Skip to content

Commit 38cd782

Browse files
deivid-rodriguezdeivid-rodriguez
authored
Ignore GitHub Actions unless they are pinned (#6743)
1 parent c49b3f9 commit 38cd782

File tree

5 files changed

+52
-45
lines changed

5 files changed

+52
-45
lines changed

‎github_actions/lib/dependabot/github_actions/file_parser.rb

+7-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,13 @@ def workfile_file_dependencies(file)
4646

4747
uses_strings.each do |string|
4848
# TODO: Support Docker references and path references
49-
dependency_set << build_github_dependency(file, string) if string.match?(GITHUB_REPO_REFERENCE)
49+
next unless string.match?(GITHUB_REPO_REFERENCE)
50+
51+
dep = build_github_dependency(file, string)
52+
git_checker = Dependabot::GitCommitChecker.new(dependency: dep, credentials: credentials)
53+
next unless git_checker.pinned?
54+
55+
dependency_set << dep
5056
end
5157

5258
dependency_set

‎github_actions/spec/dependabot/github_actions/file_parser_spec.rb

+34-33
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,25 @@
3030
)
3131
end
3232

33+
def mock_service_pack_request(nwo)
34+
stub_request(:get, "https://github.com/#{nwo}.git/info/refs?service=git-upload-pack").
35+
to_return(
36+
status: 200,
37+
body: fixture("git", "upload_packs", "checkout"),
38+
headers: {
39+
"content-type" => "application/x-git-upload-pack-advertisement"
40+
}
41+
)
42+
end
43+
3344
describe "parse" do
3445
subject(:dependencies) { parser.parse }
3546

47+
before do
48+
mock_service_pack_request("actions/checkout")
49+
mock_service_pack_request("actions/setup-node")
50+
end
51+
3652
its(:length) { is_expected.to eq(2) }
3753

3854
describe "the first dependency" do
@@ -45,24 +61,28 @@
4561
source: {
4662
type: "git",
4763
url: "https://github.com/actions/checkout",
48-
ref: "master",
64+
ref: "v1",
4965
branch: nil
5066
},
51-
metadata: { declaration_string: "actions/checkout@master" }
67+
metadata: { declaration_string: "actions/checkout@v1" }
5268
}]
5369
end
5470

5571
it "has the right details" do
5672
expect(dependency).to be_a(Dependabot::Dependency)
5773
expect(dependency.name).to eq("actions/checkout")
58-
expect(dependency.version).to be_nil
74+
expect(dependency.version).to eq("1")
5975
expect(dependency.requirements).to eq(expected_requirements)
6076
end
6177
end
6278

6379
context "with a path" do
6480
let(:workflow_file_fixture_name) { "workflow_monorepo.yml" }
6581

82+
before do
83+
mock_service_pack_request("actions/aws")
84+
end
85+
6686
its(:length) { is_expected.to eq(2) }
6787

6888
describe "the last dependency" do
@@ -75,28 +95,28 @@
7595
source: {
7696
type: "git",
7797
url: "https://github.com/actions/aws",
78-
ref: "master",
98+
ref: "v1.0.0",
7999
branch: nil
80100
},
81-
metadata: { declaration_string: "actions/aws/ec2@master" }
101+
metadata: { declaration_string: "actions/aws/ec2@v1.0.0" }
82102
}, {
83103
requirement: nil,
84104
groups: [],
85105
file: ".github/workflows/workflow.yml",
86106
source: {
87107
type: "git",
88108
url: "https://github.com/actions/aws",
89-
ref: "master",
109+
ref: "v1.0.0",
90110
branch: nil
91111
},
92-
metadata: { declaration_string: "actions/aws@master" }
112+
metadata: { declaration_string: "actions/aws@v1.0.0" }
93113
}]
94114
end
95115

96116
it "has the right details" do
97117
expect(dependency).to be_a(Dependabot::Dependency)
98118
expect(dependency.name).to eq("actions/aws")
99-
expect(dependency.version).to be_nil
119+
expect(dependency.version).to eq("1.0.0")
100120
expect(dependency.requirements).to eq(expected_requirements)
101121
end
102122
end
@@ -118,17 +138,6 @@
118138
branch: nil
119139
},
120140
metadata: { declaration_string: "actions/[email protected]" }
121-
}, {
122-
requirement: nil,
123-
groups: [],
124-
file: ".github/workflows/workflow.yml",
125-
source: {
126-
type: "git",
127-
url: "https://github.com/actions/checkout",
128-
ref: "master",
129-
branch: nil
130-
},
131-
metadata: { declaration_string: "actions/checkout@master" }
132141
}]
133142
end
134143

