Include purl info in the event #5092
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/it |
1 similar comment
|
/it |
Googlom
reviewed
Oct 1, 2024
cmd/mavenBuild.go
Outdated
Comment on lines
212
to
237
| func getPurlForThePomAndDeleteIndividualBom(pomFilePath string) string { | ||
| bomPath := filepath.Join(filepath.Dir(pomFilePath) + "/target/" + mvnBomFilename + ".xml") | ||
| if exists, _ := piperutils.FileExists(bomPath); exists { | ||
| bom, err := piperutils.GetBom(bomPath) | ||
| if err != nil { | ||
| log.Entry().Warnf("failed to get bom file %s: %v", bomPath, err) | ||
| return "" | ||
| } | ||
|
|
||
| log.Entry().Debugf("Found purl: %s for the bomPath: %s", bom.Metadata.Component.Purl, bomPath) | ||
| purl := bom.Metadata.Component.Purl | ||
|
|
||
| // Check if the BOM is an aggregated BOM | ||
| if !isAggregatedBOM(bom) { | ||
| // Delete the individual BOM file | ||
| err = os.Remove(bomPath) | ||
| if err != nil { | ||
| log.Entry().Warnf("failed to delete bom file %s: %v", bomPath, err) | ||
| } | ||
| } | ||
|
|
||
| return purl | ||
| } | ||
| log.Entry().Debugf("bom file doesn't exist and hence no pURL info: %v", bomPath) | ||
| return "" | ||
| } |
There was a problem hiding this comment.
This code could be rewritten in a more 'Go way'.
func getPurlForThePomAndDeleteIndividualBom(pomFilePath string) string {
bomPath := filepath.Join(filepath.Dir(pomFilePath), "target", mvnBomFilename+".xml")
exists, _ := piperutils.FileExists(bomPath)
if !exists {
log.Entry().Debugf("bom file doesn't exist and hence no pURL info: %v", bomPath)
return ""
}
bom, err := piperutils.GetBom(bomPath)
if err != nil {
log.Entry().Warnf("failed to get bom file %s: %v", bomPath, err)
return ""
}
log.Entry().Debugf("Found purl: %s for the bomPath: %s", bom.Metadata.Component.Purl, bomPath)
purl := bom.Metadata.Component.Purl
if !isAggregatedBOM(bom) {
if err := os.Remove(bomPath); err != nil {
log.Entry().Warnf("failed to delete bom file %s: %v", bomPath, err)
}
}
return purl
} This will reduce cognitive load by getting rid of nested if-else statements
pkg/npm/publish.go
Outdated
| @@ -225,6 +226,20 @@ func (exec *Execute) publish(packageJSON, registry, username, password string, p | |||
| return nil | |||
| } | |||
|
|
|||
| func getPurl(packageJSON string) string { | |||
| expectedBomFilePath := filepath.Join(filepath.Dir(packageJSON) + "/" + npmBomFilename) | |||
| if exists, _ := CredentialUtils.FileExists(expectedBomFilePath); exists { | |||
pkg/piperutils/cyclonedxBom.go
Outdated
| return Bom{}, err | ||
| } | ||
| defer xmlFile.Close() | ||
| byteValue, _ := io.ReadAll(xmlFile) |
There was a problem hiding this comment.
ignoring errors is not recommended
|
@Googlom I have addressed your comments, please have a look again. Could you please also trigger it test run. Thanks |
|
|
/it-go |
Googlom
approved these changes
Oct 2, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes
As part of build coordinates purl information is added by reading the cyclonedx BOM.