Skip to content

Commit ad75770

Browse files
rajbosrajbos
authored
Enable support for OpenSSF Badges instead of only scores
1 parent 16ea349 commit ad75770

File tree

11 files changed

+191
-24
lines changed

11 files changed

+191
-24
lines changed

‎.github/workflows/test_action_locally.yml‎

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
name: Test the action
2+
on:
3+
push:
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
normal-run:
10+
name: normal
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v3
14+
- uses: actions/setup-node@v3
15+
with:
16+
node-version: '16.19.0'
17+
cache: 'npm'
18+
19+
- name: Install dependencies
20+
run: npm ci
21+
22+
- name: Build
23+
run: npm run build
24+
25+
- name: Create the reporting folder
26+
run: mkdir reporting
27+
28+
- uses: ./ # uses the action in the current directory
29+
id: scorecard
30+
with:
31+
scope: reporting/scope.json
32+
database: reporting/database.json
33+
report: reporting/openssf-scorecard-report.md
34+
discovery-enabled: true
35+
discovery-orgs: UlisesGascon
36+
# The token is needed to create issues, discovery mode and pushing changes in files
37+
github-token: ${{ secrets.GITHUB_TOKEN }}
38+
39+
- name: Show output in job summary
40+
run: cat reporting/openssf-scorecard-report.md >> $GITHUB_STEP_SUMMARY
41+
42+
- name: Upload the output files
43+
uses: actions/upload-artifact@v3
44+
with:
45+
name: report
46+
path: reporting/*.*
47+
48+
# todo: test the result files to see if they have content that is correct
49+
- name: Test if the output files have content
50+
run: |
51+
# test if the markdown file has content
52+
if [ -s reporting/openssf-scorecard-report.md ]; then
53+
echo "The markdown file has content"
54+
else
55+
echo "The markdown file is empty"
56+
exit 1
57+
fi
58+
59+
# test if the database file has content
60+
if [ -s reporting/database.json ]; then
61+
echo "The database file has content"
62+
else
63+
echo "The database file is empty"
64+
exit 1
65+
fi
66+
67+
# test if the scope file has content
68+
if [ -s reporting/scope.json ]; then
69+
echo "The scope file has content"
70+
else
71+
echo "The scope file is empty"
72+
exit 1
73+
fi
74+
75+
- name: test the actions' output
76+
env:
77+
OUTPUT: ${{ steps.scorecard.outputs.scores }}
78+
run: |
79+
if [ -z "$OUTPUT" ]; then
80+
echo "The output of the action is empty"
81+
exit 1
82+
else
83+
echo "The output of the action is not empty, which is correct"
84+
fi
85+
86+
with-badges-run:
87+
name: wih OSSF badges
88+
runs-on: ubuntu-latest
89+
steps:
90+
- uses: actions/checkout@v3
91+
- uses: actions/setup-node@v3
92+
with:
93+
node-version: '16.19.0'
94+
cache: 'npm'
95+
96+
- name: Install dependencies
97+
run: npm ci
98+
99+
- name: Build
100+
run: npm run build
101+
102+
- name: Create the reporting folder
103+
run: mkdir reporting
104+
105+
- uses: ./ # uses the action in the current directory
106+
with:
107+
scope: reporting/scope.json
108+
database: reporting/database.json
109+
report: reporting/openssf-scorecard-report.md
110+
discovery-enabled: true
111+
discovery-orgs: UlisesGascon
112+
# The token is needed to create issues, discovery mode and pushing changes in files
113+
github-token: ${{ secrets.GITHUB_TOKEN }}
114+
render-badge: true
115+
116+
- name: Show output in job summary
117+
run: cat reporting/openssf-scorecard-report.md >> $GITHUB_STEP_SUMMARY
118+
119+
- name: Upload the output files
120+
uses: actions/upload-artifact@v3
121+
with:
122+
name: report
123+
path: reporting/*.*
124+
125+
# todo: test the result files to see if they have content that is correct
126+
- name: Test if the output files have content
127+
run: |
128+
# test if the markdown file has content
129+
if [ -s reporting/openssf-scorecard-report.md ]; then
130+
echo "The markdown file has content"
131+
else
132+
echo "The markdown file is empty"
133+
exit 1
134+
fi
135+
136+
# test if the database file has content
137+
if [ -s reporting/database.json ]; then
138+
echo "The database file has content"
139+
else
140+
echo "The database file is empty"
141+
exit 1
142+
fi
143+
144+
# test if the scope file has content
145+
if [ -s reporting/scope.json ]; then
146+
echo "The scope file has content"
147+
else
148+
echo "The scope file is empty"
149+
exit 1
150+
fi
151+
152+
- name: test the actions' output
153+
env:
154+
OUTPUT: ${{ steps.scorecard.outputs.scores }}
155+
run: |
156+
if [ -z "$OUTPUT" ]; then
157+
echo "The output of the action is empty"
158+
exit 1
159+
else
160+
echo "The output of the action is not empty, which is correct"
161+
fi

