[Bug] - The action_version attribute of Setup Language classes are not initialized
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 210
- Forks
- 36
- Avg merge
- 1d 10h
- Merged PRs (30d)
- 2
Description
Description
The class instances of type SetupJava, OracleSetupJava and GraalVMSetup do not have the attribute action_version. This is unexpected because action_version is inherited from the base class ThirdPartyAction
Steps to Reproduce
Running on commit https://github.com/oracle/macaron/commit/e42408ad20ae32d9646c5c4fce25392a16a2287b
- Set a break point at before this line https://github.com/oracle/macaron/blob/32aa0ccf0f552df3e90563653415bd38a3feac6a/src/macaron/slsa_analyzer/ci_service/github_actions/analyzer.py#L275
For example
def find_language_setup_action(job_node: GitHubJobNode, lang_name: BuildLanguage) -> Language | None:
"""Find the step that calls a language setup GitHub Actions and return the model.
Parameters
----------
job_node: GitHubJobNode
The target GitHub Actions job node.
lang_name: BuildLanguage
The target language used in the build.
Returns
-------
Language | None
The language model for the language setup GitHub Action or None.
"""
for callee in job_node.callee:
model = callee.model
# Check if the model implements the Language protocol.
if isinstance(model, Language):
import pdb; pdb.set_trace()
if model.lang_name == lang_name:
return model
return None
- Run this command
macaron analyze -purl pkg:maven/org.apache.hugegraph/computer-k8s@1.0.0
You will be taken into pdb
> ...//macaron/src/macaron/slsa_analyzer/ci_service/github_actions/analyzer.py(276)find_language_setup_action()
-> if model.lang_name == lang_name:
(Pdb) type(model)
<class 'macaron.slsa_analyzer.ci_service.github_actions.analyzer.SetupJava'>
(Pdb) pp(model)
*** AttributeError: 'SetupJava' object has no attribute 'action_version'
(Pdb) "action_version" in dir(SetupJava)
False
Initial investigation
This happened because of the following factors:
SetupJavainherits fromThirdPartyAction, which is a frozen dataclass. https://github.com/oracle/macaron/blob/32aa0ccf0f552df3e90563653415bd38a3feac6a/src/macaron/slsa_analyzer/ci_service/github_actions/analyzer.py#L37-L45SetupJavadoesn't set theaction_versionclass attribute, instead it just annotate this attribute asNonehttps://github.com/oracle/macaron/blob/32aa0ccf0f552df3e90563653415bd38a3feac6a/src/macaron/slsa_analyzer/ci_service/github_actions/analyzer.py#L501SetupJavadefines it owns constructor, which overrides the dataclass constructors generated forThirdPartyAction.SetupJavaconstructor doesn't initializeaction_version, hence it will never exist in any class instance.- This happens for
OracleSetupJavaandGraalVMSetupwith the same reason.
Environment Information
To assist with troubleshooting, please provide the following information about your environment:
Operating System: Ubuntu 22.04
CPU architecture information: x84-64
Bash Version: version 5.1.16(1)-release
Running Macaron as a Python package.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in src/macaron/slsa_analyzer/ci_service/github_actions/analyzer.py, focusing on ThirdPartyAction, SetupJava, OracleSetupJava, and GraalVMSetup and their constructors. Reproduce the issue with the provided macaron analyze command and inspect the model in pdb. Done means each affected instance exposes action_version without raising AttributeError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100