Public Access
feat: Support gitea
This commit is contained in:
+2
-5
@@ -6,17 +6,14 @@
|
||||
"parserOptions": {
|
||||
"project": "./tsconfig.json"
|
||||
},
|
||||
"plugins": [
|
||||
"@typescript-eslint"
|
||||
],
|
||||
"plugins": ["@typescript-eslint"],
|
||||
"extends": [
|
||||
"eslint:recommended",
|
||||
"plugin:@typescript-eslint/eslint-recommended",
|
||||
"plugin:@typescript-eslint/recommended-requiring-type-checking",
|
||||
"plugin:@typescript-eslint/recommended",
|
||||
"plugin:prettier/recommended",
|
||||
"prettier",
|
||||
"prettier/@typescript-eslint"
|
||||
"prettier"
|
||||
],
|
||||
"rules": {
|
||||
"@typescript-eslint/explicit-function-return-type": 0
|
||||
|
||||
Vendored
+11
-3
File diff suppressed because one or more lines are too long
Generated
+15
@@ -12,11 +12,13 @@
|
||||
"@actions/core": "^1.11.1",
|
||||
"@actions/github": "^6.0.1",
|
||||
"@clechasseur/rs-actions-core": "^3.0.5",
|
||||
"gitea-js": "^1.23.0",
|
||||
"nunjucks": "^3.2.4"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/jest": "^29.5.12",
|
||||
"@types/node": "^24.0.0",
|
||||
"@types/nunjucks": "^3.2.4",
|
||||
"@typescript-eslint/eslint-plugin": "^6.21.0",
|
||||
"@typescript-eslint/parser": "^6.21.0",
|
||||
"@vercel/ncc": "0.38.1",
|
||||
@@ -2048,6 +2050,13 @@
|
||||
"undici-types": "~7.16.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/nunjucks": {
|
||||
"version": "3.2.6",
|
||||
"resolved": "https://registry.npmjs.org/@types/nunjucks/-/nunjucks-3.2.6.tgz",
|
||||
"integrity": "sha512-pHiGtf83na1nCzliuAdq8GowYiXvH5l931xZ0YEHaLMNFgynpEqx+IPStlu7UaDkehfvl01e4x/9Tpwhy7Ue3w==",
|
||||
"dev": true,
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@types/semver": {
|
||||
"version": "7.5.8",
|
||||
"resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.5.8.tgz",
|
||||
@@ -3716,6 +3725,12 @@
|
||||
"url": "https://github.com/sponsors/sindresorhus"
|
||||
}
|
||||
},
|
||||
"node_modules/gitea-js": {
|
||||
"version": "1.23.0",
|
||||
"resolved": "https://registry.npmjs.org/gitea-js/-/gitea-js-1.23.0.tgz",
|
||||
"integrity": "sha512-f4+UPoWgDetZeZ+Awo5iI1nVdO5bjxA8+2QCeLo3oYWUYxKyzLfXgbW1EPD635wb8hLgS0DRBu5XhtiuYKEeUA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/glob": {
|
||||
"version": "7.2.3",
|
||||
"resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
|
||||
|
||||
@@ -37,11 +37,13 @@
|
||||
"@actions/core": "^1.11.1",
|
||||
"@actions/github": "^6.0.1",
|
||||
"@clechasseur/rs-actions-core": "^3.0.5",
|
||||
"gitea-js": "^1.23.0",
|
||||
"nunjucks": "^3.2.4"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@types/jest": "^29.5.12",
|
||||
"@types/node": "^24.0.0",
|
||||
"@types/nunjucks": "^3.2.4",
|
||||
"@typescript-eslint/eslint-plugin": "^6.21.0",
|
||||
"@typescript-eslint/parser": "^6.21.0",
|
||||
"@vercel/ncc": "0.38.1",
|
||||
|
||||
+42
-31
@@ -4,12 +4,9 @@ import * as core from '@actions/core';
|
||||
import * as github from '@actions/github';
|
||||
import * as nunjucks from 'nunjucks';
|
||||
|
||||
import { checks } from '@clechasseur/rs-actions-core';
|
||||
import * as interfaces from './interfaces';
|
||||
import * as templates from './templates';
|
||||
|
||||
const pkg = require('../package.json'); // eslint-disable-line @typescript-eslint/no-var-requires
|
||||
const USER_AGENT = `${pkg.name}/${pkg.version} (${pkg.bugs.url})`;
|
||||
import { giteaApi } from 'gitea-js';
|
||||
|
||||
interface Stats {
|
||||
critical: number;
|
||||
@@ -166,15 +163,22 @@ export async function reportCheck(
|
||||
vulnerabilities: Array<interfaces.Vulnerability>,
|
||||
warnings: Array<interfaces.Warning>,
|
||||
): Promise<void> {
|
||||
const client = github.getOctokit(token, { userAgent: USER_AGENT });
|
||||
const reporter = new checks.CheckReporter(client.rest, 'Security audit');
|
||||
const { owner, repo } = github.context.repo;
|
||||
const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
|
||||
const stats = getStats(vulnerabilities, warnings);
|
||||
const summary = getSummary(stats);
|
||||
const body = {
|
||||
description: 'Security Audit',
|
||||
context: 'security-audit',
|
||||
};
|
||||
|
||||
core.info(`Found ${summary}`);
|
||||
|
||||
try {
|
||||
await reporter.startCheck('queued');
|
||||
await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
|
||||
...body,
|
||||
state: 'pending',
|
||||
});
|
||||
} catch (error) {
|
||||
// `GITHUB_HEAD_REF` is set only for forked repos,
|
||||
// so we can check if it is a fork and not a base repo.