‎README.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -109,10 +109,10 @@ jobs:
109109
- `max-request-in-parallel`: Defines the total HTTP Request that can be done in parallel
110110
- `discovery-enabled`: Defined if the discovery is enabled
111111
- `discovery-orgs`: List of organizations to be includes in the discovery, example: `discovery-orgs: owasp,nodejs`. The OpenSSF Scorecard API is case sensitive, please use the same organization name as in the github url, like: https://github.com/NodeSecure is `NodeSecure` and not `nodesecure`. [See example](https://github.com/NodeSecure/Governance/issues/21#issuecomment-1474770986)
112-
- `report-tags-enabled`: Defines if the markdown report must be created/updated around tags by default is disabled. This is useful if the report is going to be include in a file that has other content on it, like docusaurus docs site or similar.
113-
- `report-start-tag`: Defines the start tag, default `<!-- OPENSSF-SCORECARD-MONITOR:START -->`
114-
- `report-end-tag` Defines the closing tag, default `<!-- OPENSSF-SCORECARD-MONITOR:END -->`
115-
112+
- `report-tags-enabled`: Defines if the markdown report must be created/updated around tags by default is disabled. This is useful if the report is going to be include in a file that has other content on it, like docusaurus docs site or similar
113+
- `report-start-tag` Defines the start tag, default `<!-- OPENSSF-SCORECARD-MONITOR:START -->`
114+
- `report-end-tag`: Defines the closing tag, default `<!-- OPENSSF-SCORECARD-MONITOR:END -->`
115+
- `render-badge`: Defines if the OpenSSF badge must be rendered in the reportor to only show the score
116116

117117
### Outputs
118118

‎action.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,10 @@ inputs:
5555
description: 'Maximum number of HTTP requests to be executed in parallel'
5656
required: false
5757
default: "10"
58+
render-badge:
59+
description: 'Render the OSSF badge in the report'
60+
required: false
61+
default: "false"
5862

5963
outputs:
6064
scores:

‎dist/index.js‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27711,7 +27711,7 @@ const generateScope = async ({ octokit, orgs, scope, maxRequestInParallel }) =>
2771127711
return newScope
2771227712
}
2771327713

27714-
const generateScores = async ({ scope, database: currentDatabase, maxRequestInParallel, reportTagsEnabled }) => {
27714+
const generateScores = async ({ scope, database: currentDatabase, maxRequestInParallel, reportTagsEnabled, renderBadge }) => {
2771527715
// @TODO: Improve deep clone logic
2771627716
const database = JSON.parse(JSON.stringify(currentDatabase))
2771727717
const platform = 'github.com'
@@ -27770,8 +27770,8 @@ const generateScores = async ({ scope, database: currentDatabase, maxRequestInPa
2777027770

2777127771
core.debug('All the scores are already collected')
2777227772

27773-
const reportContent = await generateReportContent(scores, reportTagsEnabled)
27774-
const issueContent = await generateIssueContent(scores)
27773+
const reportContent = await generateReportContent(scores, reportTagsEnabled, renderBadge)
27774+
const issueContent = await generateIssueContent(scores, renderBadge)
2777527775

