ossf / ossf/allstar

Issue with Allstar Branch Protection Enforcement (404 errors upon action: fix)

Open
#562 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
1.5k
Forks
152
Avg merge
1d 2h
Merged PRs (30d)
6

Description

Hello,

Over the past couple of months, I've noticed a recurring issue where Allstar returns 404 error messages when attempting to enforce branch protection, as shown in the logs below, causing the application to crash. The issue is still there with Allstar latest version (4.2)

allstar {"severity":"INFO","org":"Org","repo":"test0","area":"bot","enabled":true,"time":"2024-08-20T08:29:17Z","message":"Check repo enabled"}                                                                                                  
allstar {"severity":"INFO","org":"Org","repo":"test0","area":"Binary Artifacts","enabled":false,"time":"2024-08-20T08:29:17Z","message":"Check repo enabled"}                                                                                    
allstar {"severity":"INFO","org":"Org","repo":"test0","area":"Binary Artifacts","result":true,"enabled":false,"notify":"","details":{"Artifacts":null},"time":"2024-08-20T08:29:17Z","message":"Policy run result."}                             
allstar {"severity":"INFO","org":"Org","repo":"test0","area":"Branch Protection","enabled":true,"time":"2024-08-20T08:29:17Z","message":"Check repo enabled"}                                                                                    
allstar {"severity":"INFO","org":"Org","repo":"test0","area":"Branch Protection","result":false,"enabled":true,"notify":"No protection found for branch master\n","details":{"master":{"PRReviews":false,"NumReviews":0,"DismissStale":false,"Bl 
allstar {"severity":"ERROR","error":"PUT [https://api.github.com/repos/Org/test0/branches/master/protection](https://api.github.com/repos/Org/test0/branches/master/protection): 404 Branch protection has been disabled on this repository. []","time":"2024-08-20T08:29:18Z","message":"Unexpected error running policies."}
allstar {"severity":"INFO","area":"bot","count":7,"results":{"CODEOWNERS":{"totalFailed":1},"OpenSSF Scorecard":{"totalFailed":1},"Repository Administrators":{"totalFailed":1}},"time":"2024-08-20T08:29:18Z","message":"EnforceAll complete."}           

After investigating, I found that this issue occurs when branch protection rules are disabled on a repository. I also noticed in the GitHub API documentation that while there is an API to update branch protection, there doesn’t seem to be one to set it initially. Could this be a new limitation from GitHub?

Screenshot 2024-08-20 at 10 34 55

Currently, I’ve implemented a custom alerting system to manually re-enable branch protection rules when Allstar fails, but this is not an ideal solution. Is there a better workaround that you would recommend?

For reference, here are the current permissions for my Allstar GitHub App.

Screenshot 2024-08-20 at 10 33 39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the branch protection enforcement path and the GitHub API request shown in the logs: PUT /repos/{owner}/{repo}/branches/{branch}/protection. Reproduce the case with branch protection disabled, then trace how the 404 response is handled. Done means the failure behavior and any supported workaround are established without the application crashing.

Written by the indexing model from the issue text.

Assessment

Tech stack
github, go
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.