Skip to content

Commit f08e8fb

Browse files
lharrison13lharrison13
authored
✨ Added github codeowners to contributors list influencing contributors check (#4611)
* ✨ added github codeowners to contributors list Signed-off-by: Luke Harrison <[email protected]> * ✨ deduped code owners and contributors plus other fixes Signed-off-by: Luke Harrison <[email protected]> * ✨ index out of bounds check Signed-off-by: Luke Harrison <[email protected]> * ✨ fixed cog complexity linting error Signed-off-by: Luke Harrison <[email protected]> * ✨ updated e2e repo and rename file param Signed-off-by: Luke Harrison <[email protected]> * ✨ removed duplicate e2e test repo Signed-off-by: Luke Harrison <[email protected]> * ✨ removed export of github codeowner paths Signed-off-by: Luke Harrison <[email protected]> --------- Signed-off-by: Luke Harrison <[email protected]>
1 parent 417363b commit f08e8fb

File tree

7 files changed

+136
-25
lines changed

7 files changed

+136
-25
lines changed

‎checks/raw/contributors.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ func Contributors(cr *checker.CheckRequest) (checker.ContributorsData, error) {
3636
user := clients.User{
3737
Login: contrib.Login,
3838
NumContributions: contrib.NumContributions,
39+
IsCodeOwner: contrib.IsCodeOwner,
3940
}
4041

4142
for _, org := range contrib.Organizations {

‎clients/githubrepo/client.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,15 @@ func (client *Client) ListReleases() ([]clients.Release, error) {
223223

224224
// ListContributors implements RepoClient.ListContributors.
225225
func (client *Client) ListContributors() ([]clients.User, error) {
226-
return client.contributors.getContributors()
226+
var fileReader io.ReadCloser
227+
for _, path := range codeOwnerPaths {
228+
var err error
229+
fileReader, err = client.GetFileReader(path)
230+
if err == nil {
231+
break
232+
}
233+
}
234+
return client.contributors.getContributors(fileReader)
227235
}
228236

229237
// IsArchived implements RepoClient.IsArchived.

‎clients/githubrepo/contributors.go‎

Lines changed: 101 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,14 +17,26 @@ package githubrepo
1717
import (
1818
"context"
1919
"fmt"
20+
"io"
21+
"maps"
22+
"net/http"
2023
"strings"
2124
"sync"
2225

2326
"github.com/google/go-github/v53/github"
27+
"github.com/hmarr/codeowners"
2428

2529
"github.com/ossf/scorecard/v5/clients"
2630
)
2731

32+
// these are the paths where CODEOWNERS files can be found see
33+
// https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-file-location
34+
//
35+
//nolint:lll
36+
var (
37+
codeOwnerPaths []string = []string{"CODEOWNERS", ".github/CODEOWNERS", "docs/CODEOWNERS"}
38+
)
39+
2840
type contributorsHandler struct {
2941
ghClient *github.Client
3042
once *sync.Once
@@ -42,28 +54,26 @@ func (handler *contributorsHandler) init(ctx context.Context, repourl *Repo) {
4254
handler.contributors = nil
4355
}
4456

45-
func (handler *contributorsHandler) setup() error {
57+
func (handler *contributorsHandler) setup(codeOwnerFile io.ReadCloser) error {
58+
defer codeOwnerFile.Close()
4659
handler.once.Do(func() {
4760
if !strings.EqualFold(handler.repourl.commitSHA, clients.HeadSHA) {
4861
handler.errSetup = fmt.Errorf("%w: ListContributors only supported for HEAD queries", clients.ErrUnsupportedFeature)
4962
return
5063
}
51-
contribs, _, err := handler.ghClient.Repositories.ListContributors(
52-
handler.ctx, handler.repourl.owner, handler.repourl.repo, &github.ListContributorsOptions{})
53-
if err != nil {
54-
handler.errSetup = fmt.Errorf("error during ListContributors: %w", err)
64+
65+
contributors := make(map[string]clients.User)
66+
mapContributors(handler, contributors)
67+
if handler.errSetup != nil {
68+
return
69+
}
70+
mapCodeOwners(handler, codeOwnerFile, contributors)
71+
if handler.errSetup != nil {
5572
return
5673
}
5774