2777627776
// SET OUTPUTS
2777727777
core.setOutput('scores', scores)
@@ -27834,20 +27834,20 @@ const saveScore = ({ database, platform, org, repo, score, date, commit }) => {
2783427834
repoRef.current = { score, date, commit }
2783527835
}
2783627836

27837-
const generateReportContent = async (scores, reportTagsEnabled) => {
27837+
const generateReportContent = async (scores, reportTagsEnabled, renderBadge) => {
2783827838
core.debug('Generating report content')
2783927839
const template = await readFile(__nccwpck_require__.ab + "report.ejs", 'utf8')
27840-
return ejs.render(template, { scores, reportTagsEnabled })
27840+
return ejs.render(template, { scores, reportTagsEnabled, renderBadge })
2784127841
}
2784227842

27843-
const generateIssueContent = async (scores) => {
27843+
const generateIssueContent = async (scores, renderBadge) => {
2784427844
core.debug('Generating issue content')
2784527845
const scoresInScope = scores.filter(({ currentDiff }) => currentDiff)
2784627846
if (!scoresInScope.length) {
2784727847
return null
2784827848
}
2784927849
const template = await readFile(__nccwpck_require__.ab + "issue.ejs", 'utf8')
27850-
return ejs.render(template, { scores: scoresInScope })
27850+
return ejs.render(template, { scores: scoresInScope, renderBadge })
2785127851
}
2785227852

2785327853
module.exports = {
@@ -28161,6 +28161,7 @@ async function run () {
2816128161
const reportTagsEnabled = normalizeBoolean(core.getInput('report-tags-enabled'))
2816228162
const startTag = core.getInput('report-start-tag') || '<!-- OPENSSF-SCORECARD-MONITOR:START -->'
2816328163
const endTag = core.getInput('report-end-tag') || '<!-- OPENSSF-SCORECARD-MONITOR:END -->'
28164+
const renderBadge = normalizeBoolean(core.getInput('render-badge'))
2816428165

2816528166
// Error Handling
2816628167
if (!githubToken && [autoPush, autoCommit, generateIssue, discoveryEnabled].some(value => value)) {
@@ -28221,7 +28222,7 @@ async function run () {
2822128222

2822228223
// PROCESS
2822328224
core.info('Generating scores...')
28224-
const { reportContent, issueContent, database: newDatabaseState } = await generateScores({ scope, database, maxRequestInParallel, reportTagsEnabled })
28225+
const { reportContent, issueContent, database: newDatabaseState } = await generateScores({ scope, database, maxRequestInParallel, reportTagsEnabled, renderBadge })
2822528226

2822628227
core.info('Checking database changes...')
2822728228
const hasChanges = isDifferent(database, newDatabaseState)

‎dist/issue.ejs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ There are changes in the following repositories:
1313
| -- | -- | -- | -- | -- | -- |
1414
<%_ } -%>
1515
<%_ scores.forEach( score => { -%>
16-
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <%= score.score %> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
16+
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
1717
<%_ }); -%>
1818
1919
_Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._

‎dist/report.ejs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
| -- | -- | -- | -- | -- | -- | -- |
1010
<%_ } -%>
1111
<%_ scores.forEach( score => { -%>
12-
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <%= score.score %> | <%= score.date %> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
12+
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%><% if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.date %> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
1313
<%_ }); -%>
1414
1515
_Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._

‎src/action.js‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ async function run () {
3131
const reportTagsEnabled = normalizeBoolean(core.getInput('report-tags-enabled'))
3232
const startTag = core.getInput('report-start-tag') || '<!-- OPENSSF-SCORECARD-MONITOR:START -->'
3333
const endTag = core.getInput('report-end-tag') || '<!-- OPENSSF-SCORECARD-MONITOR:END -->'
34+
const renderBadge = normalizeBoolean(core.getInput('render-badge'))
3435

3536
// Error Handling
3637
if (!githubToken && [autoPush, autoCommit, generateIssue, discoveryEnabled].some(value => value)) {
@@ -91,7 +92,7 @@ async function run () {
9192

