Skip to content

Commit 6fad417

Browse files
ljones140ljones140
authored
Merge pull request #978 from actions/ljones140/make-ruby-code-scannable
Make Ruby Code Scannable
2 parents 595b5ae + e86e969 commit 6fad417

File tree

3 files changed

+135
-86
lines changed

3 files changed

+135
-86
lines changed

‎.github/workflows/codeql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
strategy:
2121
fail-fast: false
2222
matrix:
23-
language: [ 'javascript-typescript', 'actions' ]
23+
language: [ 'javascript-typescript', 'actions', 'ruby' ]
2424

2525
steps:
2626
- name: Checkout repository
@@ -38,7 +38,7 @@ jobs:
3838
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
3939
# queries: security-extended,security-and-quality
4040
config: |
41-
paths-ignore:
41+
paths-ignore:
4242
- dist/index.js
4343
- dist/sourcemap-register.js
4444

‎scripts/scan_pr‎

Lines changed: 5 additions & 84 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,8 @@
11
#!/usr/bin/env ruby
2-
require 'json'
3-
require 'tempfile'
4-
require 'open3'
5-
require 'bundler/inline'
6-
require 'optparse'
72

8-
gemfile do
9-
source 'https://rubygems.org'
10-
gem 'octokit'
11-
end
3+
# Load the scan_pr library
4+
require_relative 'scan_pr_lib'
125

13-
config_file = nil
14-
github_token = ENV["GITHUB_TOKEN"]
15-
16-
if !github_token || github_token.empty?
17-
puts "Please set the GITHUB_TOKEN environment variable"
18-
exit -1
19-
end
20-
21-
op = OptionParser.new do |opts|
22-
usage = <<EOF
23-
Run Dependency Review on a repository.
24-
25-
\e[1mUsage:\e[22m
26-
scripts/scan_pr [options] <pr_url>
27-
28-
\e[1mExample:\e[22m
29-
scripts/scan_pr https://github.com/actions/dependency-review-action/pull/294
30-
31-
EOF
32-
33-
opts.banner = usage
34-
35-
opts.on('-c', '--config-file <FILE>', 'Use an external configuration file') do |cf|
36-
config_file = cf
37-
end
38-
39-
opts.on("-h", "--help", "Prints this help") do
40-
puts opts
41-
exit
42-
end
43-
end
44-
45-
op.parse!
46-
47-
# make sure we have a NWO somewhere in the parameters
48-
arg = /(?<repo_nwo>[\w\-]+\/[\w\-]+)\/pull\/(?<pr_number>\d+)/.match(ARGV.join(" "))
49-
50-
if arg.nil?
51-
puts op
52-
exit -1
53-
end
54-
55-
repo_nwo = arg[:repo_nwo]
56-
pr_number = arg[:pr_number]
57-
58-
octo = Octokit::Client.new(access_token: github_token)
59-
pr = octo.pull_request(repo_nwo, pr_number)
60-
61-
event_file = Tempfile.new
62-
event_file.write("{ \"pull_request\": #{pr.to_h.to_json}}")
63-
event_file.close
64-
65-
action_inputs = {
66-
"repo-token": github_token,
67-
"config-file": config_file
68-
}
69-
70-
dev_cmd_env = {
71-
"GITHUB_REPOSITORY" => repo_nwo,
72-
"GITHUB_EVENT_NAME" => "pull_request",
73-
"GITHUB_EVENT_PATH" => event_file.path,
74-
"GITHUB_STEP_SUMMARY" => "/dev/null"
75-
}
76-
77-
# bash does not like variable names with dashes like the ones Actions
78-
# uses (e.g. INPUT_REPO-TOKEN). Passing them through `env` instead of
79-
# manually setting them does the job.
80-
action_inputs_env_str = action_inputs.map { |name, value| "\"INPUT_#{name.upcase}=#{value}\"" }.join(" ")
81-
dev_cmd = "./node_modules/.bin/nodemon --exec \"env #{action_inputs_env_str} node -r esbuild-register\" src/main.ts"
82-
83-
Open3.popen2e(dev_cmd_env, dev_cmd) do |stdin, out|
84-
while line = out.gets
85-
puts line.gsub(github_token, "<REDACTED>")
86-
end
87-
end
6+
# Create and run the scanner
7+
scanner = ScanPr.new
8+
scanner.run(ARGV)

