actions/go-dependency-submission
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #12 from actions/lsep/fix-url-encoding

Browse Source 
Do not URL-safe encode the namespace. PackageURL does this
This commit is contained in:
Brandyn Phelps
2022-06-23 11:48:05 -07:00
committed by GitHub
parent 0a044ad723 9a1dc9e4d6
commit 68f3c0969e
6 changed files with 158 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/index.js
Vendored
+1 -2
View File
@@ -108,8 +108,7 @@ function parseGoPackage(pkg) {
let namespace = null;
let name;
if (qualifiedPackage.indexOf('/') !== -1) {
// need to URL-safe encode slashes in the namespace
namespace = encodeURIComponent(path_1.default.dirname(qualifiedPackage));
namespace = path_1.default.dirname(qualifiedPackage);
name = path_1.default.basename(qualifiedPackage);
}
else {
dist/index.js.map
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/parse.js
Vendored
+58
View File
@@ -0,0 +1,58 @@
"use strict";
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.parseGoModGraph = exports.parseGoList = exports.parseGoPackage = void 0;
const path_1 = __importDefault(require("path"));
const packageurl_js_1 = require("packageurl-js");
function parseGoPackage(pkg) {
const [qualifiedPackage, version] = pkg.split('@');
let namespace = null;
let name;
if (qualifiedPackage.indexOf('/') !== -1) {
namespace = path_1.default.dirname(qualifiedPackage);
name = path_1.default.basename(qualifiedPackage);
}
else {
name = qualifiedPackage;
}
return new packageurl_js_1.PackageURL('golang', namespace, name, version !== null && version !== void 0 ? version : null, null, null);
}
exports.parseGoPackage = parseGoPackage;
/**
* parseGoList parses a list of Go packages (one per line) matching the format
* "${GO_PACKAGE}@v{VERSION}" into Package URLs. This expects the output of 'go
* list -deps' as input.
*
* @param {string} contents
* @returns {Array<PackageURL>}
*/
function parseGoList(contents) {
// split the input by newlines, sort, and dedup
const packages = Array.from(new Set(contents.split('\n').map((p) => p.trim())));
const purls = [];
packages.forEach((pkg) => {
if (!pkg.trim())
return;
purls.push(parseGoPackage(pkg));
});
return purls;
}
exports.parseGoList = parseGoList;
/**
* parseGoModGraph parses an *associative list* of Go packages into tuples into
* an associative list of PackageURLs. This expects the output of 'go mod
* graph' as input
*/
function parseGoModGraph(contents) {
const pkgAssocList = [];
contents.split('\n').forEach((line) => {
if (!line.trim())
return;
const [parentPkg, childPkg] = line.split(' ');
pkgAssocList.push([parseGoPackage(parentPkg), parseGoPackage(childPkg)]);
});
return pkgAssocList;
}
exports.parseGoModGraph = parseGoModGraph;
dist/process.js
Vendored
+87
View File
@@ -0,0 +1,87 @@
"use strict";
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
return new (P || (P = Promise))(function (resolve, reject) {
function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
step((generator = generator.apply(thisArg, _arguments || [])).next());
});
};
var __importDefault = (this && this.__importDefault) || function (mod) {
return (mod && mod.__esModule) ? mod : { "default": mod };
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.processGoBuildTarget = exports.processGoGraph = void 0;
const path_1 = __importDefault(require("path"));
const exec = __importStar(require("@actions/exec"));
const core = __importStar(require("@actions/core"));
const dependency_submission_toolkit_1 = require("@github/dependency-submission-toolkit");
const parse_1 = require("./parse");
function processGoGraph(goModDir) {
return __awaiter(this, void 0, void 0, function* () {
console.log(`Running 'go mod graph' in ${goModDir}`);
const goModGraph = yield exec.getExecOutput('go', ['mod', 'graph'], {
cwd: goModDir
});
if (goModGraph.exitCode !== 0) {
core.error(goModGraph.stderr);
core.setFailed("'go mod graph' failed!");
throw new Error("Failed to execute 'go mod graph'");
}
const cache = new dependency_submission_toolkit_1.PackageCache();
const packageAssocList = (0, parse_1.parseGoModGraph)(goModGraph.stdout);
packageAssocList.forEach(([parentPkg, childPkg]) => {
