✨ Feature: Dependency-diff Visualization in the Scorecard Action (version 0 - part 1)

action.yaml

@@ -41,13 +41,27 @@ inputs:
     description: "INPUT: Default GitHub token. (Internal purpose only, not intended for developers to set. Used for pull requests configured with a PAT)."
     required: false
     default: ${{ github.token }}
+  checks:
+    description: "INPUT: Scorecard checks to run. Use this input to specify the checks to run for dependency-diffs."
+    required: false
+    default: "Maintained,Security-Policy,License,Code-Review,SAST" # Several important checks by default.
+  change_types:
+    description: "INPUT: Depenency-diff change types to surface Scorecard check results."
+    required: false
+    default: "added"
+  pull_request_head_sha:
+    description: "INPUT: The headSHA of the merging branch in a pull request. This is only used for a pull request-triggered action."
+    required: false
+    default: ${{ github.event.pull_request.head.sha }}
+
 
 branding:
   icon: "mic"
   color: "white"
 
 runs:
   using: "docker"
-  image: "docker://gcr.io/openssf/scorecard-action:v2.0.0-beta.1"
+  image: "Dockerfile"
+  # image: "docker://gcr.io/openssf/scorecard-action:v2.0.0-beta.1"
 
 

entrypoint/dependencydiff/entrypoint_depdiff.go

@@ -0,0 +1,82 @@
+// Copyright 2022 Security Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dependencydiff
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os"
+	"strings"
+
+	"github.com/google/go-github/v45/github"
+	"github.com/ossf/scorecard-action/options"
+	"github.com/ossf/scorecard/v4/clients/githubrepo/roundtripper"
+	"github.com/ossf/scorecard/v4/dependencydiff"
+	"github.com/ossf/scorecard/v4/log"
+	"github.com/ossf/scorecard/v4/pkg"
+)
+
+// New creates a new instance running the scorecard dependency-diff mode
+// used as an entrypoint for GitHub Actions.
+func New(ctx context.Context) error {
+	repoURI := os.Getenv(options.EnvGithubRepository)
+	ownerRepo := strings.Split(repoURI, "/")
+	if len(ownerRepo) != 2 {
+		return fmt.Errorf("%w: repo uri", errInvalid)
+	}
+	// Since the event listener is set to pull requests to main, this will be the main branch reference.
+	base := os.Getenv(options.EnvGithubBaseRef)
+	if base == "" {
+		return fmt.Errorf("%w: base ref", errEmpty)
+	}
+	// The head reference of the pull request source branch.
+	head := os.Getenv(options.EnvGitHubHeadRef)
+	if head == "" {
+		return fmt.Errorf("%w: head ref", errEmpty)
+	}
+	// GetDependencyDiffResults will handle the error checking of checks.
+	checks := strings.Split(os.Getenv(options.EnvInputChecks), ",")
+	changeTypes := strings.Split(os.Getenv(options.EnvInputChangeTypes), ",")
+	changeTypeMap := map[pkg.ChangeType]bool{}
+	for _, ct := range changeTypes {
+		key := pkg.ChangeType(ct)
+		if !key.IsValid() {
+			return fmt.Errorf("%w: change type", errInvalid)
+		}
+		changeTypeMap[key] = true
+	}
+	deps, err := dependencydiff.GetDependencyDiffResults(
+		ctx, repoURI, base, head, checks, changeTypeMap,
+	)
+	if err != nil {
+		return fmt.Errorf("error getting dependency-diff: %w", err)
+	}
+
+	// Generate a markdown string using the dependency-diffs and write it to the pull request comment.
+	report, err := dependencydiffResultsAsMarkdown(deps, base, head)
+	if err != nil {
+		return fmt.Errorf("error formatting results as markdown: %w", err)
+	}
+	logger := log.NewLogger(log.DefaultLevel)
+	ghrt := roundtripper.NewTransport(ctx, logger) /* This round tripper handles the access token. */
+	ghClient := github.NewClient(&http.Client{Transport: ghrt})
+	err = writeToComment(ctx, ghClient, ownerRepo[0], ownerRepo[1], report)
+	if err != nil {
+		return fmt.Errorf("error writting the report to comment: %w", err)
+	}
+
+	return nil
+}

