Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix Workflow Global Permissions Nil Check #85

Merged
merged 36 commits into from
Apr 26, 2022
Merged

Fix Workflow Global Permissions Nil Check #85

merged 36 commits into from
Apr 26, 2022

Conversation

rohankh532
Copy link
Contributor

@rohankh532 rohankh532 commented Apr 22, 2022 •
edited
Loading

rohankh532 and others added 30 commits March 29, 2022 18:14
@rohankh532
post endpoint
73a914b
@rohankh532
use exported func for verifyTlogEntry
0452748
@rohankh532
for trigger
322a2f4
@rohankh532
Merge branch 'main' of https://github.com/ossf/scorecard-webapp into …
c156fcc 
…post-endpoint
@rohankh532
reverted go version. was breaking build
5e2fcdc
@rohankh532
Merge branch 'main' into post-endpoint
81cf3fb
@rohankh532
moved entry/cert lookup code to sep func & process jsonOutput too
3158ee0
@rohankh532
removed finished todos
442bef9
@rohankh532
fixed tests + use cert to find wkflw path
6bd7ce2
@rohankh532
refactored if statement
a4aaa4f
@rohankh532
check for global wkflw env, defaults, permissions
8d47ee3
@rohankh532
don't assume main job name
1973abd
@rohankh532
verify cert SHAs too
5b3c94c
@rohankh532
Merge branch 'main' into post-endpoint
8179ca9
@rohankh532
Verify that branch is the repo's default branch
56d8c8c
@rohankh532
Merge branch 'post-endpoint' of https://github.com/ossf/scorecard-webapp
f85a46a 
 into post-endpoint
@rohankh532
Merge branch 'main' into post-endpoint
e39014b
@rohankh532
verify cert hasn't expired
3768d4b
@rohankh532
Merge branch 'post-endpoint' of https://github.com/ossf/scorecard-webapp
d570658 
 into post-endpoint
@rohankh532
merged main into post-endpoint
5fafee8
@rohankh532
refactored post endpoint
5adcdb1
@rohankh532
Merge branch 'main' into post-endpoint
40aee91
@rohankh532
allow multiple jobs
8461ce3
@rohankh532
allow other flavors of ubuntu
f4687cf
@rohankh532
refactored VerifySignature
c576d8d
@rohankh532
check for token-id permissions
40d3a97
@rohankh532
remove sarif results from processing
4bc515b
@rohankh532
Merge branch 'main' into post-endpoint
b8616d6
@rohankh532
fixed logic for verifying wkflw perms
63c62c0
@rohankh532
simplified if statement
2666e69
azeemshaikh38
azeemshaikh38 reviewed Apr 22, 2022
View reviewed changes
Copy link
Contributor

@azeemshaikh38 azeemshaikh38 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you add tests for this? Especially the verifyScorecardWorkflow fn.

signing/signing.go Outdated Show resolved Hide resolved
azeemshaikh38
azeemshaikh38 approved these changes Apr 22, 2022
View reviewed changes
signing/signing_test.go Show resolved Hide resolved
@rohankh532 rohankh532 mentioned this pull request Apr 26, 2022
Closed
@laurentsimon laurentsimon enabled auto-merge (squash) April 26, 2022 18:42
@laurentsimon laurentsimon merged commit 289ada1 into main Apr 26, 2022
@laurentsimon laurentsimon deleted the post-endpoint branch April 26, 2022 18:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@laurentsimon laurentsimon laurentsimon approved these changes

@azeemshaikh38 azeemshaikh38 azeemshaikh38 approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@rohankh532 @azeemshaikh38 @laurentsimon @Paradiselife84