✨ Gitlab support: RepoClient #2655

raghavkaul · 2023-02-13T16:43:29Z

What kind of change does this PR introduce?

This PR adds tests for GitLab support in Scorecard. Some work remains: Some tests require a GitLab test organization, or test repos, or other scaffolding.

What is the current behavior?

This work builds off @N8BWert's work in #2280, but updates the branch with main.

Which issue(s) this PR fixes

Fixes #2266.

Does this PR introduce a user-facing change?

If a user is running scorecard on a GitHub repository that includes the string "gitlab." in the title scorecard will now think that repository is actually a GitLab project, however this is an incredibly rare edge case.

Release Notes

Repositories that include "gitlab." in their title will be assumed to be gitlab projects.

Link to previous PR:
#2265 (comment)

checker/client.go

codecov · 2023-02-16T19:26:24Z

Codecov Report

Merging #2655 (533dc3e) into main (5625dda) will decrease coverage by 0.20%.
The diff coverage is 28.57%.

❗ Current head 533dc3e differs from pull request most recent head eb0d15b. Consider uploading reports for the commit eb0d15b to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2655      +/-   ##
==========================================
- Coverage   49.86%   49.66%   -0.20%     
==========================================
  Files         156      156              
  Lines       11576    11643      +67     
==========================================
+ Hits         5772     5783      +11     
- Misses       5454     5505      +51     
- Partials      350      355       +5

github-actions · 2023-02-27T02:02:21Z

Stale pull request message

azeemshaikh38

Thanks @raghavkaul. Could you please split this PR into smaller ones? Maybe one PR per check? There are 50 changed files with 160 commits in this PR. That's a lot of code to review reasonably.

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

azeemshaikh38

Looks good overall to submit. Left some minor comments.

.github/workflows/integration.yml

Makefile

checker/client.go

clients/repo.go

clients/gitlabrepo/client.go

* Make target for e2e-gitlab-token * Only run Gitlab tests in CI that don't require a token Signed-off-by: Raghav Kaul <raghavkaul@google.com>

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

* Check OSS-Fuzz using project list Signed-off-by: Spencer Schrock <sschrock@google.com> * Use clients.RepoClient interface to perform the new OSS Fuzz check Signed-off-by: Spencer Schrock <sschrock@google.com> * wip: add eager client for better repeated lookup of projects Signed-off-by: Spencer Schrock <sschrock@google.com> * Split lazy and eager behavior into different implementations. Signed-off-by: Spencer Schrock <sschrock@google.com> * Add tests and benchmarks Signed-off-by: Spencer Schrock <sschrock@google.com> * Switch to always parsing JSON to determine if a project is present. The other approach of looking for a substring match would lead to false positives. Signed-off-by: Spencer Schrock <sschrock@google.com> * Add eager constructor to surface status file errors sooner. Signed-off-by: Spencer Schrock <sschrock@google.com> * Switch existing users to new OSS Fuzz client Signed-off-by: Spencer Schrock <sschrock@google.com> * Mark old method as deprecated in the godoc Signed-off-by: Spencer Schrock <sschrock@google.com> * remove unused comment. Signed-off-by: Spencer Schrock <sschrock@google.com> * Use new OSS Fuzz client in e2e test. Signed-off-by: Spencer Schrock <sschrock@google.com> * fix typo. Signed-off-by: Spencer Schrock <sschrock@google.com> * Fix potential path bug with test server. Signed-off-by: Spencer Schrock <sschrock@google.com> * Force include the two JSON files which were being ignored by .gitignore Signed-off-by: Spencer Schrock <sschrock@google.com> * trim the status json file Signed-off-by: Spencer Schrock <sschrock@google.com> --------- Signed-off-by: Spencer Schrock <sschrock@google.com>

