multi-repo-action: Cleanups (1/n) by justaugustus · Pull Request #301 · ossf/scorecard-action

justaugustus · 2022-05-15T18:42:47Z

install: Move action installation into a separate package
Add missing license headers
install: Fix unrecognized variables
lint: Fix warnings and attempt to auto-fix issues (where supported)
install: Parameterize config
install: Borrow GitHub client pattern from sigs.k8s.io/release-sdk
install: Use package-internal GitHub interface
install: Provide installation options as struct
install: Initial error/log handling cleanups
install: Use cobra for CLI
Remove inaccurate instances of workflow configuration file
multi-repo-action: Disable incomplete tests
install: Retrieve the correct action configuration from local path

Signed-off-by: Stephen Augustus foo@auggie.dev

azeemshaikh38

Thanks!

multi-repo-action/org-workflow-add.go

codecov · 2022-05-24T22:32:21Z

Codecov Report

Merging #301 (5d6b3d6) into main (adf2f6d) will decrease coverage by 1.47%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main     #301      +/-   ##
==========================================
- Coverage   61.95%   60.47%   -1.48%     
==========================================
  Files           3        4       +1     
  Lines         205      210       +5     
==========================================
  Hits          127      127              
- Misses         69       74       +5     
  Partials        9        9

Impacted Files	Coverage Δ
multi-repo-action/main.go	`0.00% <0.00%> (ø)`
signing/signing.go	`30.76% <ø> (ø)`

Signed-off-by: Stephen Augustus <foo@auggie.dev>

justaugustus · 2022-05-24T23:09:04Z

Before:

❯ GITHUB_TOKEN=$(cat ~/.github-token) go run multi-repo-action/org-workflow-add.go
# command-line-arguments
multi-repo-action/org-workflow-add.go:31:9: undefined: REPO_LIST
multi-repo-action/org-workflow-add.go:38:23: undefined: REPO_LIST
multi-repo-action/org-workflow-add.go:47:27: undefined: REPO_LIST

After this pull request:

❯ GITHUB_TOKEN=$(cat ~/.github-token) go run multi-repo-action/main.go --owner uwu-tools
2022/05/24 19:03:41 skipped repo (go-ghcrawl) because new branch could not be created: creating git reference: POST https://api.github.com/repos/uwu-tools/go-ghcrawl/git/refs: 404 Not Found []

So, things are still broken, but less broken than "will not run at all"!
A good place to merge and iterate on the next details :)

justaugustus · 2022-05-24T23:15:08Z

A note on code coverage...
While I won't normally suggest it, I'd love to merge in spite of the current decrease in coverage.

These tests were incomplete/broken before, but that was masked by either the fact that:

the main file was not idiomatically-named OR
the main file could not execute in its previous state

The program is still incomplete, so there's some thought to be had about what should be tested