entrypoint/dependencydiff/errors.go

@@ -0,0 +1,23 @@
+// Copyright 2022 Security Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dependencydiff
+
+import "errors"
+
+var (
+	errEmpty          = errors.New("empty")
+	errInvalid        = errors.New("invalid")
+	errShouldNotBeNil = errors.New("should not be nil")
+)

entrypoint/dependencydiff/helpers.go

@@ -0,0 +1,117 @@
+// Copyright 2022 Security Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package dependencydiff
+
+import (
+	"fmt"
+	"net/http"
+	"net/url"
+
+	docs "github.com/ossf/scorecard/v4/docs/checks"
+	"github.com/ossf/scorecard/v4/pkg"
+)
+
+func getDependencySortKeys(dcMap map[string]pkg.DependencyCheckResult,
+) ([]scoreAndDependencyName, error) {
+	sortKeys := []scoreAndDependencyName{}
+	doc, err := docs.Read()
+	if err != nil {
+		return nil, fmt.Errorf("error reading docs: %w", err)
+	}
+	for k := range dcMap {
+		scoreAndName := scoreAndDependencyName{
+			dependencyName: dcMap[k].Name,
+			aggregateScore: negInf,
+			// Since this struct is for sorting, the dependency having a score of negative infinite
+			// will be put to the very last, unless its agregate score is not empty.
+		}
+		scResults := dcMap[k].ScorecardResultWithError.ScorecardResult
+		if scResults != nil {
+			score, err := scResults.GetAggregateScore(doc)
+			if err != nil {
+				return nil, fmt.Errorf("error getting the aggregate score: %w", err)
+			}
+			scoreAndName.aggregateScore = score
+		}
+		sortKeys = append(sortKeys, scoreAndName)
+	}
+	return sortKeys, nil
+}
+
+func addedTag() string {
+	return fmt.Sprintf(" :sparkles: **`" + "added" + "`** ")
+}
+
+func removedTag() string {
+	return fmt.Sprintf(" ~~**`" + "removed" + "`**~~ ")
+}
+
+func scoreTag(score float64) string {
+	switch score {
+	case negInf:
+		return ""
+	default:
+		return fmt.Sprintf("`Score: %.1f` ", score)
+	}
+}
+
+// Convert the dependency-diff check result slice to two maps: added and removed, for added and removed dependencies respectively.
+func dependencySliceToMaps(deps []pkg.DependencyCheckResult) (map[string]pkg.DependencyCheckResult,
+	map[string]pkg.DependencyCheckResult) {
+	added := map[string]pkg.DependencyCheckResult{}
+	removed := map[string]pkg.DependencyCheckResult{}
+	for _, d := range deps {
+		if d.ChangeType != nil {
+			switch *d.ChangeType {
+			case pkg.Added:
+				added[d.Name] = d
+			case pkg.Removed:
+				removed[d.Name] = d
+			case pkg.Updated:
+				// Do nothing, for now.
+				// The current data source GitHub Dependency Review won't give the updated dependencies,
+				// so we need to find them manually by checking the added/removed maps.
+			}
+		}
+	}
+	return added, removed
+}
+
+func entryExists(system, name, version string) (bool, error) {
+	url := fmt.Sprintf(
+		"https://deps.dev/_/s/%s/p/%s/v/%s",
+		url.PathEscape(system),
+		url.PathEscape(name),
+		url.PathEscape(version),
+	)
+	resp, err := http.Get(url)
+	if err != nil {
+		return false, fmt.Errorf("error requesting deps.dec/_: %w", err)
+	}
+	switch resp.StatusCode {
+	case http.StatusOK:
+		return true, nil
+	default:
+		return false, nil
+	}
+}
+
+func asPointerChangeType(ct pkg.ChangeType) *pkg.ChangeType {
+	return &ct
+}
+
+func asPointerStr(s string) *string {
+	return &s
+}