|
||||
@@ -205,16 +209,22 @@ See https://github.com/actions-rs/clippy-check/issues/2 for details.`);
|
||||
}
|
||||
|
||||
try {
|
||||
const body = makeReport(vulnerabilities, warnings);
|
||||
const output = {
|
||||
title: 'Security advisories found',
|
||||
summary: summary,
|
||||
text: body,
|
||||
};
|
||||
const status = stats.critical > 0 ? 'failure' : 'success';
|
||||
await reporter.finishCheck(status, output);
|
||||
// const body = makeReport(vulnerabilities, warnings);
|
||||
// const output = {
|
||||
// title: 'Security advisories found',
|
||||
// summary: summary,
|
||||
// text: body,
|
||||
// };
|
||||
const state = stats.critical > 0 ? 'failure' : 'success';
|
||||
await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
|
||||
...body,
|
||||
state,
|
||||
});
|
||||
} catch (error) {
|
||||
await reporter.cancelCheck();
|
||||
await api.repos.repoCreateStatus(owner, repo, github.context.sha, {
|
||||
...body,
|
||||
state: 'error',
|
||||
});
|
||||
throw error;
|
||||
}
|
||||
|
||||
@@ -235,13 +245,13 @@ async function alreadyReported(
|
||||
advisoryId: string,
|
||||
): Promise<boolean> {
|
||||
const { owner, repo } = github.context.repo;
|
||||
const client = github.getOctokit(token, { userAgent: USER_AGENT });
|
||||
const results = await client.rest.search.issuesAndPullRequests({
|
||||
q: `${advisoryId} in:title repo:${owner}/${repo}`,
|
||||
per_page: 1, // eslint-disable-line @typescript-eslint/camelcase
|
||||
const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
|
||||
const results = await api.repos.issueListIssues(owner, repo, {
|
||||
q: advisoryId,
|
||||
limit: 1,
|
||||
});
|
||||
|
||||
if (results.data.total_count > 0) {
|
||||
if (results.data.length > 0) {
|
||||
core.info(
|
||||
`Seems like ${advisoryId} is mentioned already in the issues/PRs, \
|
||||
will not report an issue against it`,
|
||||
@@ -260,7 +270,7 @@ export async function reportIssues(
|
||||
): Promise<void> {
|
||||
const { owner, repo } = github.context.repo;
|
||||
|
||||
const client = github.getOctokit(token, { userAgent: USER_AGENT });
|
||||
const api = giteaApi(process.env.GITHUB_SERVER_URL!, { token });
|
||||
|
||||
for (const vulnerability of vulnerabilities) {
|
||||
const reported = await alreadyReported(
|
||||
@@ -274,13 +284,13 @@ export async function reportIssues(
|
||||
const body = nunjucks.renderString(templates.VULNERABILITY_ISSUE, {
|
||||
vulnerability: vulnerability,
|
||||
});
|
||||
const issue = await client.rest.issues.create({
|
||||
owner: owner,
|
||||
repo: repo,
|
||||
const issue = await api.repos.issueCreateIssue(owner, repo, {
|
||||
title: `${vulnerability.advisory.id}: ${vulnerability.advisory.title}`,
|
||||
body: body,
|
||||
labels,
|
||||
body,
|
||||
});
|
||||
for (const label of labels) {
|
||||
core.warning(`Unable to add label ${label}`);
|
||||
}
|
||||
core.info(
|
||||
`Created an issue for ${vulnerability.advisory.id}: ${issue.data.html_url}`,
|
||||
);
|
||||
@@ -316,12 +326,13 @@ export async function reportIssues(
|
||||
warning: warning,
|
||||
advisory: advisory,
|
||||
});
|
||||
const issue = await client.rest.issues.create({
|
||||
owner: owner,
|
||||
repo: repo,
|
||||
const issue = await api.repos.issueCreateIssue(owner, repo, {
|
||||
title: `${advisory.id}: ${advisory.title}`,
|
||||
body: body,
|
||||
body,
|
||||
});
|
||||
for (const label of labels) {
|
||||
core.warning(`Unable to add label ${label}`);
|
||||
}
|
||||
core.info(
|
||||
`Created an issue for ${advisory.id}: ${issue.data.html_url}`,
|
||||
);
|
||||
|
||||
Reference in New Issue
Block a user