ossf / ossf/package-analysis

Make a CI action to run each supported kind of analysis

Open
#637 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement infrastructure
Dominant language
Go
Stars
912
Forks
74
PR merge metrics
No merged PRs in 30d

Description

We can use scripts/run_analysis.sh to run CI for each supported kind of analysis on push. However, the trick is to be able to use a locally built image. This might take a long time to build and run on each push / PR. Possibly we should replace the current 'build_docker' action with a 'build and run analysis' action

Things that need to be run: (fixed packages can be chosen for each)

  1. dynamic analysis: pypi
  2. dynamic analysis: npm
  3. dynamic analysis: ruby
  4. dynamic analysis: crates.io
  5. dynamic analysis: packagist
  6. static analysis: npm

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with scripts/run_analysis.sh and the current build_docker action to understand how analyses and locally built images are invoked. Define how the CI action should run the six listed analysis cases on push, including fixed packages for each, and verify that each case completes using the locally built image.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions, shell
Domain
build-system, ci-cd, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.