diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 568fef3..8c10870 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -13,12 +13,12 @@ name: "CodeQL" on: push: - branches: [ main, '*' ] + branches: [main, "*"] pull_request: # The branches below must be a subset of the branches above - branches: [ main ] + branches: [main] schedule: - - cron: '30 0 * * 2' + - cron: "30 0 * * 2" permissions: read-all @@ -34,38 +34,38 @@ jobs: strategy: fail-fast: false matrix: - language: [ 'go' ] + language: ["go"] # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] # Learn more about CodeQL language support at https://git.io/codeql-language-support steps: - - name: Checkout repository - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2 + - name: Checkout repository + uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2 - # Initializes the CodeQL tools for scanning. - - name: Initialize CodeQL - uses: github/codeql-action/init@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 - with: - languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - # queries: ./path/to/local/query, your-org/your-repo/queries@main + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main - # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). - # If this step fails, then you should remove it and run the build manually (see below) - - name: Autobuild - uses: github/codeql-action/autobuild@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 - # ℹī¸ Command-line programs to run using the OS shell. - # 📚 https://git.io/JvXDl + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 + # Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl - # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines - # and modify them (or add more) to build your code if your project - # uses a compiled language + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language - #- run: | - # make bootstrap - # make release + # - run: | + # make bootstrap + # make release - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 diff --git a/.github/workflows/pre-submit.cli.yml b/.github/workflows/pre-submit.cli.yml index 9549c1d..e798313 100644 --- a/.github/workflows/pre-submit.cli.yml +++ b/.github/workflows/pre-submit.cli.yml @@ -1,12 +1,12 @@ name: Pre submits cli -on: +on: pull_request: - branches: [ "main" ] + branches: ["main"] workflow_dispatch: # Used in combination with schedule.cli.yml # to avoid duplicating the test code. schedule: - - cron: '25 6 * * 5' + - cron: "25 6 * * 5" permissions: read-all @@ -20,7 +20,7 @@ jobs: - name: setup-go uses: actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f # tag=v3.3.1 with: - go-version: '1.18' + go-version: "1.18" - name: Save event name env: diff --git a/.github/workflows/pre-submit.lint.yml b/.github/workflows/pre-submit.lint.yml index cad42fa..dd55d89 100644 --- a/.github/workflows/pre-submit.lint.yml +++ b/.github/workflows/pre-submit.lint.yml @@ -7,6 +7,45 @@ permissions: contents: read jobs: + golangci-lint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 + - uses: actions/setup-go@c4a742cab115ed795e34d4513e2cf7d472deb55f # tag=v3.3.1 + with: + go-version: "1.18" + - env: + GOLANGCI_LINT_VERSION: "1.46.2" + GOLANGCI_LINT_CHECKSUM: "242cd4f2d6ac0556e315192e8555784d13da5d1874e51304711570769c4f2b9b" + run: | + set -euo pipefail + + #Install golangci-lint + curl -sSLo golangci-lint.tar.gz "https://github.com/golangci/golangci-lint/releases/download/v${GOLANGCI_LINT_VERSION}/golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64.tar.gz" + echo "golangci-lint checksum is $(sha256sum golangci-lint.tar.gz | awk '{ print $1 }')" + echo "expected checksum is $GOLANGCI_LINT_CHECKSUM" + echo "$GOLANGCI_LINT_CHECKSUM golangci-lint.tar.gz" | sha256sum --strict --check --status || exit -2 + tar xf golangci-lint.tar.gz + mv golangci-lint-${GOLANGCI_LINT_VERSION}-linux-amd64/golangci-lint /usr/local/bin + + # Run golangci-lint + make golangci-lint + + yamllint: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # tag=v3.1.0 + - env: + YAMLLINT_VERSION: "1.26.3" + run: | + set -euo pipefail + + # Install yamllint + pip install "yamllint==${YAMLLINT_VERSION}" + + # Run yamllint + make yamllint + eslint: runs-on: ubuntu-latest steps: @@ -14,5 +53,4 @@ jobs: - uses: actions/setup-node@v3 with: node-version: 16 - - working-directory: actions/installer - run: make lint + - run: make eslint diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 48dc177..6467ae5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,6 +1,6 @@ name: Verifier releaser -on: +on: # For manual tests. workflow_dispatch: push: @@ -8,7 +8,7 @@ on: - "*" # triggers only if push new tag version, like `0.8.4`. # Run daily as a dry-run/test. schedule: - - cron: '0 1 * * *' + - cron: "0 1 * * *" permissions: read-all diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml index 6459b60..63d6dfb 100644 --- a/.github/workflows/scorecards.yml +++ b/.github/workflows/scorecards.yml @@ -3,9 +3,9 @@ on: # Only the default branch is supported. branch_protection_rule: schedule: - - cron: '25 6 * * 5' + - cron: "25 6 * * 5" push: - branches: [ "main" ] + branches: ["main"] # Declare default permissions as read only. permissions: read-all @@ -22,7 +22,7 @@ jobs: # Needs for private repositories. contents: read actions: read - + steps: - name: "Checkout code" uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # tag=v3.1.2 @@ -41,8 +41,8 @@ jobs: # repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} # Publish the results for public repositories to enable scorecard badges. For more details, see - # https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories, `publish_results` will automatically be set to `false`, regardless + # https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories, `publish_results` will automatically be set to `false`, regardless # of the value entered here. publish_results: true @@ -54,7 +54,7 @@ jobs: name: SARIF file path: results.sarif retention-days: 5 - + # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" uses: github/codeql-action/upload-sarif@4238421316c33d73aeea2801274dd286f157c2bb # v2.1.32 diff --git a/.golangci.yml b/.golangci.yml new file mode 100644 index 0000000..4a87fc7 --- /dev/null +++ b/.golangci.yml @@ -0,0 +1,173 @@ +--- +run: + concurrency: 2 + deadline: 5m +issues: + include: + - EXC0012 + - EXC0013 + - EXC0014 + - EXC0015 + # Maximum issues count per one linter. + # Set to 0 to disable. + # Default: 50 + max-issues-per-linter: 0 + # Maximum count of issues with the same text. + # Set to 0 to disable. + # Default: 3 + max-same-issues: 0 + new-from-rev: "" +linters: + disable-all: true + enable: + - asciicheck + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - deadcode + - depguard + - dogsled + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - errcheck + - errorlint + - exhaustive + - exportloopref + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - gci + - gochecknoinits + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - gocognit + - goconst + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - gocritic + - gocyclo + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - godot + - godox + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - goerr113 + - gofmt + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - gofumpt + - goheader + - goimports + - gomodguard + - goprintffuncname + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - gosec + - gosimple + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - govet + - ineffassign + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - lll + - makezero + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - misspell + - nakedret + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - nestif + - nolintlint + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - paralleltest + - predeclared + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - revive + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - staticcheck + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - stylecheck + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - thelper + - typecheck + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - unconvert + - unused + - varcheck + - whitespace + # TODO(https://github.com/slsa-framework/slsa-verifier/issues/363): Restore linter + # - wrapcheck +linters-settings: + errcheck: + check-type-assertions: true + check-blank: true + govet: + enable: + - fieldalignment + godox: + keywords: + - BUG + - FIXME + - HACK + gci: + sections: + - standard + - default + - prefix(github.com/slsa-framework/slsa-github-generator) + gocritic: + enabled-checks: + # Diagnostic + - appendAssign + - argOrder + - badCond + - caseOrder + - codegenComment + - commentedOutCode + - deprecatedComment + - dupArg + - dupBranchBody + - dupCase + - dupSubExpr + - exitAfterDefer + - flagDeref + - flagName + - nilValReturn + - offBy1 + - sloppyReassign + - weakCond + - octalLiteral + + # Performance + - appendCombine + - equalFold + - hugeParam + - indexAlloc + - rangeExprCopy + - rangeValCopy + + # Style + - assignOp + - boolExprSimplify + - captLocal + - commentFormatting + - commentedOutImport + - defaultCaseOrder + - docStub + - elseif + - emptyFallthrough + - emptyStringTest + - hexLiteral + - ifElseChain + - methodExprCall + - regexpMust + - singleCaseSwitch + - sloppyLen + - stringXbytes + - switchTrue + - typeAssertChain + - typeSwitchVar + - underef + - unlabelStmt + - unlambda + - unslice + - valSwap + - wrapperFunc + - yodaStyleExpr + + # Opinionated + - builtinShadow + - importShadow + - initClause + - nestingReduce + - paramTypeCombine + - ptrToRefParam + - typeUnparen + - unnecessaryBlock diff --git a/.yamllint.yaml b/.yamllint.yaml new file mode 100644 index 0000000..7b236cd --- /dev/null +++ b/.yamllint.yaml @@ -0,0 +1,17 @@ +--- +extends: default + +ignore: | + node_modules/ + vendor/ + +rules: + comments: + # prettier formats comments one space from content + min-spaces-from-content: 1 + document-start: disable + line-length: disable + truthy: + allowed-values: ["true", "false"] + # Allow Github Actions keys like 'on' + check-keys: false diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..ea44459 --- /dev/null +++ b/Makefile @@ -0,0 +1,57 @@ +SHELL := /bin/bash +OUTPUT_FORMAT = $(shell if [ "${GITHUB_ACTIONS}" == "true" ]; then echo "github"; else echo ""; fi) + +.PHONY: help +help: ## Shows all targets and help from the Makefile (this message). + @echo "slsa-github-generator Makefile" + @echo "Usage: make [COMMAND]" + @echo "" + @grep --no-filename -E '^([/a-z.A-Z0-9_%-]+:.*?|)##' $(MAKEFILE_LIST) | \ + awk 'BEGIN {FS = "(:.*?|)## ?"}; { \ + if (length($$1) > 0) { \ + printf " \033[36m%-20s\033[0m %s\n", $$1, $$2; \ + } else { \ + if (length($$2) > 0) { \ + printf "%s\n", $$2; \ + } \ + } \ + }' + +## Testing +##################################################################### + +.PHONY: unit-test +unit-test: ## Runs all unit tests. + # Run unit tests for the detect-workflow action. + make -C .github/actions/detect-workflow/ unit-test + go mod vendor + go test -mod=vendor -v ./... + + +## Linters +##################################################################### + +.PHONY: lint +lint: golangci-lint eslint yamllint ## Run all linters. + +.PHONY: golangci-lint +golangci-lint: ## Runs the golangci-lint linter. + @set -e;\ + extraargs=""; \ + if [ "$(OUTPUT_FORMAT)" == "github" ]; then \ + extraargs="--out-format github-actions"; \ + fi; \ + golangci-lint run -c .golangci.yml ./... $$extraargs + +.PHONY: eslint +eslint: ## Runs the eslint linter. + make -C actions/installer lint + +.PHONY: yamllint +yamllint: ## Runs the yamllint linter. + @set -e;\ + extraargs=""; \ + if [ "$(OUTPUT_FORMAT)" == "github" ]; then \ + extraargs="-f github"; \ + fi; \ + yamllint -c .yamllint.yaml . $$extraargs diff --git a/cli/slsa-verifier/main_test.go b/cli/slsa-verifier/main_test.go index fb69a3a..41c3930 100644 --- a/cli/slsa-verifier/main_test.go +++ b/cli/slsa-verifier/main_test.go @@ -770,7 +770,6 @@ func Test_runVerifyGHAArtifactImage(t *testing.T) { t.Errorf(fmt.Sprintf("matches failed: %v", err)) } } - } }) }