Repository navigation
chore: update security reporting instructions, bump golangci-lint ver… - #73
Merged
Merged
Conversation
…sion, add fuzz tests, and create test fixtures
There was a problem hiding this comment.
🟡 Changes recommended
--require-hashes conflicts with the fixture’s un-hashed >= requirements, causing the Dockerfile build to fail.
1 open finding
🧠 Review effort: Lite
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
chore: raise OpenSSF Scorecard score (#68)
Fixes the Scorecard checks that can be fixed in code. The score is currently 6.2; with these changes and the manual steps below it should reach about 8.6. Code-Review and Branch-Protection can't go higher while the project has a single maintainer.
Changes
osv-scanner.tomlto everytargets/*fixture. It tells osv-scanner to ignore PyPI packages. The targets are fake repos the aibomgen scanner is tested against, and their packages are never installed. Runningosv-scanner scan source -r .drops from 95 findings to 0.go.modwas already clean.targets/target-3/scripts/Dockerfilenow pins its base image by digest and runs pip with--require-hashes. Scorecard has no way to exclude a path, and the file is a scanner fixture that is never built.FuzzParseModelRef. It checks that a parsed ID is never empty and never contains@, and that parsing round-trips throughString().SECURITY.mdnow links directly to private vulnerability reporting.Follow-ups (not in this PR)
checksums.txt.sigstore.jsonis published. Signing was added after v0.2.1. Signed-Releases looks at the last 5 releases, so it improves with each new release.TestScanRepoDifficultalways skips because its fixture path is wrong:../../targetsshould be../../../targets.Testing
go test ./...passes.go test -run='^$' -fuzz=FuzzParseModelRef -fuzztime=30s ./pkg/aibomgen/generatorpasses (about 570k runs).osv-scanner scan source -r .finds no issues.Closes #68