✨ Gitlab support #2265

N8BWert · 2022-09-15T17:37:57Z

What kind of change does this PR introduce?

This PR introduces GitLab functionality to the scorecard project.

What is the current behavior?

Currently scorecard only supports testing GitHub repositories.

What is the new behavior (if this is a feature change)?**

A client has been added to allow the command line execution of scorecard to include support for gitlab projects.

Which issue(s) this PR fixes

#Support For GitLab Projects
#2266 (comment)

Special notes for your reviewer

It is important to note that projectID is not the same as the name of the project. Scorecard will not find the GitLab project in the following situation:

Example: Project named test-project with projectID 1234 owned by steve who is a part of examplecompany

This will not work:

scorecard gitlab.examplecompany.com/steve/test-project

However this will work:

scorecard gitlab.examplecompany.com/steve/1234

Does this PR introduce a user-facing change?

If a user is running scorecard on a GitHub repository that includes the string "gitlab." in the title scorecard will now think that repository is actually a GitLab project, however this is an incredibly rare edge case.

Repositories that include "gitlab." in their title will be assumed to be gitlab projects.

github-actions · 2022-09-15T17:56:37Z

Integration tests success for
[d4c5ef8]
(https://github.com/ossf/scorecard/actions/runs/3062497764)

codecov · 2022-09-15T17:58:47Z

Codecov Report

Merging #2265 (842d3bb) into main (a6983ed) will decrease coverage by 3.67%.
The diff coverage is 5.38%.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2265      +/-   ##
==========================================
- Coverage   44.85%   41.17%   -3.68%     
==========================================
  Files          95      110      +15     
  Lines        7957     8774     +817     
==========================================
+ Hits         3569     3613      +44     
- Misses       4125     4892     +767     
- Partials      263      269       +6

azeemshaikh38 · 2022-09-15T20:38:57Z

@N8BWert thank you so much for this PR! Very excited to see Scorecard support GitLab. I'm ooo today, will review it tomo.

laurentsimon

Looks amazing. Thanks for this PR.
A few things we can iterate on after merging are:

Handling of tokens
Adding e2e tests under the `./e2e/ folder.
Scanning of critical repositories in the cron jobs (under ./cron folder)

I'd suggest we add a "experimental feature" in the README until we have the e2e tests in.

naveensrinivasan

Thank you! This is great! Without tests, it is going to be hard to maintain this. Could you please add tests?

laurentsimon · 2022-09-16T15:28:15Z

@naveensrinivasan which tests specifically? Under clients/gitlabrepo? Or end-to-end tests?
Since this is a massive PR and still experimental, I think it'd be OK to do the e2e tests in a follow-up PR. Wdut?

N8BWert · 2022-09-16T15:30:05Z

@naveensrinivasan By tests do you mean the e2e tests. If so, would you like me to host all of the e2e test repos on my gitlab or is there a plan to make a fork of those repos into an ossf specific GitLab?

laurentsimon · 2022-09-16T15:47:51Z

I think we should take the second option: have an ossf GitLab org

naveensrinivasan · 2022-09-16T15:49:39Z

@naveensrinivasan which tests specifically? Under clients/gitlabrepo? Or end-to-end tests?
Since this is a massive PR and still experimental, I think it'd be OK to do the e2e tests in a follow-up PR. Wdut?

Both TBH. I recommend we do the e2e and merge them in, as it provides some sanity. If not, we are blindsided whether any of these features are working. That is my thought process.

naveensrinivasan · 2022-09-16T15:51:26Z

@naveensrinivasan By tests do you mean the e2e tests. If so, would you like me to host all of the e2e test repos on my gitlab or is there a plan to make a fork of those repos into an ossf specific GitLab?

If the e2e tests are in GitLab how do we ensure in this repository that new code changes aren't breaking this functionality? Do you have ideas?

laurentsimon · 2022-09-16T15:54:27Z

@N8BWert feel free to start the e2e tests using your own repos. In the meantime we'll figure out how to create an org ossf-tests on GitLab. When, done, we can just transfer or copy your repos into it. SG?

