Merge pull request #30 from atomist-skills/lift-from-goal-eval

lift common policy code from goal-eval

Taskfile.yaml

@@ -20,7 +20,7 @@ vars:
 tasks:
   go:test:
     cmds:
-      - go test -v
+      - go test -v ./... --count=1
 
   go:build:
     cmds:

go.mod

@@ -4,34 +4,41 @@ go 1.19
 
 require (
 	cloud.google.com/go/logging v1.8.1
+	cloud.google.com/go/storage v1.31.0
 	github.com/google/uuid v1.3.1
+	github.com/hasura/go-graphql-client v0.9.3
+	github.com/mitchellh/hashstructure/v2 v2.0.1
 	github.com/sirupsen/logrus v1.9.0
 	golang.org/x/oauth2 v0.13.0
+	google.golang.org/api v0.147.0
 	olympos.io/encoding/edn v0.0.0-20201019073823-d3554ca0b0a3
 )
 
 require (
 	cloud.google.com/go v0.110.8 // indirect
 	cloud.google.com/go/compute v1.23.0 // indirect
 	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/iam v1.1.2 // indirect
 	cloud.google.com/go/longrunning v0.5.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.3 // indirect
 	github.com/google/go-cmp v0.5.9 // indirect
 	github.com/google/s2a-go v0.1.7 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.1 // indirect
 	github.com/googleapis/gax-go/v2 v2.12.0 // indirect
+	github.com/klauspost/compress v1.10.3 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	golang.org/x/crypto v0.14.0 // indirect
 	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/sync v0.4.0 // indirect
 	golang.org/x/sys v0.13.0 // indirect
 	golang.org/x/text v0.13.0 // indirect
-	google.golang.org/api v0.147.0 // indirect
+	golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20231002182017-d307bd883b97 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20231002182017-d307bd883b97 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20231009173412-8bfb1ae86b6c // indirect
 	google.golang.org/grpc v1.58.2 // indirect
 	google.golang.org/protobuf v1.31.0 // indirect
+	nhooyr.io/websocket v1.8.7 // indirect
 )

internal/test_util/logger.go

@@ -0,0 +1,16 @@
+package test_util
+
+import "github.com/atomist-skills/go-skill"
+
+func CreateEmptyLogger() skill.Logger {
+	return skill.Logger{
+		Debug:  func(msg string) {},
+		Debugf: func(format string, a ...any) {},
+		Info:   func(msg string) {},
+		Infof:  func(format string, a ...any) {},
+		Warn:   func(msg string) {},
+		Warnf:  func(format string, a ...any) {},
+		Error:  func(msg string) {},
+		Errorf: func(format string, a ...any) {},
+	}
+}

internal/test_util/pointer.go

@@ -0,0 +1,7 @@
+package test_util
+
+// Pointer is useful for making pointers of literals in test cases
+// e.g. Pointer(3) or Pointer("string")
+func Pointer[T any](some T) *T {
+	return &some
+}

