Skip to content

Add config option to specify branches for dangerous workflow #677

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Apr 30, 2025
Merged

Add config option to specify branches for dangerous workflow #677

merged 5 commits into from
Apr 30, 2025

Conversation

serb-google
Copy link
Contributor

Add config option to specify branches for dangerous workflow, see #622 (comment)

Tested with and without option in /.allstar/dangerous_workflow.yaml file private branch to confirm this works as expected.

@serb-google serb-google requested a review from a team as a code owner April 4, 2025 22:53
@serb-google serb-google mentioned this pull request Apr 4, 2025
Merged
@serb-google
Copy link
Contributor Author

It's not really clear why the linter is failing, I can't replicate this locally with:

 allstar$ ../golangci-lint-1.64.7-linux-amd64/golangci-lint run --timeout 3m
 allstar$ ../golangci-lint-1.64.7-linux-amd64/golangci-lint cache clean

@serb-google
Copy link
Contributor Author

Looks like 24b42f0 resolved the lint error.

coheigea
coheigea suggested changes Apr 7, 2025
View reviewed changes
pkg/config/config.go Outdated
// Schedule specifies whether to perform certain actions on specific days.
Schedule *ScheduleConfig `json:"schedule"`

// Comma-seperated branch list to scan for Dangerous Workflows.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: separated. Same for below

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice catch :)

@coheigea
Copy link
Contributor

coheigea commented Apr 7, 2025

What happens if a given branch isn't available in a repo? Will it just skip or throw an error? I'd want to specify "refs/remotes/origin/master", "refs/remotes/origin/main" etc. to catch different default branches in various repos. Or is there a way to always pick the default branch?

@serb-google
Copy link
Contributor Author

What happens if a given branch isn't available in a repo? Will it just skip or throw an error? I'd want to specify "refs/remotes/origin/master", "refs/remotes/origin/main" etc. to catch different default branches in various repos. Or is there a way to always pick the default branch?

Based on https://github.com/serb-google/allstar/blob/config/pkg/policies/workflow/workflow.go#L150 this should throw an error.

I think it should be possible to wire up GetDefaultBranchName() from the scorecard Git client for a magic string like Default ( https://github.com/ossf/scorecard/blob/main/clients/git/client.go#L316 ). I should be able to have that wired up in a few days.

jeffmendoza
jeffmendoza reviewed Apr 7, 2025
View reviewed changes
Copy link
Member

@jeffmendoza jeffmendoza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, some naming comments.
Lets preserve the ability to easily only check the default branch, as @coheigea mentioned.

pkg/config/config.go Outdated
// Comma-separated branch list to scan for Dangerous Workflows.
// Blank/default to scan all branches.
// Must use format "refs/remotes/origin/branch_name".
DangerousWorkflowBranchList string `json:"dangerousWorkflowBranchList"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe you need these config fields. Just the ones you added to the policy-specific config

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, updated!

pkg/policies/workflow/workflow.go Outdated
// Comma-separated branch list to scan for Dangerous Workflows.
// Blank/default to scan all branches.
// Must use format "refs/remotes/origin/branch_name".
DangerousWorkflowBranchList string `json:"dangerousWorkflowBranchList"`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because this is already a part of the Dangerous Workflow policy config, just name this "BranchList"

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ack, updated!

@serb-google
Copy link
Contributor Author

I modified the logic to add in a keyword "default" which will be replaced with the actual default git branch name.

I tested this using a private repo with configuration file .allstar/dangerous_workflow.yaml with the contents branchList: default. Log:

{"severity":"DEBUG","time":"2025-04-27T16:21:34Z","message":"local checkout -- installation access token retrieved"}
{"severity":"DEBUG","repo":"serb-google/test_private","time":"2025-04-27T16:21:34Z","message":"Repo checkout"}
{"severity":"DEBUG","time":"2025-04-27T16:21:34Z","message":"local checkout -- checkout success"}
{"severity":"DEBUG","branches":"refs/heads/main","time":"2025-04-27T16:21:34Z","message":"Running against branch list"}
{"severity":"DEBUG","branch":"refs/heads/main","time":"2025-04-27T16:21:34Z","message":"Branch checkout"}
{"severity":"INFO","org":"serb-google","repo":"test_private","area":"Dangerous Workflow","result":true,"enabled":false,"notify":"","details":{"Findings":null},"time":"2025-04-27T16:21:34Z","message":"Policy run result."}

@serb-google serb-google requested a review from coheigea April 27, 2025 16:51
jeffmendoza
jeffmendoza approved these changes Apr 30, 2025
View reviewed changes
Copy link
Member

@jeffmendoza jeffmendoza left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a quick note on how the lists are merged. Thanks for the updates!!

serb-google and others added 5 commits April 30, 2025 14:13
@serb-google @jeffmendoza
Add config option for dangerous workflows branch list.
f67f607 
Signed-off-by: Samuel Erb <[email protected]>
@serb-google @jeffmendoza
Attempt to resolve lint error.
a2d3950 
Signed-off-by: Samuel Erb <[email protected]>
@serb-google @jeffmendoza
Fix spelling errors
906b3e4 
Signed-off-by: Samuel Erb <[email protected]>
@serb-google @jeffmendoza
Add "default" as a branch target.
0aa08c7 
Remove workflow config from top level config file.

Signed-off-by: Samuel Erb <[email protected]>
@jeffmendoza
Update comment on repo-level config for branch list on dangerous work…
abce5f9 
…flow policy.

Signed-off-by: Jeff Mendoza <[email protected]>
@jeffmendoza
Copy link
Member

Some merge conflicts for some reason, a rebase was needed, will merge now

@jeffmendoza jeffmendoza merged commit d38ebe1 into ossf:main Apr 30, 2025
7 checks passed
@coheigea
Copy link
Contributor

coheigea commented May 1, 2025

@jeffmendoza Can we have a new release with this feature please? #659

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jeffmendoza jeffmendoza jeffmendoza approved these changes

@coheigea coheigea Awaiting requested review from coheigea

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@serb-google @coheigea @jeffmendoza