N8BWert · 2022-09-16T15:55:15Z

Sounds good to me!

azeemshaikh38

Thanks for this incredible PR @N8BWert! This looks good to submit overall. I left some comments, please address those and I can work on getting this merged in. My high-level comments on the PR is:

Let's confine this PR to changes made within clients/gitlabrepo/ package only. You can add the integrated support for GitLab in a future PR.
Remove any dead code that is still WIP and submit it in a future PR.
Please add some unit tests for code where parsing/string building logic exists.
There are some linter errors/warnings. Please fix those to adhere to our projects coding guidelines.

checker/client.go

clients/gitlabrepo/branches.go

clients/gitlabrepo/client.go

clients/user.go

clients/gitlabrepo/workflows.go

clients/gitlabrepo/issues.go

clients/gitlabrepo/client.go

checks/raw/security_policy.go

checker/client.go

README.md

N8BWert · 2022-09-16T16:08:05Z

@azeemshaikh38 Sounds good, on it now.

azeemshaikh38 · 2022-09-16T16:10:49Z

@laurentsimon @naveensrinivasan @N8BWert - regarding e2e: we might be biting off more than we can chew by attempting this all in a single PR. My suggestion would be to get this PR merged in with just code inside clients/gitlabrepo. We can look into adding support for e2e tests and fully supporting this in the CLI in separate smaller PRs. Wdyt?

Note that gitlabrepo implementation isn't fully completed yet (which is fine cause this PR adds >90% support for it already).

laurentsimon · 2022-09-16T16:19:25Z

I'm fine with adding e2etests later, see #2265 (comment)

azeemshaikh38 · 2022-09-16T16:25:34Z

I'm fine with adding e2etests later, see #2265 (comment)

Ah I see. In that case, @naveensrinivasan do you still prefer having e2e tests? Note that this PR won't contain any logic outside clients/gitlabrepo segregating it from the core Scorecard logic and allowing us to test it piece by piece. Does that work?

naveensrinivasan

Thank you!

…into gitlab_support

azeemshaikh38 · 2022-09-21T18:29:56Z

@N8BWert could you update your branch and resolve pending conflicts here? I will get this PR merged in so that review of #2280 can be unblocked.

Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com>

…into gitlab_support

github-actions · 2022-09-21T19:04:30Z

Integration tests success for
[cf83b48]
(https://github.com/ossf/scorecard/actions/runs/3100223005)

github-actions · 2022-09-21T19:04:52Z

Integration tests success for
[56b36e8]
(https://github.com/ossf/scorecard/actions/runs/3100303282)

github-actions · 2022-09-21T20:04:35Z

Integration tests success for
[842d3bb]
(https://github.com/ossf/scorecard/actions/runs/3100647146)

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com> Signed-off-by: N8BWert <n8.wert.b@gmail.com>

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com>

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com> Signed-off-by: N8BWert <n8.wert.b@gmail.com> Signed-off-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com>

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com>

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com> Signed-off-by: N8BWert <n8.wert.b@gmail.com> Signed-off-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com>

* updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * updated readme to reflect gitlab usage * bugfixes after a good deal of testing * removed unnecessary files from branch * cleaning up my mess * requested changes + unit tests * style fixes * merge main into gitlab_support * check-linter fixes Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com> Co-authored-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com> Signed-off-by: nathaniel.wert <nathaniel.wert@kudelskisecurity.com>

nathaniel.wert added 4 commits September 14, 2022 15:22

updated readme to reflect gitlab usage

2eca0a9

bugfixes after a good deal of testing

a93e138

removed unnecessary files from branch

76d3a2e

cleaning up my mess

d4c5ef8

N8BWert requested review from olivekl, azeemshaikh38, justaugustus, laurentsimon and naveensrinivasan as code owners September 15, 2022 17:37

N8BWert temporarily deployed to integration-test September 15, 2022 17:38 Inactive