@@ -193,6 +202,12 @@
193202

194203
its(:length) { is_expected.to eq(4) }
195204

205+
before do
206+
mock_service_pack_request("docker/setup-qemu-action")
207+
mock_service_pack_request("docker/setup-buildx-action")
208+
mock_service_pack_request("docker/login-action")
209+
end
210+
196211
context "the first dependency" do
197212
subject(:dependency) { dependencies.first }
198213

@@ -245,20 +260,6 @@
245260

246261
context "with a semver tag pinned to a reusable workflow commit" do
247262
let(:workflow_file_fixture_name) { "workflow_semver_reusable.yml" }
248-
let(:service_pack_url) do
249-
"https://github.com/actions/checkout.git/info/refs" \
250-
"?service=git-upload-pack"
251-
end
252-
before do
253-
stub_request(:get, service_pack_url).
254-
to_return(
255-
status: 200,
256-
body: fixture("git", "upload_packs", "checkout"),
257-
headers: {
258-
"content-type" => "application/x-git-upload-pack-advertisement"
259-
}
260-
)
261-
end
262263

263264
its(:length) { is_expected.to eq(1) }
264265

‎github_actions/spec/dependabot/github_actions/file_updater_spec.rb

+6-6
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@
116116
ref: "v1.1.0",
117117
branch: nil
118118
},
119-
metadata: { declaration_string: "actions/aws/ec2@master" }
119+
metadata: { declaration_string: "actions/aws/ec2@v1.0.0" }
120120
}, {
121121
requirement: nil,
122122
groups: [],
@@ -127,7 +127,7 @@
127127
ref: "v1.1.0",
128128
branch: nil
129129
},
130-
metadata: { declaration_string: "actions/aws@master" }
130+
metadata: { declaration_string: "actions/aws@v1.0.0" }
131131
}],
132132
previous_requirements: [{
133133
requirement: nil,
@@ -136,21 +136,21 @@
136136
source: {
137137
type: "git",
138138
url: "https://github.com/actions/aws",
139-
ref: "master",
139+
ref: "v1.0.0",
140140
branch: nil
141141
},
142-
metadata: { declaration_string: "actions/aws/ec2@master" }
142+
metadata: { declaration_string: "actions/aws/ec2@v1.0.0" }
143143
}, {
144144
requirement: nil,
145145
groups: [],
146146
file: ".github/workflows/workflow.yml",
147147
source: {
148148
type: "git",
149149
url: "https://github.com/actions/aws",
150-
ref: "master",
150+
ref: "v1.0.0",
151151
branch: nil
152152
},
153-
metadata: { declaration_string: "actions/aws@master" }
153+
metadata: { declaration_string: "actions/aws@v1.0.0" }
154154
}],
155155
package_manager: "github_actions"
156156
)

‎github_actions/spec/fixtures/workflow_files/workflow.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ jobs:
77
runs-on: ubuntu-latest
88

99
steps:
10-
- uses: actions/checkout@master
10+
- uses: actions/checkout@v1
1111

1212
- name: Use Node.js 10.x
13-
uses: actions/setup-node@master
13+
uses: actions/setup-node@v1
1414
with:
1515
version: 10.x
1616

‎github_actions/spec/fixtures/workflow_files/workflow_monorepo.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,10 @@ jobs:
77
runs-on: ubuntu-latest
88

99
steps:
10-
- uses: actions/checkout@master
10+
- uses: actions/checkout@v1
1111

1212
- name: Use Node.js 10.x
13-
uses: actions/aws/ec2@master
13+
uses: actions/aws/ec2@v1.0.0
1414
with:
1515
version: 10.x
1616

@@ -28,6 +28,6 @@ jobs:
2828
- uses: actions/checkout@master
2929

3030
- name: Use Node.js ${{matrix.node}}.x
31-
uses: actions/aws@master
31+
uses: actions/aws@v1.0.0
3232
with:
3333
version: ${{matrix.node}}.x

0 commit comments

Comments
 (0)