‎scripts/scan_pr_lib.rb‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
require 'json'
2+
require 'tempfile'
3+
require 'open3'
4+
require 'bundler/inline'
5+
require 'optparse'
6+
7+
gemfile do
8+
source 'https://rubygems.org'
9+
gem 'octokit'
10+
end
11+
12+
class ScanPr
13+
def initialize
14+
@config_file = nil
15+
@github_token = ENV["GITHUB_TOKEN"]
16+
17+
validate_token
18+
end
19+
20+
def run(args)
21+
parse_options(args)
22+
repo_nwo, pr_number = extract_repo_and_pr(args)
23+
24+
pr = fetch_pull_request(repo_nwo, pr_number)
25+
event_file = create_event_file(pr)
26+
27+
execute_dependency_review(repo_nwo, event_file)
28+
ensure
29+
event_file&.unlink
30+
end
31+
32+
private
33+
34+
def validate_token
35+
if !@github_token || @github_token.empty?
36+
puts "Please set the GITHUB_TOKEN environment variable"
37+
exit -1
38+
end
39+
end
40+
41+
def parse_options(args)
42+
op = OptionParser.new do |opts|
43+
usage = <<EOF
44+
Run Dependency Review on a repository.
45+
46+
\e[1mUsage:\e[22m
47+
scripts/scan_pr [options] <pr_url>
48+
49+
\e[1mExample:\e[22m
50+
scripts/scan_pr https://github.com/actions/dependency-review-action/pull/294
51+
52+
EOF
53+
54+
opts.banner = usage
55+
56+
opts.on('-c', '--config-file <FILE>', 'Use an external configuration file') do |cf|
57+
@config_file = cf
58+
end
59+
60+
opts.on("-h", "--help", "Prints this help") do
61+
puts opts
62+
exit
63+
end
64+
end
65+
66+
op.parse!(args)
67+
@option_parser = op
68+
end
69+
70+
def extract_repo_and_pr(args)
71+
# make sure we have a NWO somewhere in the parameters
72+
arg = /(?<repo_nwo>[\w\-]+\/[\w\-]+)\/pull\/(?<pr_number>\d+)/.match(args.join(" "))
73+
74+
if arg.nil?
75+
puts @option_parser
76+
exit -1
77+
end
78+
79+
[arg[:repo_nwo], arg[:pr_number]]
80+
end
81+
82+
def fetch_pull_request(repo_nwo, pr_number)
83+
octo = Octokit::Client.new(access_token: @github_token)
84+
octo.pull_request(repo_nwo, pr_number)
85+
end
86+
87+
def create_event_file(pr)
88+
event_file = Tempfile.new
89+
event_file.write("{ \"pull_request\": #{pr.to_h.to_json}}")
90+
event_file.close
91+
event_file
92+
end
93+
94+
def execute_dependency_review(repo_nwo, event_file)
95+
action_inputs = {
96+
"repo-token": @github_token,
97+
"config-file": @config_file
98+
}
99+
100+
dev_cmd_env = {
101+
"GITHUB_REPOSITORY" => repo_nwo,
102+
"GITHUB_EVENT_NAME" => "pull_request",
103+
"GITHUB_EVENT_PATH" => event_file.path,
104+
"GITHUB_STEP_SUMMARY" => "/dev/null"
105+
}
106+
107+
# Merge action inputs into environment, formatting keys as INPUT_...
108+
action_inputs_env = action_inputs.each_with_object({}) do |(name, value), h|
109+
h["INPUT_#{name.to_s.upcase}"] = value unless value.nil?
110+
end
111+
env = dev_cmd_env.merge(action_inputs_env)
112+
113+
dev_cmd = [
114+
"./node_modules/.bin/nodemon",
115+
"--exec",
116+
"node",
117+
"-r",
118+
"esbuild-register",
119+
"src/main.ts"
120+
]
121+
122+
Open3.popen2e(env, *dev_cmd) do |stdin, out|
123+
while line = out.gets
124+
puts line.gsub(@github_token, "<REDACTED>")
125+
end
126+
end
127+
end
128+
end

0 commit comments

Comments
 (0)