laurentsimon

Thanks

install/github/github.go

starter-workflows/code-scanning/scorecards.yml

* Removed Sarif Results From Processing & Rekor Upload (#197) * test action * sign test data * func to sign and upload workflow result * added signScorecardResult func and test * added signScorecardResult func and test * moved signing code into main.go * added call to signScorecardResult at the end of main * added err checking * comments and added global vars * style changes * updated test to use randomized payload * check publish_results * error logging for signScorecardResult call * error logging * entrypoint * updated dockerfile * dockerfile * dockerfile * EnvInputsResults vars added to Options * resultsfile env var * set PAT * create results file with sudo * sudo create resultsfile * try os.Openfile * fixed fileapth * changed Distroless to debian * get output format from env var * fixed defaultpolicyfile path * policy filepath * copy policy.yml in dockerfile * policyfile * moved signing code to separate file * dockerfile * generate results.json file in preRun * revert dockerfile to main * json file creation check * run scorecard again to produce json output * testing * entrypointJson * print cmd * alter env vars in main for json * opts * dockerfile uses entrypoint.go * renamed make build * produce both sarif and json * sign json result * sig verification api call * go mod tidy * readfile fix * sign sarif instead of json * http response code checking * moved api call func into signing.go * dont hardcode repo paths * finalized signing + verif * renamed sign test * Bump debian from d5cd7e5 to 40f90ea * removed unnecessary slash * comments * policy.yml -> /policy.yml * refractored signing * more refractoring + sig processing test * fixed func call * fixed sign test * style + error fmt * reverted dockerfile * style fixes * lint fixes * linting errs * test workflow permissions * debug print * commented out signing test * linting errors Co-authored-by: Azeem Shaikh <azeemshaikh38@gmail.com> * Add initial release documentation (#194) Signed-off-by: Stephen Augustus <foo@auggie.dev> * 🌱 Bump codecov/codecov-action from 3.0.0 to 3.1.0 Bumps [codecov/codecov-action](https://github.com/codecov/codecov-action) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/codecov/codecov-action/releases) - [Changelog](https://github.com/codecov/codecov-action/blob/master/CHANGELOG.md) - [Commits](codecov/codecov-action@e3c5604...81cd2dc) --- updated-dependencies: - dependency-name: codecov/codecov-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * ✨ Update documentation (#203) * set GITHUB_TOKEN as default token * updates * Update doc * Update doc * updates * updates * update * update * update * update * updates * Update doc with PAT for private repos (#205) * Update doc with PAT for private repos * Update README.md * Update README.md * Update README.md * Log repo_info.json File in entrypoint.sh (#211) * test action * log repo_json file * check status >=300 * log json * fixed conditional * fixed or * fixed or * spacing * remove file before exit * always print repo_info * 🌱 Bump github/codeql-action from 2.1.8 to 2.1.9 (#231) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.8 to 2.1.9. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@1ed1437...7502d6e) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update Scorecard version to v4.2.0 in Golang (#247) Co-authored-by: Azeem Shaikh <azeems@google.com> * 🌱 Bump openssf/scorecard from v4.1.0 to v4.2.0 (#249) Bumps openssf/scorecard from v4.1.0 to v4.2.0. --- updated-dependencies: - dependency-name: openssf/scorecard dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Update hash to latest scorecard (#276) Update hash to latest scorecard * ✨ Amend documentation for private repos (#286) * update * update * update * update (#293) * 🌱 Bump debian from `f75d8a3` to `fbaacd5` (#287) Bumps debian from `f75d8a3` to `fbaacd5`. --- updated-dependencies: - dependency-name: debian dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * 🌱 Bump github.com/sigstore/cosign from 1.7.2 to 1.8.0 (#212) Bumps [github.com/sigstore/cosign](https://github.com/sigstore/cosign) from 1.7.2 to 1.8.0. - [Release notes](https://github.com/sigstore/cosign/releases) - [Changelog](https://github.com/sigstore/cosign/blob/main/CHANGELOG.md) - [Commits](sigstore/cosign@v1.7.2...v1.8.0) --- updated-dependencies: - dependency-name: github.com/sigstore/cosign dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * 🌱 Bump github.com/caarlos0/env/v6 from 6.9.1 to 6.9.2 Bumps [github.com/caarlos0/env/v6](https://github.com/caarlos0/env) from 6.9.1 to 6.9.2. - [Release notes](https://github.com/caarlos0/env/releases) - [Changelog](https://github.com/caarlos0/env/blob/main/.goreleaser.yml) - [Commits](caarlos0/env@v6.9.1...v6.9.2) --- updated-dependencies: - dependency-name: github.com/caarlos0/env/v6 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump github/codeql-action from 2.1.9 to 2.1.10 (#305) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.1.9 to 2.1.10. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](github/codeql-action@7502d6e...2f58583) --- updated-dependencies: - dependency-name: github/codeql-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * 🌱 Bump golangci/golangci-lint-action from 3.1.0 to 3.2.0 Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 3.1.0 to 3.2.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](golangci/golangci-lint-action@b517f99...537aa19) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump actions/setup-go from 3.0.0 to 3.1.0 Bumps [actions/setup-go](https://github.com/actions/setup-go) from 3.0.0 to 3.1.0. - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](actions/setup-go@f6164bd...fcdc436) --- updated-dependencies: - dependency-name: actions/setup-go dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * 🌱 Bump github.com/google/go-cmp from 0.5.7 to 0.5.8 (#206) * Update container hash for v1.1.0 (#314) * multi-repo-action: Cleanups (1/n) (#301) - install: Move action installation into a separate package - Add missing license headers - install: Fix unrecognized variables - lint: Fix warnings and attempt to auto-fix issues (where supported) - install: Parameterize config - install: Borrow GitHub client pattern from sigs.k8s.io/release-sdk - install: Use package-internal GitHub interface - install: Provide installation options as struct - install: Initial error/log handling cleanups - install: Use cobra for CLI - Remove inaccurate instances of workflow configuration file - multi-repo-action: Disable incomplete tests - install: Retrieve the correct action configuration from local path Signed-off-by: Stephen Augustus <foo@auggie.dev> Co-authored-by: Rohan Khandelwal <98796241+rohankh532@users.noreply.github.com> Co-authored-by: Stephen Augustus (he/him) <justaugustus@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: laurentsimon <64505099+laurentsimon@users.noreply.github.com> Co-authored-by: Azeem Shaikh <azeems@google.com>