commit 00da7a8be965c09d044f978d6b9eafee1350bd30 Author: Azeem Shaikh <azeemshaikh38@gmail.com> Date: Tue Mar 14 23:07:19 2023 +0000 Pr comments commit 1127dd9 Merge: 274448f 23bd295 Author: Azeem Shaikh <azeemshaikh38@gmail.com> Date: Wed Mar 15 04:23:32 2023 +0530 Merge branch 'main' into go-git commit 274448f Author: Azeem Shaikh <azeemshaikh38@gmail.com> Date: Tue Mar 14 22:52:30 2023 +0000 Initial implementation of go-git client Signed-off-by: Azeem Shaikh <azeemshaikh38@gmail.com> commit 23bd295 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 20:28:41 2023 +0000 :seedling: Bump github/codeql-action from 2.2.4 to 2.2.6 (ossf#2741) commit fc026ef Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 17:04:31 2023 +0000 :seedling: Bump github.com/google/ko from 0.12.0 to 0.13.0 in /tools (ossf#2742) commit 2e04214 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 14:02:34 2023 +0000 :seedling: Bump tj-actions/changed-files from 35.6.2 to 35.7.0 Bumps [tj-actions/changed-files](https://github.com/tj-actions/changed-files) from 35.6.2 to 35.7.0. - [Release notes](https://github.com/tj-actions/changed-files/releases) - [Changelog](https://github.com/tj-actions/changed-files/blob/main/HISTORY.md) - [Commits](tj-actions/changed-files@5ce975c...bd376fb) --- updated-dependencies: - dependency-name: tj-actions/changed-files dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> commit e36b590 Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue Mar 14 08:59:20 2023 -0500 :seedling: Bump actions/cache from 3.3.0 to 3.3.1 (ossf#2740) Bumps [actions/cache](https://github.com/actions/cache) from 3.3.0 to 3.3.1. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@940f3d7...88522ab) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> commit 6ff94eb Author: Gabriela Gutierrez <gabigutierrez@google.com> Date: Mon Mar 13 19:42:37 2023 +0000 :bug: Handle editable pip installs (ossf#2731) * fix: Handle editable pip install Editable pip installs (-e) should be considered secure if the package is installed from a local source or a remote source (VCS install) but pinned by commit hash. To keep the behaviour we have for normal pip installs, we need to guarantee the package dependencies are pinned by hash too. For normal pip installs, we verify that by using --require-hashes flag. Unfortunately, --require-hashes flag is not compatible with editable installs, so we use --no-deps flag to verify the dependencies are not installed since we can't verify if they are pinned. Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Editable pip install in GHA Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Editable pip install in Dockerfile Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Editable pip install in shell script Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * fix: Code complexity increase Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * fix: Simplify boolean return Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * docs: Add pip editable install references in comments Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * fix: Handle multiple packages in editable pip install Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Multi editable pip install in GHA Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Multi editable pip install in Dockerfile Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> * test: Multi editable pip install in shell script Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> --------- Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> commit 110e352 Author: raghavkaul <8695110+raghavkaul@users.noreply.github.com> Date: Mon Mar 13 11:13:50 2023 -0400 ✨ Gitlab support: RepoClient (ossf#2655) * Add make targets and E2E test target for GitLab only Signed-off-by: Raghav Kaul <raghavkaul@google.com> * Add GitLab support to RepoClient Signed-off-by: Raghav Kaul <raghavkaul@google.com> * Build * Make target for e2e-gitlab-token * Only run Gitlab tests in CI that don't require a token Signed-off-by: Raghav Kaul <raghavkaul@google.com> * Add tests Signed-off-by: Raghav Kaul <raghavkaul@google.com> * Remove spurious printf Signed-off-by: Raghav Kaul <raghavkaul@google.com> * 🐛 Check OSS Fuzz build file for Fuzzing check (ossf#2719) * Check OSS-Fuzz using project list Signed-off-by: Spencer Schrock <sschrock@google.com> * Use clients.RepoClient interface to perform the new OSS Fuzz check Signed-off-by: Spencer Schrock <sschrock@google.com> * wip: add eager client for better repeated lookup of projects Signed-off-by: Spencer Schrock <sschrock@google.com> * Split lazy and eager behavior into different implementations. Signed-off-by: Spencer Schrock <sschrock@google.com> * Add tests and benchmarks Signed-off-by: Spencer Schrock <sschrock@google.com> * Switch to always parsing JSON to determine if a project is present. The other approach of looking for a substring match would lead to false positives. Signed-off-by: Spencer Schrock <sschrock@google.com> * Add eager constructor to surface status file errors sooner. Signed-off-by: Spencer Schrock <sschrock@google.com> * Switch existing users to new OSS Fuzz client Signed-off-by: Spencer Schrock <sschrock@google.com> * Mark old method as deprecated in the godoc Signed-off-by: Spencer Schrock <sschrock@google.com> * remove unused comment. Signed-off-by: Spencer Schrock <sschrock@google.com> * Use new OSS Fuzz client in e2e test. Signed-off-by: Spencer Schrock <sschrock@google.com> * fix typo. Signed-off-by: Spencer Schrock <sschrock@google.com> * Fix potential path bug with test server. Signed-off-by: Spencer Schrock <sschrock@google.com> * Force include the two JSON files which were being ignored by .gitignore Signed-off-by: Spencer Schrock <sschrock@google.com> * trim the status json file Signed-off-by: Spencer Schrock <sschrock@google.com> --------- Signed-off-by: Spencer Schrock <sschrock@google.com> --------- Signed-off-by: Raghav Kaul <raghavkaul@google.com> Signed-off-by: Spencer Schrock <sschrock@google.com> Co-authored-by: Spencer Schrock <sschrock@google.com> commit 5625dda Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Sat Mar 11 17:14:42 2023 +0000 :seedling: Bump github.com/onsi/ginkgo/v2 from 2.8.3 to 2.9.0 in /tools Bumps [github.com/onsi/ginkgo/v2](https://github.com/onsi/ginkgo) from 2.8.3 to 2.9.0. - [Release notes](https://github.com/onsi/ginkgo/releases) - [Changelog](https://github.com/onsi/ginkgo/blob/master/CHANGELOG.md) - [Commits](onsi/ginkgo@v2.8.3...v2.9.0) --- updated-dependencies: - dependency-name: github.com/onsi/ginkgo/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> commit d591e38 Author: Spencer Schrock <sschrock@google.com> Date: Fri Mar 10 16:02:05 2023 -0800 🌱 Add RepoClient re-use E2E tests. (ossf#2625) * Add e2e test for re-used repoclient. Signed-off-by: Spencer Schrock <sschrock@google.com> * Improve diff logging Signed-off-by: Spencer Schrock <sschrock@google.com> * Skip scorecard e2e test during unit tests. Signed-off-by: Spencer Schrock <sschrock@google.com> * Fix linter. Signed-off-by: Spencer Schrock <sschrock@google.com> --------- Signed-off-by: Spencer Schrock <sschrock@google.com> commit a7e81bb Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri Mar 10 08:20:28 2023 -0600 :seedling: Bump actions/cache from 3.2.6 to 3.3.0 (ossf#2738) Bumps [actions/cache](https://github.com/actions/cache) from 3.2.6 to 3.3.0. - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](actions/cache@69d9d44...940f3d7) --- updated-dependencies: - dependency-name: actions/cache dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