58-
for _, contrib := range contribs {
59-
if contrib.GetLogin() == "" {
60-
continue
61-
}
62-
contributor := clients.User{
63-
NumContributions: contrib.GetContributions(),
64-
Login: contrib.GetLogin(),
65-
}
66-
orgs, _, err := handler.ghClient.Organizations.List(handler.ctx, contrib.GetLogin(), nil)
75+
for contributor := range maps.Values(contributors) {
76+
orgs, _, err := handler.ghClient.Organizations.List(handler.ctx, contributor.Login, nil)
6777
// This call can fail due to token scopes. So ignore error.
6878
if err == nil {
6979
for _, org := range orgs {
@@ -72,20 +82,94 @@ func (handler *contributorsHandler) setup() error {
7282
})
7383
}
7484
}
75-
user, _, err := handler.ghClient.Users.Get(handler.ctx, contrib.GetLogin())
85+
user, _, err := handler.ghClient.Users.Get(handler.ctx, contributor.Login)
7686
if err != nil {
7787
handler.errSetup = fmt.Errorf("error during Users.Get: %w", err)
7888
}
7989
contributor.Companies = append(contributor.Companies, user.GetCompany())
8090
handler.contributors = append(handler.contributors, contributor)
8191
}
92+
8293
handler.errSetup = nil
8394
})
8495
return handler.errSetup
8596
}
8697

87-
func (handler *contributorsHandler) getContributors() ([]clients.User, error) {
88-
if err := handler.setup(); err != nil {
98+
func mapContributors(handler *contributorsHandler, contributors map[string]clients.User) {
99+
// getting contributors from the github API
100+
contribs, _, err := handler.ghClient.Repositories.ListContributors(
101+
handler.ctx, handler.repourl.owner, handler.repourl.repo, &github.ListContributorsOptions{})
102+
if err != nil {
103+
handler.errSetup = fmt.Errorf("error during ListContributors: %w", err)
104+
return
105+
}
106+
107+
// adding contributors to contributor map
108+
for _, contrib := range contribs {
109+
if contrib.GetLogin() == "" {
110+
continue
111+
}
112+
contributors[contrib.GetLogin()] = clients.User{
113+
Login: contrib.GetLogin(), NumContributions: contrib.GetContributions(),
114+
IsCodeOwner: false,
115+
}
116+
}
117+
}
118+
119+
func mapCodeOwners(handler *contributorsHandler, codeOwnerFile io.ReadCloser, contributors map[string]clients.User) {
120+
ruleset, err := codeowners.ParseFile(codeOwnerFile)
121+
if err != nil {
122+
handler.errSetup = fmt.Errorf("error during ParseFile: %w", err)
123+
return
124+
}
125+
126+
// expanding owners
127+
owners := make([]*clients.User, 0)
128+
for _, rule := range ruleset {
129+
for _, owner := range rule.Owners {
130+
switch owner.Type {
131+
case codeowners.UsernameOwner:
132+
// if usernameOwner just add to owners list
133+
owners = append(owners, &clients.User{Login: owner.Value, NumContributions: 0, IsCodeOwner: true})
134+
case codeowners.TeamOwner:
135+
// if teamOwner expand and add to owners list (only accessible by org members with read:org token scope)
136+
splitTeam := strings.Split(owner.Value, "/")
137+
if len(splitTeam) == 2 {
138+
users, response, err := handler.ghClient.Teams.ListTeamMembersBySlug(
139+
handler.ctx,
140+
splitTeam[0],
141+
splitTeam[1],
142+
&github.TeamListTeamMembersOptions{},
143+
)
144+
if err == nil && response.StatusCode == http.StatusOK {
145+
for _, user := range users {
146+
owners = append(owners, &clients.User{Login: user.GetLogin(), NumContributions: 0, IsCodeOwner: true})
147+
}
148+
}
149+
}
150+
}
151+
}
152+
}
153+
154+
// adding owners to contributor map and deduping
155+
for _, owner := range owners {
156+
if owner.Login == "" {
157+
continue
158+
}
159+
value, ok := contributors[owner.Login]
160+
if ok {
161+
// if contributor exists already set IsCodeOwner to true
162+
value.IsCodeOwner = true
163+
contributors[owner.Login] = value
164+
} else {
165+
// otherwise add new contributor
166+
contributors[owner.Login] = *owner
167+
}
168+
}
169+
}
170+
171+
func (handler *contributorsHandler) getContributors(codeOwnerFile io.ReadCloser) ([]clients.User, error) {
172+
if err := handler.setup(codeOwnerFile); err != nil {
89173
return nil, fmt.Errorf("error during contributorsHandler.setup: %w", err)
90174
}
91175
return handler.contributors, nil

