✨ Enable users to integrate external checks via blank-imports

checks/all_checks.go

@@ -54,7 +54,7 @@ func GetAllWithExperimental() checker.CheckNameToFnMap {
 	return getAll(true /*overrideExperimental*/)
 }
 
-func registerCheck(name string, fn checker.CheckFn, supportedRequestTypes []checker.RequestType) error {
+func RegisterCheck(name string, fn checker.CheckFn, supportedRequestTypes []checker.RequestType) error {
 	if name == "" {
 		return errInternalNameCannotBeEmpty
 	}

checks/all_checks_test.go

@@ -21,7 +21,7 @@ import (
 	"github.com/ossf/scorecard/v4/checker"
 )
 
-func Test_registerCheck(t *testing.T) {
+func Test_RegisterCheck(t *testing.T) {
 	t.Parallel()
 	type args struct {
 		fn   checker.CheckFn
@@ -33,7 +33,7 @@ func Test_registerCheck(t *testing.T) {
 		wanterr bool
 	}{
 		{
-			name: "registerCheck",
+			name: "RegisterCheck",
 			args: args{
 				name: "test",
 				fn:   func(x *checker.CheckRequest) checker.CheckResult { return checker.CheckResult{} },
@@ -60,8 +60,8 @@ func Test_registerCheck(t *testing.T) {
 		tt := tt
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			if err := registerCheck(tt.args.name, tt.args.fn, nil /*supportedRequestTypes*/); (err != nil) != tt.wanterr {
-				t.Errorf("registerCheck() error = %v, wantErr %v", err, tt.wanterr)
+			if err := RegisterCheck(tt.args.name, tt.args.fn, nil /*supportedRequestTypes*/); (err != nil) != tt.wanterr {
+				t.Errorf("RegisterCheck() error = %v, wantErr %v", err, tt.wanterr)
 			}
 		})
 	}

checks/binary_artifact.go

@@ -32,7 +32,7 @@ func init() {
 		checker.CommitBased,
 		checker.FileBased,
 	}
-	if err := registerCheck(CheckBinaryArtifacts, BinaryArtifacts, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckBinaryArtifacts, BinaryArtifacts, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/branch_protection.go

@@ -26,7 +26,7 @@ const CheckBranchProtection = "Branch-Protection"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckBranchProtection, BranchProtection, nil); err != nil {
+	if err := RegisterCheck(CheckBranchProtection, BranchProtection, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/ci_tests.go

@@ -30,7 +30,7 @@ func init() {
 	supportedRequestTypes := []checker.RequestType{
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckCITests, CITests, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckCITests, CITests, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/cii_best_practices.go

@@ -28,7 +28,7 @@ const CheckCIIBestPractices = "CII-Best-Practices"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckCIIBestPractices, CIIBestPractices, nil); err != nil {
+	if err := RegisterCheck(CheckCIIBestPractices, CIIBestPractices, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/code_review.go

@@ -29,7 +29,7 @@ func init() {
 	supportedRequestTypes := []checker.RequestType{
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckCodeReview, CodeReview, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckCodeReview, CodeReview, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/contributors.go

@@ -28,7 +28,7 @@ const CheckContributors = "Contributors"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckContributors, Contributors, nil); err != nil {
+	if err := RegisterCheck(CheckContributors, Contributors, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/dangerous_workflow.go

@@ -32,7 +32,7 @@ func init() {
 		checker.FileBased,
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckDangerousWorkflow, DangerousWorkflow, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckDangerousWorkflow, DangerousWorkflow, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/dependency_update_tool.go

@@ -31,7 +31,7 @@ func init() {
 	supportedRequestTypes := []checker.RequestType{
 		checker.FileBased,
 	}
-	if err := registerCheck(CheckDependencyUpdateTool, DependencyUpdateTool, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckDependencyUpdateTool, DependencyUpdateTool, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/fuzzing.go

@@ -28,7 +28,7 @@ const CheckFuzzing = "Fuzzing"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckFuzzing, Fuzzing, nil); err != nil {
+	if err := RegisterCheck(CheckFuzzing, Fuzzing, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/license.go

@@ -31,7 +31,7 @@ func init() {
 	supportedRequestTypes := []checker.RequestType{
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckLicense, License, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckLicense, License, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/maintained.go

@@ -28,7 +28,7 @@ const CheckMaintained = "Maintained"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckMaintained, Maintained, nil); err != nil {
+	if err := RegisterCheck(CheckMaintained, Maintained, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/packaging.go

@@ -31,7 +31,7 @@ const CheckPackaging = "Packaging"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckPackaging, Packaging, nil); err != nil {
+	if err := RegisterCheck(CheckPackaging, Packaging, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/permissions.go