raghavkaul requested review from azeemshaikh38, justaugustus, laurentsimon, naveensrinivasan and spencerschrock as code owners February 13, 2023 16:43

raghavkaul had a problem deploying to integration-test February 13, 2023 16:44 — with GitHub Actions Failure

raghavkaul force-pushed the gitlab_tests branch from 924585a to 539b412 Compare February 13, 2023 16:45

raghavkaul had a problem deploying to integration-test February 13, 2023 16:46 — with GitHub Actions Failure

laurentsimon approved these changes Feb 13, 2023

View reviewed changes

checker/client.go Outdated Show resolved Hide resolved

raghavkaul had a problem deploying to integration-test February 16, 2023 19:20 — with GitHub Actions Failure

github-actions bot added the no-pr-activity label Feb 27, 2023

raghavkaul had a problem deploying to integration-test February 28, 2023 00:44 — with GitHub Actions Failure

raghavkaul removed the no-pr-activity label Feb 28, 2023

raghavkaul had a problem deploying to integration-test February 28, 2023 20:34 — with GitHub Actions Failure

raghavkaul had a problem deploying to integration-test March 1, 2023 18:55 — with GitHub Actions Failure

raghavkaul force-pushed the gitlab_tests branch from 70a412d to ec4d26f Compare March 1, 2023 21:13

raghavkaul had a problem deploying to integration-test March 1, 2023 21:13 — with GitHub Actions Failure

raghavkaul mentioned this pull request Mar 1, 2023

✨ Gitlab support (Part 2) - Tests #2280

Closed

raghavkaul had a problem deploying to integration-test March 2, 2023 21:30 — with GitHub Actions Failure

raghavkaul had a problem deploying to integration-test March 2, 2023 21:32 — with GitHub Actions Failure

azeemshaikh38 requested changes Mar 2, 2023

View reviewed changes

raghavkaul temporarily deployed to integration-test March 2, 2023 23:04 — with GitHub Actions Inactive

raghavkaul force-pushed the gitlab_tests branch from 59ec00a to 23b44a8 Compare March 9, 2023 17:55

raghavkaul temporarily deployed to integration-test March 9, 2023 17:55 — with GitHub Actions Inactive

raghavkaul changed the title ~~🌱 Gitlab support: Tests~~ ✨ Gitlab support: RepoClient Mar 9, 2023

raghavkaul mentioned this pull request Mar 9, 2023

How to configure policy.yml for a run? ossf/scorecard-action#1098

Closed

Add make targets and E2E test target for GitLab only

c612630

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

raghavkaul force-pushed the gitlab_tests branch from 23b44a8 to 17b77fc Compare March 9, 2023 18:26

raghavkaul temporarily deployed to integration-test March 9, 2023 18:27 — with GitHub Actions Inactive

raghavkaul force-pushed the gitlab_tests branch from 17b77fc to 3a7a8e5 Compare March 9, 2023 18:46

raghavkaul had a problem deploying to integration-test March 9, 2023 18:46 — with GitHub Actions Failure

Add GitLab support to RepoClient

533dc3e

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

raghavkaul force-pushed the gitlab_tests branch from 3a7a8e5 to 533dc3e Compare March 9, 2023 18:57

raghavkaul temporarily deployed to integration-test March 9, 2023 18:58 — with GitHub Actions Inactive

azeemshaikh38 approved these changes Mar 9, 2023

View reviewed changes

raghavkaul and others added 4 commits March 10, 2023 20:47

Build

8c33301

* Make target for e2e-gitlab-token * Only run Gitlab tests in CI that don't require a token Signed-off-by: Raghav Kaul <raghavkaul@google.com>

Add tests

57298ba

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

Remove spurious printf

cea0526

Signed-off-by: Raghav Kaul <raghavkaul@google.com>

raghavkaul temporarily deployed to integration-test March 10, 2023 21:00 — with GitHub Actions Inactive

Merge branch 'main' into gitlab_tests

eb0d15b

raghavkaul temporarily deployed to integration-test March 13, 2023 15:02 — with GitHub Actions Inactive

raghavkaul merged commit 110e352 into ossf:main Mar 13, 2023

raghavkaul deleted the gitlab_tests branch March 13, 2023 15:14

pnacht mentioned this pull request Mar 23, 2023

Feature: Add a summary of relevant changes to releases or to a CHANGELOG file #2784

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Gitlab support: RepoClient #2655

✨ Gitlab support: RepoClient #2655

raghavkaul commented Feb 13, 2023

codecov bot commented Feb 16, 2023 •

edited

github-actions bot commented Feb 27, 2023

azeemshaikh38 left a comment

azeemshaikh38 left a comment

✨ Gitlab support: RepoClient #2655

✨ Gitlab support: RepoClient #2655

Conversation

raghavkaul commented Feb 13, 2023

What kind of change does this PR introduce?

What is the current behavior?

Which issue(s) this PR fixes

Does this PR introduce a user-facing change?

Release Notes

codecov bot commented Feb 16, 2023 • edited

Codecov Report

github-actions bot commented Feb 27, 2023

azeemshaikh38 left a comment

Choose a reason for hiding this comment

azeemshaikh38 left a comment

Choose a reason for hiding this comment

codecov bot commented Feb 16, 2023 •

edited