‎clients/githubrepo/contributors_e2e_test.go‎

Lines changed: 21 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ package githubrepo
1616

1717
import (
1818
"context"
19+
"io"
1920
"net/http"
2021

2122
"github.com/google/go-github/v53/github"
@@ -24,11 +25,18 @@ import (
2425

2526
"github.com/ossf/scorecard/v5/clients"
2627
"github.com/ossf/scorecard/v5/clients/githubrepo/roundtripper"
28+
"github.com/ossf/scorecard/v5/internal/gitfile"
2729
"github.com/ossf/scorecard/v5/log"
2830
)
2931

3032
var _ = Describe("E2E TEST: githubrepo.contributorsHandler", func() {
3133
var contribHandler *contributorsHandler
34+
var fileHandler io.ReadCloser
35+
repoURL := Repo{
36+
owner: "ossf-tests",
37+
repo: "scorecard-check-contributors-e2e",
38+
commitSHA: clients.HeadSHA,
39+
}
3240

3341
BeforeEach(func() {
3442
ctx := context.Background()
@@ -41,18 +49,24 @@ var _ = Describe("E2E TEST: githubrepo.contributorsHandler", func() {
4149
ghClient: client,
4250
ctx: ctx,
4351
}
52+
//nolint:errcheck
53+
repo, _, _ := contribHandler.ghClient.Repositories.Get(contribHandler.ctx, repoURL.owner, repoURL.repo)
54+
gitFileHandler := gitfile.Handler{}
55+
gitFileHandler.Init(contribHandler.ctx, repo.GetCloneURL(), repoURL.commitSHA)
56+
// searching for CODEOWNERS file
57+
for _, path := range codeOwnerPaths {
58+
var err error
59+
fileHandler, err = gitFileHandler.GetFile(path)
60+
if err == nil {
61+
break
62+
}
63+
}
4464
})
4565
Context("getContributors()", func() {
4666
skipIfTokenIsNot(patTokenType, "PAT only")
4767
It("returns contributors for valid HEAD query", func() {
48-
repoURL := Repo{
49-
owner: "ossf",
50-
repo: "scorecard",
51-
commitSHA: clients.HeadSHA,
52-
}
53-
5468
contribHandler.init(context.Background(), &repoURL)
55-
Expect(contribHandler.getContributors()).ShouldNot(BeNil())
69+
Expect(contribHandler.getContributors(fileHandler)).ShouldNot(BeNil())
5670
Expect(contribHandler.errSetup).Should(BeNil())
5771
})
5872
})

‎clients/user.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ type User struct {
2222
NumContributions int
2323
ID int64
2424
IsBot bool
25+
IsCodeOwner bool
2526
}
2627

2728
// RepoAssociation is how a user is associated with a repository.

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ require (
4343
github.com/gobwas/glob v0.2.3
4444
github.com/google/go-github/v53 v53.2.0
4545
github.com/google/osv-scanner v1.9.2
46+
github.com/hmarr/codeowners v1.2.1
4647
github.com/in-toto/attestation v1.1.1
4748
github.com/mcuadros/go-jsonschema-generator v0.0.0-20200330054847-ba7a369d4303
4849
github.com/onsi/ginkgo/v2 v2.23.4

‎go.sum‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -505,6 +505,8 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
505505
github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
506506
github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
507507
github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
508+
github.com/hmarr/codeowners v1.2.1 h1:+9yndrwG0UVP1GkLBEQMSbSUNeLpbrbL924SRthA/9k=
509+
github.com/hmarr/codeowners v1.2.1/go.mod h1:KPlR1p/B4owPjwfNIBueWlOP4CmqlQFX9b6nANG6j40=
508510
github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
509511
github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
510512
github.com/ianlancetaylor/demangle v0.0.0-20240912202439-0a2b6291aafd h1:EVX1s+XNss9jkRW9K6XGJn2jL2lB1h5H804oKPsxOec=

0 commit comments

Comments
 (0)