From bcb46eb4fccefe60e7b094c9ba53bbe1b1805b5c Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:29:53 +1300 Subject: [PATCH 1/9] ci: run `osv-linter` --- .github/workflows/ci.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7c64af9..661f3c22 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,6 +36,23 @@ jobs: persist-credentials: false - run: docker run -v $PWD:/src ghcr.io/google/osv-scanner:latest scan -r src + lint: + permissions: + contents: read # to fetch code (actions/checkout) + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - name: Set up Go + uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + with: + go-version: stable + check-latest: true + - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema + - run: go install ./cmd/osv + working-directory: /tmp/osv-schema/tools/osv-linter + + - run: osv-linter + ruff: permissions: contents: read # to fetch code (actions/checkout) From 7a4f266218e2ae69d378a0c232ed886baff893ac Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:43:22 +1300 Subject: [PATCH 2/9] ci: cache go dependencies --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 661f3c22..6657db4f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,12 +42,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: + - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: + cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema - run: go install ./cmd/osv working-directory: /tmp/osv-schema/tools/osv-linter From e1a25de323752c9d244276ce35b976aa8c86dfa3 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:45:04 +1300 Subject: [PATCH 3/9] ci: rework --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6657db4f..e5284ce0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,10 +49,9 @@ jobs: cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - - run: go install ./cmd/osv + - run: go build -o osv-linter ./cmd/osv working-directory: /tmp/osv-schema/tools/osv-linter - - - run: osv-linter + - run: /tmp/osv-schema/tools/osv-linter/osv-linter ruff: permissions: From c9c7c6118051c941db35eca7417d68a2a59b284e Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:49:49 +1300 Subject: [PATCH 4/9] ci: be within workspace --- .github/workflows/ci.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e5284ce0..8517d1b0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,16 +42,17 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema + - run: git clone https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: - cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' + cache-dependency-path: 'osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - run: go build -o osv-linter ./cmd/osv - working-directory: /tmp/osv-schema/tools/osv-linter - - run: /tmp/osv-schema/tools/osv-linter/osv-linter + working-directory: osv-schema/tools/osv-linter + + - run: osv-schema/tools/osv-linter/osv-linter ruff: permissions: From 1c90e93051d609793f87be35f85e672ee9739a37 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:50:07 +1300 Subject: [PATCH 5/9] ci: clone the repository --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8517d1b0..de359dec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,6 +54,11 @@ jobs: - run: osv-schema/tools/osv-linter/osv-linter + - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + with: + persist-credentials: false + - run: ls -aoh + ruff: permissions: contents: read # to fetch code (actions/checkout) From a5f25820e107340659e9293d57c1cf9d26ed9262 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:55:46 +1300 Subject: [PATCH 6/9] ci: checkout repo within existing workspace --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de359dec..66d439ce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,6 +56,7 @@ jobs: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: + path: drupal-advisory-database persist-credentials: false - run: ls -aoh From a4b50ff96ab7194854c5f03b586ffc3a208488fd Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:56:34 +1300 Subject: [PATCH 7/9] ci: run the linter --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 66d439ce..5dbef79f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,7 +58,9 @@ jobs: with: path: drupal-advisory-database persist-credentials: false - - run: ls -aoh + - run: | + osv-schema/tools/osv-linter/osv-linter record lint --parallel 2 \ + drupal-advisory-database/advisories/ ruff: permissions: From 40061f5c364e92af272a15b6fab35b8e7224ee36 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 09:08:28 +1300 Subject: [PATCH 8/9] ci: add some comments --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5dbef79f..38cf8249 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,6 +42,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: + # build the osv-linter from source - run: git clone https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 @@ -54,6 +55,7 @@ jobs: - run: osv-schema/tools/osv-linter/osv-linter + # run the linter against our advisories - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: path: drupal-advisory-database From c3d2758369ca4f45f1e6ea7214ce53d341c52678 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 10:12:25 +1300 Subject: [PATCH 9/9] ci: only clone the first commit --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38cf8249..799e4618 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,7 +43,7 @@ jobs: timeout-minutes: 15 steps: # build the osv-linter from source - - run: git clone https://github.com/ossf/osv-schema + - run: git clone --depth 1 https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: