
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 51b5fd1 - Browse repository at this point
Copy the full SHA 51b5fd1View commit details -
fix: Remove unnecessary function
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 53ac96f - Browse repository at this point
Copy the full SHA 53ac96fView commit details -
test: Annotations string format
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 9d17753 - Browse repository at this point
Copy the full SHA 9d17753View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 9006269 - Browse repository at this point
Copy the full SHA 9006269View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 05f9aed - Browse repository at this point
Copy the full SHA 05f9aedView commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for fe07f91 - Browse repository at this point
Copy the full SHA fe07f91View commit details -
fix: Linter unnecessart struct type declaration
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 1a59b82 - Browse repository at this point
Copy the full SHA 1a59b82View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 5cce247 - Browse repository at this point
Copy the full SHA 5cce247View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for a45a4fc - Browse repository at this point
Copy the full SHA a45a4fcView commit details -
fix: Linter improve error msg in run scorecard
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 443a009 - Browse repository at this point
Copy the full SHA 443a009View commit details -
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for b357f17 - Browse repository at this point
Copy the full SHA b357f17View commit details -
docs: Disable security alerts on SARIF output
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 494b6db - Browse repository at this point
Copy the full SHA 494b6dbView commit details -
docs: Redirect to configuration doc on main README
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for ad2a9b8 - Browse repository at this point
Copy the full SHA ad2a9b8View commit details -
test: Invalid check in annotations
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 2b73436 - Browse repository at this point
Copy the full SHA 2b73436View commit details -
test: Invalid reason in annotations
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 8234d6d - Browse repository at this point
Copy the full SHA 8234d6dView commit details -
test: Exempt check on SARIF output clears runs
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 997f030 - Browse repository at this point
Copy the full SHA 997f030View commit details -
test: Add check1 annotations json
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for a36843e - Browse repository at this point
Copy the full SHA a36843eView commit details
Commits on Apr 22, 2024
-
fix: On parse error return empty config file not a "dirty" one
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 05fb5b1 - Browse repository at this point
Copy the full SHA 05fb5b1View commit details -
fix: On parse config error continue execution
We log the error to the user but continue execution with empty config. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 63b480c - Browse repository at this point
Copy the full SHA 63b480cView commit details -
Merge branch 'main' into feat/maintainers-annotation
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for ff88498 - Browse repository at this point
Copy the full SHA ff88498View commit details -
fix: Merge conflics importing rules
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for f81871e - Browse repository at this point
Copy the full SHA f81871eView commit details -
fix: Readd is experimental enabled method
This method is necessary to validate if experimental feature is enabled so it can activate show annotations feature. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for 19f8ae1 - Browse repository at this point
Copy the full SHA 19f8ae1View commit details
Commits on Apr 23, 2024
-
feat: Wrap config parse under experimental flag
Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>
Configuration menu - View commit details
-
Copy full SHA for e7cd246 - Browse repository at this point
Copy the full SHA e7cd246View commit details -
fix unit test by removing unused mock call
Signed-off-by: Spencer Schrock <sschrock@google.com>
Configuration menu - View commit details
-
Copy full SHA for b28295e - Browse repository at this point
Copy the full SHA b28295eView commit details