- install: Move action installation into a separate package - Add missing license headers - install: Fix unrecognized variables - lint: Fix warnings and attempt to auto-fix issues (where supported) - install: Parameterize config - install: Borrow GitHub client pattern from sigs.k8s.io/release-sdk - install: Use package-internal GitHub interface - install: Provide installation options as struct - install: Initial error/log handling cleanups - install: Use cobra for CLI - Remove inaccurate instances of workflow configuration file - multi-repo-action: Disable incomplete tests - install: Retrieve the correct action configuration from local path Signed-off-by: Stephen Augustus <foo@auggie.dev>

justaugustus force-pushed the multi-action-cleanup branch from 77772ae to 1c56892 Compare May 15, 2022 19:14

azeemshaikh38 approved these changes May 15, 2022

View reviewed changes

laurentsimon reviewed May 17, 2022

View reviewed changes

multi-repo-action/org-workflow-add.go Outdated Show resolved Hide resolved

justaugustus force-pushed the multi-action-cleanup branch 3 times, most recently from 442d418 to f11dc39 Compare May 24, 2022 19:32

justaugustus changed the title ~~[WIP] multi-repo-action cleanups~~ multi-repo-action: Cleanups (1/n) May 24, 2022

justaugustus force-pushed the multi-action-cleanup branch from e0984d7 to 4bf14ad Compare May 24, 2022 22:43

justaugustus added 13 commits May 24, 2022 18:43

install: Move action installation into a separate package

da95e0c

Signed-off-by: Stephen Augustus <foo@auggie.dev>

Add missing license headers

4b4094a

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Fix unrecognized variables

1339897

Signed-off-by: Stephen Augustus <foo@auggie.dev>

lint: Fix warnings and attempt to auto-fix issues (where supported)

2ec5c83

Signed-off-by: Stephen Augustus <foo@auggie.dev>

[WIP] install: Parameterize config

b18a594

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Borrow GitHub client pattern from sigs.k8s.io/release-sdk

e1d3f97

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Use package-internal GitHub interface

101ac57

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Provide installation options as struct

48ca3f3

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Initial error/log handling cleanups

8389474

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Use cobra for CLI

502112a

Signed-off-by: Stephen Augustus <foo@auggie.dev>

Remove inaccurate instances of workflow configuration file

0072df3

Signed-off-by: Stephen Augustus <foo@auggie.dev>

multi-repo-action: Disable incomplete tests

bb52c12

Signed-off-by: Stephen Augustus <foo@auggie.dev>

install: Retrieve the correct action configuration from local path

5d6b3d6

Signed-off-by: Stephen Augustus <foo@auggie.dev>

justaugustus force-pushed the multi-action-cleanup branch from 4bf14ad to 5d6b3d6 Compare May 24, 2022 22:44

justaugustus requested review from azeemshaikh38 and laurentsimon May 24, 2022 23:09

laurentsimon approved these changes May 24, 2022

View reviewed changes

install/github/github.go Show resolved Hide resolved

starter-workflows/code-scanning/scorecards.yml Show resolved Hide resolved

justaugustus enabled auto-merge (squash) May 24, 2022 23:25

justaugustus mentioned this pull request May 24, 2022

Generate workflow config file before releases #315

Open

justaugustus merged commit 5c8bc69 into ossf:main May 24, 2022

justaugustus mentioned this pull request May 25, 2022

Update to hash #63

Closed

naveensrinivasan mentioned this pull request Jul 26, 2022

Organization-wide Workflow Add Instructions #773

Closed

justaugustus mentioned this pull request Aug 20, 2022

cmd/installer: Cleanups (2/n) #833

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

multi-repo-action: Cleanups (1/n)#301

multi-repo-action: Cleanups (1/n)#301
justaugustus merged 13 commits intoossf:mainfrom
justaugustus:multi-action-cleanup

justaugustus commented May 15, 2022 •

edited

Loading

Uh oh!

azeemshaikh38 left a comment

Uh oh!

Uh oh!

codecov bot commented May 24, 2022 •

edited

Loading

Uh oh!

justaugustus commented May 24, 2022

Uh oh!

justaugustus commented May 24, 2022

Uh oh!

laurentsimon left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

justaugustus commented May 15, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azeemshaikh38 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov bot commented May 24, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

justaugustus commented May 24, 2022

Uh oh!

justaugustus commented May 24, 2022

Uh oh!

laurentsimon left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

justaugustus commented May 15, 2022 •

edited

Loading

codecov bot commented May 24, 2022 •

edited

Loading