policy/evaluators/data/convert.go

@@ -0,0 +1,152 @@
+package data
+
+import (
+	"time"
+
+	"github.com/atomist-skills/go-skill/policy/graphql"
+)
+
+func getPurlsFromPackages(packages []MetadataPackage) []string {
+	purls := []string{}
+	for _, pkg := range packages {
+		purls = append(purls, pkg.Purl)
+	}
+	return purls
+}
+
+func getPackagesByPurl(packages []graphql.VulnerabilitiesByPackage) map[string]graphql.VulnerabilitiesByPackage {
+	result := map[string]graphql.VulnerabilitiesByPackage{}
+	for _, pkg := range packages {
+		result[pkg.Purl] = pkg
+	}
+
+	return result
+}
+
+func convertGraphqlToPackages(imagePackages graphql.ImagePackagesByDigest) ([]Package, error) {
+	nonEmptyHistories := []graphql.ImageHistory{}
+	for _, history := range imagePackages.ImageHistories {
+		if !history.EmptyLayer {
+			nonEmptyHistories = append(nonEmptyHistories, history)
+		}
+	}
+
+	pkgs := []Package{}
+	for _, p := range imagePackages.ImagePackages.Packages {
+		locations := []PackageLocation{}
+		for _, location := range p.PackageLocations {
+			layerOrdinal := -1
+			for _, layer := range imagePackages.ImageLayers.Layers {
+				if location.DiffId == layer.DiffId {
+					layerOrdinal = layer.Ordinal
+					break
+				}
+			}
+
+			historyOrdinal := -1
+			if len(nonEmptyHistories) > 0 && layerOrdinal > -1 {
+				historyOrdinal = nonEmptyHistories[layerOrdinal].Ordinal
+			}
+
+			locations = append(locations, PackageLocation{
+				LayerOrdinal: historyOrdinal,
+				Path:         location.Path,
+			})
+		}
+
+		var namespace string
+		if p.Package.Namespace == nil {
+			namespace = ""
+		} else {
+			namespace = *p.Package.Namespace
+		}
+
+		vulnerabilities, err := convertToVulnerabilities(p.Package.Vulnerabilities)
+		if err != nil {
+			return nil, err
+		}
+
+		pkgs = append(pkgs, Package{
+			Purl:            p.Package.Purl,
+			Licenses:        p.Package.Licenses,
+			Name:            p.Package.Name,
+			Namespace:       namespace,
+			Version:         p.Package.Version,
+			Type:            p.Package.Type,
+			Locations:       locations,
+			Vulnerabilities: vulnerabilities,
+		})
+	}
+
+	return pkgs, nil
+}
+
+func convertMetadataPackagesToPackages(metadataPackages []MetadataPackage, vulnerabilitiesByPackage []graphql.VulnerabilitiesByPackage) ([]Package, error) {
+	pkgsByPurl := getPackagesByPurl(vulnerabilitiesByPackage)
+
+	packages := []Package{}
+	for _, mPkg := range metadataPackages {
+		pkg := pkgsByPurl[mPkg.Purl]
+		vulnerabilities, err := convertToVulnerabilities(pkg.Vulnerabilities)
+		if err != nil {
+			return nil, err
+		}
+
+		packages = append(packages, Package{
+			Licenses:        mPkg.Licenses,
+			Name:            mPkg.Name,
+			Namespace:       mPkg.Namespace,
+			Version:         mPkg.Version,
+			Purl:            mPkg.Purl,
+			Type:            mPkg.Type,
+			Vulnerabilities: vulnerabilities,
+		})
+	}
+
+	return packages, nil
+}
+
+func convertToVulnerabilities(vulnerabilities []graphql.Vulnerability) ([]Vulnerability, error) {
+	result := []Vulnerability{}
+
+	for _, vulnerability := range vulnerabilities {
+		publishedAt, err := time.Parse(time.RFC3339, vulnerability.PublishedAt)
+		if err != nil {
+			return nil, err
+		}
+
+		updatedAt, err := time.Parse(time.RFC3339, vulnerability.UpdatedAt)
+		if err != nil {
+			return nil, err
+		}
+
+		vulnerabilityResult := Vulnerability{
+			Cvss:            Cvss{},
+			PublishedAt:     publishedAt,
+			Source:          vulnerability.Source,
+			SourceID:        vulnerability.SourceID,
+			UpdatedAt:       updatedAt,
+			VulnerableRange: vulnerability.VulnerableRange,
+		}
+
+		if vulnerability.Cvss.Score != nil {
+			vulnerabilityResult.Cvss.Score = *vulnerability.Cvss.Score
+		}
+
+		if vulnerability.Cvss.Severity != nil {
+			vulnerabilityResult.Cvss.Severity = *vulnerability.Cvss.Severity
+		}
+
+		if vulnerability.URL != nil {
+			vulnerabilityResult.URL = *vulnerability.URL
+		}
+
+		if vulnerability.FixedBy != nil {
+			vulnerabilityResult.FixedBy = *vulnerability.FixedBy
+		}
+
+		result = append(result, vulnerabilityResult)
+	}
+
+	return result, nil
+}

policy/evaluators/data/fixed.go

@@ -0,0 +1,28 @@
+package data
+
+import (
+	"context"
+
+	"github.com/atomist-skills/go-skill/policy/graphql"
+	"github.com/atomist-skills/go-skill/policy/query"
+)
+
+// FixedDataSource is only used for tests
+type FixedDataSource struct {
+	Packages             map[string][]Package
+	ImageDetailsByDigest *graphql.ImageDetailsByDigest
+}
+
+func (s FixedDataSource) GetPackages(ctx context.Context, digest string) (*GetPackagesResult, error) {
+	return &GetPackagesResult{
+		AsyncQueryMade: false,
+		Result:         s.Packages[digest],
+	}, nil
+}
+
+func (s FixedDataSource) GetImageDetailsByDigest(ctx context.Context, digest string, platform query.ImagePlatform) (*GetImageDetailsByDigestResult, error) {
+	return &GetImageDetailsByDigestResult{
+		AsyncQueryMade: false,
+		Result:         s.ImageDetailsByDigest,
+	}, nil
+}