N8BWert marked this pull request as draft September 15, 2022 17:38

N8BWert changed the title ~~Gitlab support ✨~~ ✨ Gitlab support Sep 15, 2022

N8BWert marked this pull request as ready for review September 15, 2022 17:54

laurentsimon approved these changes Sep 15, 2022

View reviewed changes

naveensrinivasan requested changes Sep 16, 2022

View reviewed changes

azeemshaikh38 approved these changes Sep 16, 2022

View reviewed changes

naveensrinivasan approved these changes Sep 16, 2022

View reviewed changes

nathaniel.wert added 6 commits September 16, 2022 17:02

updated readme to reflect gitlab usage

d78ec76

bugfixes after a good deal of testing

d112c7e

removed unnecessary files from branch

a4593bd

cleaning up my mess

9b16dfb

requested changes + unit tests

1e28892

style fixes

6b45307

naveensrinivasan force-pushed the gitlab_support branch from f593185 to 6b45307 Compare September 16, 2022 22:02

naveensrinivasan had a problem deploying to integration-test September 16, 2022 22:03 Failure

Merge branch 'gitlab_support' of https://github.com/N8BWert/scorecard …

cdcb80d

…into gitlab_support

N8BWert mentioned this pull request Sep 20, 2022

✨ Gitlab support (Part 2) - Tests #2280

Closed

Merge branch 'main' into gitlab_support

cf83b48

Signed-off-by: Nathaniel Wert <N8.Wert.B@gmail.com>

N8BWert temporarily deployed to integration-test September 21, 2022 18:32 Inactive

nathaniel.wert added 2 commits September 21, 2022 14:33

Merge branch 'gitlab_support' of https://github.com/N8BWert/scorecard …

9bda6c7

…into gitlab_support

merge main into gitlab_support

56b36e8

N8BWert temporarily deployed to integration-test September 21, 2022 18:46 Inactive

check-linter fixes

842d3bb

N8BWert temporarily deployed to integration-test September 21, 2022 19:45 Inactive

azeemshaikh38 merged commit 0f87094 into ossf:main Sep 21, 2022

raghavkaul mentioned this pull request Feb 13, 2023

✨ Gitlab support: RepoClient #2655

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨ Gitlab support #2265

✨ Gitlab support #2265

N8BWert commented Sep 15, 2022 •

edited

Loading

github-actions bot commented Sep 15, 2022

codecov bot commented Sep 15, 2022 •

edited

Loading

azeemshaikh38 commented Sep 15, 2022

laurentsimon left a comment

naveensrinivasan left a comment

laurentsimon commented Sep 16, 2022

N8BWert commented Sep 16, 2022

laurentsimon commented Sep 16, 2022

naveensrinivasan commented Sep 16, 2022

naveensrinivasan commented Sep 16, 2022

laurentsimon commented Sep 16, 2022 •

edited

Loading

N8BWert commented Sep 16, 2022

azeemshaikh38 left a comment

N8BWert commented Sep 16, 2022

azeemshaikh38 commented Sep 16, 2022

laurentsimon commented Sep 16, 2022

azeemshaikh38 commented Sep 16, 2022

naveensrinivasan left a comment

azeemshaikh38 commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

✨ Gitlab support #2265

✨ Gitlab support #2265

Conversation

N8BWert commented Sep 15, 2022 • edited Loading

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior (if this is a feature change)?**

Which issue(s) this PR fixes

Special notes for your reviewer

Does this PR introduce a user-facing change?

github-actions bot commented Sep 15, 2022

codecov bot commented Sep 15, 2022 • edited Loading

Codecov Report

azeemshaikh38 commented Sep 15, 2022

laurentsimon left a comment

Choose a reason for hiding this comment

naveensrinivasan left a comment

Choose a reason for hiding this comment

laurentsimon commented Sep 16, 2022

N8BWert commented Sep 16, 2022

laurentsimon commented Sep 16, 2022

naveensrinivasan commented Sep 16, 2022

naveensrinivasan commented Sep 16, 2022

laurentsimon commented Sep 16, 2022 • edited Loading

N8BWert commented Sep 16, 2022

azeemshaikh38 left a comment

Choose a reason for hiding this comment

N8BWert commented Sep 16, 2022

azeemshaikh38 commented Sep 16, 2022

laurentsimon commented Sep 16, 2022

azeemshaikh38 commented Sep 16, 2022

naveensrinivasan left a comment

Choose a reason for hiding this comment

azeemshaikh38 commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

github-actions bot commented Sep 21, 2022

N8BWert commented Sep 15, 2022 •

edited

Loading

codecov bot commented Sep 15, 2022 •

edited

Loading

laurentsimon commented Sep 16, 2022 •

edited

Loading