@@ -30,7 +30,7 @@ func init() {
 		checker.FileBased,
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckTokenPermissions, TokenPermissions, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckTokenPermissions, TokenPermissions, supportedRequestTypes); err != nil {
 		// This should never happen.
 		panic(err)
 	}

checks/pinned_dependencies.go

@@ -30,7 +30,7 @@ func init() {
 		checker.FileBased,
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckPinnedDependencies, PinningDependencies, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckPinnedDependencies, PinningDependencies, supportedRequestTypes); err != nil {
 		// This should never happen.
 		panic(err)
 	}

checks/plugin.go

@@ -0,0 +1,66 @@
+// Copyright 2024 OpenSSF Scorecard Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package checks
+
+import (
+	"io/ioutil"
+	"log"
+	"os"
+	"plugin"
+	"strings"
+	"sync"
+)
+
+const CheckPluginLocationEnvironmentVariable = "SCORECARD_DYNAMIC_CHECKS"
+
+var pluginMutex sync.Mutex
+
+//nolint:gochecknoinits
+func init() {
+	pluginsDir, ok := os.LookupEnv(CheckPluginLocationEnvironmentVariable)
+	if !ok {
+		return
+	}
+
+	files, err := ioutil.ReadDir(pluginsDir)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	// Avoid `recursive call during initialization - linker skew` via mutex
+	pluginMutex.Lock()
+	defer pluginMutex.Unlock()
+
+	for _, file := range files {
+		if !strings.HasSuffix(file.Name(), ".so") {
+			continue
+		}
+
+		p, err := plugin.Open(file.Name())
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		registerCheck, err := p.Lookup("RegisterCheck")
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		err = registerCheck.(func() error)()
+		if err != nil {
+			log.Fatal(err)
+		}
+	}
+}

checks/sast.go

@@ -28,7 +28,7 @@ const CheckSAST = "SAST"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckSAST, SAST, nil); err != nil {
+	if err := RegisterCheck(CheckSAST, SAST, nil); err != nil {
 		// This should never happen.
 		panic(err)
 	}

checks/security_policy.go

@@ -31,7 +31,7 @@ func init() {
 	supportedRequestTypes := []checker.RequestType{
 		checker.CommitBased,
 	}
-	if err := registerCheck(CheckSecurityPolicy, SecurityPolicy, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckSecurityPolicy, SecurityPolicy, supportedRequestTypes); err != nil {
 		// This should never happen.
 		panic(err)
 	}

checks/signed_releases.go

@@ -28,7 +28,7 @@ const CheckSignedReleases = "Signed-Releases"
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckSignedReleases, SignedReleases, nil); err != nil {
+	if err := RegisterCheck(CheckSignedReleases, SignedReleases, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/vulnerabilities.go

@@ -32,7 +32,7 @@ func init() {
 		checker.CommitBased,
 		checker.FileBased,
 	}
-	if err := registerCheck(CheckVulnerabilities, Vulnerabilities, supportedRequestTypes); err != nil {
+	if err := RegisterCheck(CheckVulnerabilities, Vulnerabilities, supportedRequestTypes); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/webhook.go

@@ -32,7 +32,7 @@ const (
 
 //nolint:gochecknoinits
 func init() {
-	if err := registerCheck(CheckWebHooks, WebHooks, nil); err != nil {
+	if err := RegisterCheck(CheckWebHooks, WebHooks, nil); err != nil {
 		// this should never happen
 		panic(err)
 	}

checks/write.md

@@ -34,7 +34,7 @@ The steps to writing a check are as follows:
     const CheckMyCheckName string = "My-Check"
 
     func init() {
-        registerCheck(CheckMyCheckName, EntryPointMyCheck)
+        RegisterCheck(CheckMyCheckName, EntryPointMyCheck)
     }
     ```
 

docs/checks/impl.go

@@ -21,6 +21,7 @@ import (
 	"strings"
 
 	"github.com/ossf/scorecard/v4/docs/checks/internal"
+	"github.com/ossf/scorecard/v4/docs/checks/plugin"
 	sce "github.com/ossf/scorecard/v4/errors"
 )
 
@@ -32,6 +33,7 @@ const docURL = "https://github.com/ossf/scorecard/blob/%s/docs/checks.md"
 // contains checks' documentation.
 type DocImpl struct {
 	internaldoc internal.Doc
+	plugindoc   plugin.Doc
 }
 
 // Read loads the checks' documentation.
@@ -42,7 +44,13 @@ func Read() (Doc, error) {
 		return &d, fmt.Errorf("internal.ReadDoc: %w", e)
 	}
 
-	d := DocImpl{internaldoc: m}
+	p, e := plugin.ReadDoc()
+	if e != nil {
+		d := DocImpl{}
+		return &d, fmt.Errorf("plugin.ReadDoc: %w", e)
+	}
+
+	d := DocImpl{internaldoc: m, plugindoc: p}
 	return &d, nil
 }