9293
// PROCESS
9394
core.info('Generating scores...')
94-
const { reportContent, issueContent, database: newDatabaseState } = await generateScores({ scope, database, maxRequestInParallel, reportTagsEnabled })
95+
const { reportContent, issueContent, database: newDatabaseState } = await generateScores({ scope, database, maxRequestInParallel, reportTagsEnabled, renderBadge })
9596

9697
core.info('Checking database changes...')
9798
const hasChanges = isDifferent(database, newDatabaseState)

‎src/index.js‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ const generateScope = async ({ octokit, orgs, scope, maxRequestInParallel }) =>
9898
return newScope
9999
}
100100

101-
const generateScores = async ({ scope, database: currentDatabase, maxRequestInParallel, reportTagsEnabled }) => {
101+
const generateScores = async ({ scope, database: currentDatabase, maxRequestInParallel, reportTagsEnabled, renderBadge }) => {
102102
// @TODO: Improve deep clone logic
103103
const database = JSON.parse(JSON.stringify(currentDatabase))
104104
const platform = 'github.com'
@@ -157,8 +157,8 @@ const generateScores = async ({ scope, database: currentDatabase, maxRequestInPa
157157

158158
core.debug('All the scores are already collected')
159159

160-
const reportContent = await generateReportContent(scores, reportTagsEnabled)
161-
const issueContent = await generateIssueContent(scores)
160+
const reportContent = await generateReportContent(scores, reportTagsEnabled, renderBadge)
161+
const issueContent = await generateIssueContent(scores, renderBadge)
162162

163163
// SET OUTPUTS
164164
core.setOutput('scores', scores)

‎src/utils.js‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -42,20 +42,20 @@ const saveScore = ({ database, platform, org, repo, score, date, commit }) => {
4242
repoRef.current = { score, date, commit }
4343
}
4444

45-
const generateReportContent = async (scores, reportTagsEnabled) => {
45+
const generateReportContent = async (scores, reportTagsEnabled, renderBadge) => {
4646
core.debug('Generating report content')
4747
const template = await readFile(join(process.cwd(), 'templates/report.ejs'), 'utf8')
48-
return ejs.render(template, { scores, reportTagsEnabled })
48+
return ejs.render(template, { scores, reportTagsEnabled, renderBadge })
4949
}
5050

51-
const generateIssueContent = async (scores) => {
51+
const generateIssueContent = async (scores, renderBadge) => {
5252
core.debug('Generating issue content')
5353
const scoresInScope = scores.filter(({ currentDiff }) => currentDiff)
5454
if (!scoresInScope.length) {
5555
return null
5656
}
5757
const template = await readFile(join(process.cwd(), 'templates/issue.ejs'), 'utf8')
58-
return ejs.render(template, { scores: scoresInScope })
58+
return ejs.render(template, { scores: scoresInScope, renderBadge })
5959
}
6060

6161
module.exports = {

‎templates/issue.ejs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ There are changes in the following repositories:
1313
| -- | -- | -- | -- | -- | -- |
1414
<%_ } -%>
1515
<%_ scores.forEach( score => { -%>
16-
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <%= score.score %> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
16+
| [<%= score.org %>/<%= score.repo %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>) | [<%= score.commit.slice(0, 7) %>](https://<%= score.platform %>/<%= score.org %>/<%= score.repo %>/commit/<%= score.commit %>) | <% if (!renderBadge) { -%><%= score.score %> <%_ } -%> <%_ if (renderBadge) { -%> [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>/badge)](https://api.securityscorecards.dev/projects/github.com/<%= score.org %>/<%= score.repo %>) <%_ } -%> | <%= score.currentDiff || 0 %> | [Full Report](https://deps.dev/project/github/<%= score.org.toLowerCase() %>%2F<%= score.repo.toLowerCase() %>) | [Fix it](http://app.stepsecurity.io/securerepo?repo=<%= score.org %>/<%= score.repo %>) |
1717
<%_ }); -%>
1818
1919
_Report generated by [UlisesGascon/openssf-scorecard-monitor](https://github.com/UlisesGascon/openssf-scorecard-monitor)._

0 commit comments

Comments
 (0)