|
| 1 | +// Copyright 2022 Security Scorecard Authors |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | +package main |
| 15 | + |
| 16 | +import ( |
| 17 | + "encoding/json" |
| 18 | + "fmt" |
| 19 | + "io/ioutil" |
| 20 | + "os" |
| 21 | +) |
| 22 | + |
| 23 | +// main is the entrypoint for the action. |
| 24 | +func main() { |
| 25 | + // TODO - This is a port of the entrypoint.sh script. |
| 26 | + // This is still a work in progress. |
| 27 | + if err := initalizeENVVariables(); err != nil { |
| 28 | + panic(err) |
| 29 | + } |
| 30 | +} |
| 31 | + |
| 32 | +// initalizeENVVariables is a function to initialize the environment variables required for the action. |
| 33 | +//nolint |
| 34 | +func initalizeENVVariables() error { |
| 35 | + /* |
| 36 | + https://docs.github.com/en/actions/learn-github-actions/environment-variables |
| 37 | + GITHUB_EVENT_PATH contains the json file for the event. |
| 38 | + GITHUB_SHA contains the commit hash. |
| 39 | + GITHUB_WORKSPACE contains the repo folder. |
| 40 | + GITHUB_EVENT_NAME contains the event name. |
| 41 | + GITHUB_ACTIONS is true in GitHub env. |
| 42 | + */ |
| 43 | + if err := os.Setenv("ENABLE_SARIF", "1"); err != nil { |
| 44 | + return err |
| 45 | + } |
| 46 | + |
| 47 | + if err := os.Setenv("ENABLE_LICENSE", "1"); err != nil { |
| 48 | + return err |
| 49 | + } |
| 50 | + |
| 51 | + if err := os.Setenv("ENABLE_DANGEROUS_WORKFLOW", "1"); err != nil { |
| 52 | + return err |
| 53 | + } |
| 54 | + |
| 55 | + if err := os.Setenv("SCORECARD_POLICY_FILE", "/policy.yml"); err != nil { |
| 56 | + return err |
| 57 | + } |
| 58 | + |
| 59 | + if result, exists := os.LookupEnv("INPUT_RESULTS_FILE"); !exists { |
| 60 | + return fmt.Errorf("INPUT_RESULTS_FILE is not set") |
| 61 | + } else { |
| 62 | + if result == "" { |
| 63 | + return fmt.Errorf("INPUT_RESULTS_FILE is empty") |
| 64 | + } |
| 65 | + if err := os.Setenv("SCORECARD_RESULTS_FILE", result); err != nil { |
| 66 | + return err |
| 67 | + } |
| 68 | + } |
| 69 | + |
| 70 | + if result, exists := os.LookupEnv("INPUT_RESULTS_FORMAT"); !exists { |
| 71 | + return fmt.Errorf("INPUT_RESULTS_FORMAT is not set") |
| 72 | + } else { |
| 73 | + if result == "" { |
| 74 | + return fmt.Errorf("INPUT_RESULTS_FORMAT is empty") |
| 75 | + } |
| 76 | + if err := os.Setenv("SCORECARD_RESULTS_FORMAT", result); err != nil { |
| 77 | + return err |
| 78 | + } |
| 79 | + } |
| 80 | + |
| 81 | + if result, exists := os.LookupEnv("INPUT_PUBLISH_RESULTS"); !exists { |
| 82 | + return fmt.Errorf("INPUT_PUBLISH_RESULTS is not set") |
| 83 | + } else { |
| 84 | + if result == "" { |
| 85 | + return fmt.Errorf("INPUT_PUBLISH_RESULTS is empty") |
| 86 | + } |
| 87 | + if err := os.Setenv("SCORECARD_PUBLISH_RESULTS", result); err != nil { |
| 88 | + return err |
| 89 | + } |
| 90 | + } |
| 91 | + |
| 92 | + if err := os.Setenv("SCORECARD_BIN", "/scorecard"); err != nil { |
| 93 | + return err |
| 94 | + } |
| 95 | + |
| 96 | + if err := os.Setenv("ENABLED_CHECKS", ""); err != nil { |
| 97 | + return err |
| 98 | + } |
| 99 | + return gitHubEventPath() |
| 100 | +} |
| 101 | + |
| 102 | +// gitHubEventPath is a function to get the path to the GitHub event |
| 103 | +// and sets the SCORECARD_IS_FORK environment variable. |
| 104 | +func gitHubEventPath() error { |
| 105 | + if result, exists := os.LookupEnv("GITHUB_EVENT_PATH"); !exists { |
| 106 | + return fmt.Errorf("GITHUB_EVENT_PATH is not set") |
| 107 | + } else { |
| 108 | + if result == "" { |
| 109 | + return fmt.Errorf("GITHUB_EVENT_PATH is empty") |
| 110 | + } |
| 111 | + if err := os.Setenv("GITHUB_EVENT_PATH", result); err != nil { |
| 112 | + return err |
| 113 | + } |
| 114 | + |
| 115 | + data, err := ioutil.ReadFile(result) |
| 116 | + if err != nil { |
| 117 | + return err |
| 118 | + } |
| 119 | + |
| 120 | + if isFork, err := scorecardIsFork(string(data)); err != nil { |
| 121 | + return err |
| 122 | + } else { |
| 123 | + if isFork { |
| 124 | + if err := os.Setenv("SCORECARD_IS_FORK", "true"); err != nil { |
| 125 | + return err |
| 126 | + } |
| 127 | + } else { |
| 128 | + if err := os.Setenv("SCORECARD_IS_FORK", "false"); err != nil { |
| 129 | + return err |
| 130 | + } |
| 131 | + } |
| 132 | + } |
| 133 | + } |
| 134 | + return nil |
| 135 | +} |
| 136 | + |
| 137 | +// scorecardIsFork is a function to check if the current repo is a fork. |
| 138 | +func scorecardIsFork(ghEventPath string) (bool, error) { |
| 139 | + if ghEventPath == "" { |
| 140 | + return false, fmt.Errorf("ghEventPath is empty") |
| 141 | + } |
| 142 | + /* |
| 143 | + https://docs.github.com/en/actions/reference/workflow-commands-for-github-actions#github_repository_is_fork |
| 144 | + GITHUB_REPOSITORY_IS_FORK is true if the repository is a fork. |
| 145 | + */ |
| 146 | + type repo struct { |
| 147 | + Repository struct { |
| 148 | + Fork bool `json:"fork"` |
| 149 | + } `json:"repository"` |
| 150 | + } |
| 151 | + var r repo |
| 152 | + if err := json.Unmarshal([]byte(ghEventPath), &r); err != nil { |
| 153 | + return false, err |
| 154 | + } |
| 155 | + |
| 156 | + return r.Repository.Fork, nil |
| 157 | +} |
0 commit comments