$ ./scorecard --repo=github.com/adnanh/webhook --show-details
Starting [Active]
Starting [Branch-Protection]
Starting [CI-Tests]
Starting [CII-Best-Practices]
Starting [Code-Review]
Starting [Contributors]
Starting [Frozen-Deps]
Starting [Fuzzing]
Starting [Packaging]
Starting [Pull-Requests]
Starting [SAST]
Starting [Security-Policy]
Starting [Signed-Releases]
Starting [Signed-Tags]
Finished [Fuzzing]
Finished [CII-Best-Practices]
Finished [Branch-Protection]
Finished [Packaging]
Finished [Frozen-Deps]
Finished [Signed-Tags]
Finished [Signed-Releases]
Finished [Contributors]
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x8 pc=0x7696f1]
goroutine 29 [running]:
github.com/ossf/scorecard/checks.SASTToolInCheckRuns(0x9a53c0, 0xc00009c000, 0xc0000e0840, 0xc0000b00d0, 0xc000097620, 0xc00009a103, 0x6, 0xc00009a10a, 0x7, 0xc000032320, ...)
/src/github.com/ossf/scorecard/checks/sast.go:54 +0x231
github.com/ossf/scorecard/checker.MultiCheck.func1(0x9a53c0, 0xc00009c000, 0xc0000e0840, 0xc0000b00d0, 0xc000097620, 0xc00009a103, 0x6, 0xc00009a10a, 0x7, 0xc000032320, ...)
/src/github.com/ossf/scorecard/checker/check.go:57 +0xf8
github.com/ossf/scorecard/checks.SAST(0x9a53c0, 0xc00009c000, 0xc0000e0840, 0xc0000b00d0, 0xc000097620, 0xc00009a103, 0x6, 0xc00009a10a, 0x7, 0xc000032320, ...)
/src/github.com/ossf/scorecard/checks/sast.go:32 +0xd5
github.com/ossf/scorecard/checker.(*Runner).Run(0xc0001fbea8, 0x933ba0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
/src/github.com/ossf/scorecard/checker/checker.go:54 +0x1b5
github.com/ossf/scorecard/pkg.RunScorecards.func1(0xc00009c414, 0x9a53c0, 0xc00009c000, 0xc0000e0840, 0xc0000b00d0, 0xc000097620, 0xc00009a103, 0x6, 0xc00009a10a, 0x7, ...)
/src/github.com/ossf/scorecard/pkg/scorecard.go:107 +0xd4
created by github.com/ossf/scorecard/pkg.RunScorecards
/src/github.com/ossf/scorecard/pkg/scorecard.go:104 +0x353
If I limit the checks to just SAST, I haven't seen it panic yet. I added some debugging print statements before the range loop to see what the github package is returning. It looks something like this:
pr = https://github.com/adnanh/webhook/pull/463
error = <nil>
resp = &{0xc000778d80 0 0 0 0 github.Rate{Limit:5000, Remaining:3034, Reset:github.Timestamp{2021-01-18 10:01:53 -0600 CST}}}
status = 200 OK
crs = (*github.ListCheckRunsResults)(nil)
$ go version
go version go1.16beta1 linux/amd64
$ git log -1 --oneline
c00aa4b (HEAD -> main, origin/main, origin/HEAD) Add e2e tests for remaining checks.
I ran into an odd issue today:
If I limit the checks to just SAST, I haven't seen it panic yet. I added some debugging print statements before the range loop to see what the github package is returning. It looks something like this:
It would be easy to add a nil-check before accessing
csr, but it seems like the github package should be returning an error or a non-nil response.I tried updating to
github/v33, but the problem remains.