cache.package(parentPkg).dependsOn(cache.package(childPkg));
});
return cache;
});
}
exports.processGoGraph = processGoGraph;
// For a specific Go _build target_, this template lists all dependencies used
// to build the build target It does not provide association between the
// dependencies (i.e. which dependencies depend on which)
// eslint-disable-next-line quotes
// eslint-disable-next-line no-useless-escape
const GO_LIST_DEP_TEMPLATE = '{{define "M"}}{{.Path}}@{{.Version}}{{end}}{{with .Module}}{{if not .Main}}{{if .Replace}}{{template "M" .Replace}}{{else}}{{template "M" .}}{{end}}{{end}}{{end}}';
function processGoBuildTarget(goModDir, goBuildTarget, cache) {
return __awaiter(this, void 0, void 0, function* () {
console.log(`Running go package detection in ${goModDir} on build target ${goBuildTarget}`);
const goList = yield exec.getExecOutput('go', ['list', '-deps', '-f', GO_LIST_DEP_TEMPLATE, goBuildTarget], { cwd: goModDir });
if (goList.exitCode !== 0) {
core.error(goList.stderr);
core.setFailed("'go list' failed!");
throw new Error("Failed to execute 'go list'");
}
const dependencies = (0, parse_1.parseGoList)(goList.stdout);
const manifest = new dependency_submission_toolkit_1.BuildTarget(goBuildTarget, path_1.default.join(goModDir, goBuildTarget));
dependencies.forEach((dep) => {
manifest.addBuildDependency(cache.package(dep));
});
return manifest;
});
}
exports.processGoBuildTarget = processGoBuildTarget;
src/parse.test.ts
+10 -13
View File
@@ -12,12 +12,9 @@ describe('parseGoPackage', () => {
'pkg:golang/foo/bar@0.1.2'
)
})
// this test should pass, but packageurl-js is double URL-safe encoding the
// '%' to %25. It won't, however, URL-encode the '/' that is represented by
// %2F.
it.skip('parses a package with a namespace with slashes', () => {
expect(parseGoPackage('foo/boo/bar@0.1.2').toString()).toEqual(
'pkg:golang/foo%2Fboo/bar@0.1.2'
it('parses a package with a namespace with slashes', () => {
expect(parseGoPackage('github.com/foo/bar@0.1.2').toString()).toEqual(
'pkg:golang/github.com/foo/bar@0.1.2'
)
})
it('parses a package without a namespace', () => {
@@ -36,7 +33,7 @@ describe('parseGoList', () => {
{
type: 'golang',
name: 'otlptracehttp',
namespace: 'go.opentelemetry.io%2Fotel%2Fexporters%2Fotlp%2Fotlptrace',
namespace: 'go.opentelemetry.io/otel/exporters/otlp/otlptrace',
version: 'v1.7.0',
qualifiers: null,
subpath: null
@@ -44,7 +41,7 @@ describe('parseGoList', () => {
{
type: 'golang',
name: 'sys',
namespace: 'golang.org%2Fx',
namespace: 'golang.org/x',
version: 'v0.0.0-20220317061510-51cd9980dadf',
qualifiers: null,
subpath: null
@@ -52,7 +49,7 @@ describe('parseGoList', () => {
{
type: 'golang',
name: 'text',
namespace: 'golang.org%2Fx',
namespace: 'golang.org/x',
version: 'v0.3.7',
qualifiers: null,
subpath: null
@@ -88,7 +85,7 @@ github.com/mattn/go-colorable@v1.1.9 github.com/mattn/go-isatty@v0.0.12`)
{
type: 'golang',
name: 'color',
namespace: 'github.com%2Ffatih',
namespace: 'github.com/fatih',
version: 'v1.13.0',
qualifiers: null,
subpath: null
@@ -96,7 +93,7 @@ github.com/mattn/go-colorable@v1.1.9 github.com/mattn/go-isatty@v0.0.12`)
{
type: 'golang',
name: 'go-isatty',
namespace: 'github.com%2Fmattn',
namespace: 'github.com/mattn',
version: 'v0.0.14',
qualifiers: null,
subpath: null
@@ -106,7 +103,7 @@ github.com/mattn/go-colorable@v1.1.9 github.com/mattn/go-isatty@v0.0.12`)
{
type: 'golang',
name: 'go-colorable',
namespace: 'github.com%2Fmattn',
namespace: 'github.com/mattn',
version: 'v1.1.9',
qualifiers: null,
subpath: null
@@ -114,7 +111,7 @@ github.com/mattn/go-colorable@v1.1.9 github.com/mattn/go-isatty@v0.0.12`)
{
type: 'golang',
name: 'go-isatty',
namespace: 'github.com%2Fmattn',
namespace: 'github.com/mattn',
version: 'v0.0.12',
qualifiers: null,
subpath: null
src/parse.ts
+1 -2
View File
@@ -6,8 +6,7 @@ export function parseGoPackage (pkg: string): PackageURL {
let namespace: string | null = null
let name: string
if (qualifiedPackage.indexOf('/') !== -1) {
// need to URL-safe encode slashes in the namespace
namespace = encodeURIComponent(path.dirname(qualifiedPackage))
namespace = path.dirname(qualifiedPackage)
name = path.basename(qualifiedPackage)
} else {
name = qualifiedPackage