Skip to content

Commit 0f5a2e7

Browse files
Merge branch 'microsoft:main' into main
2 parents 3632aa6 + 13f3e9f commit 0f5a2e7

22 files changed

+256
-94
lines changed

.github/workflows/build.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ jobs:
1717

1818
steps:
1919
- name: Checkout repository
20-
uses: actions/checkout@v3
20+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2121
with:
2222
fetch-depth: 0
2323

2424
- name: Setup .NET
25-
uses: actions/setup-dotnet@v3
25+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3
2626

2727
- name: Setup NuGet cache
28-
uses: actions/cache@v3
28+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
2929
with:
3030
path: ~/.nuget/packages
3131
key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props') }}

.github/workflows/codeql-analysis.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -21,17 +21,17 @@ jobs:
2121
security-events: write
2222

2323
steps:
24-
- uses: actions/checkout@v3
24+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2525
with:
2626
fetch-depth: 0
2727

2828
- name: Initialize CodeQL
29-
uses: github/codeql-action/[email protected].0
29+
uses: github/codeql-action/init@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
3030
with:
3131
languages: 'csharp'
3232

3333
- name: Autobuild
34-
uses: github/codeql-action/[email protected].0
34+
uses: github/codeql-action/autobuild@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
3535

3636
- name: Perform CodeQL Analysis
37-
uses: github/codeql-action/[email protected].0
37+
uses: github/codeql-action/analyze@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3

.github/workflows/detector-version-bump-reminder.yml

+4-1
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,15 @@ on:
33
push:
44
paths:
55
- 'src/Microsoft.ComponentDetection.Detectors/**'
6+
7+
permissions:
8+
pull-requests: write
69

710
jobs:
811
comment:
912
runs-on: ubuntu-latest
1013
steps:
11-
- uses: mshick/add-pr-comment@v2
14+
- uses: mshick/add-pr-comment@918f1387735fff58f77804b013a95a4887ec4d85 # v2
1215
with:
1316
repo-token: ${{ secrets.GITHUB_TOKEN }}
1417
message: |

.github/workflows/gen-docs.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,12 @@ jobs:
1616
contents: write # for stefanzweifel/git-auto-commit-action to push code in repo
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: actions/checkout@v3
19+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2020
with:
2121
fetch-depth: 0
2222

2323
- name: Setup .NET Core
24-
uses: actions/setup-dotnet@v3
24+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3
2525

2626
- name: Generate docs
2727
run: |
@@ -43,7 +43,7 @@ jobs:
4343
EOF
4444
4545
- name: Commit
46-
uses: stefanzweifel/git-auto-commit-action@v4
46+
uses: stefanzweifel/git-auto-commit-action@3ea6ae190baf489ba007f7c92608f33ce20ef04a # v4
4747
with:
4848
commit_message: 'Update docs'
4949
file_pattern: '*.md'

.github/workflows/ossf-scorecard.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,6 @@ jobs:
6767

6868
# Upload the results to GitHub's code scanning dashboard.
6969
- name: "Upload to code-scanning"
70-
uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
70+
uses: github/codeql-action/upload-sarif@29b1f65c5e92e24fe6b6647da1eaabe529cec70f # v2.3.3
7171
with:
7272
sarif_file: results.sarif

.github/workflows/release-drafter.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ jobs:
1616
pull-requests: read
1717
runs-on: ubuntu-latest
1818
steps:
19-
- uses: release-drafter/release-drafter@v5
19+
- uses: release-drafter/release-drafter@569eb7ee3a85817ab916c8f8ff03a5bd96c9c83e # v5
2020
with:
2121
disable-autolabeler: true
2222
env:

.github/workflows/release.yml

+3-3
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,12 @@ jobs:
2222

2323
steps:
2424
- name: Checkout repository
25-
uses: actions/checkout@v3
25+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2626
with:
2727
fetch-depth: 0
2828

2929
- name: Setup .NET
30-
uses: actions/setup-dotnet@v3
30+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3
3131

3232
- name: Restore packages
3333
run: dotnet restore
@@ -36,7 +36,7 @@ jobs:
3636
run: dotnet publish --configuration Release --output ./bin --self-contained --runtime ${{ matrix.rid }} -p:PublishSingleFile=true -p:IncludeAllContentForSelfExtract=true -p:DebugType=None -p:PublishTrimmed=false ./src/Microsoft.ComponentDetection
3737

3838
- name: Publish CLI tool
39-
uses: shogo82148/[email protected]
39+
uses: shogo82148/actions-upload-release-asset@b016af922a61601d647ff60226adadbe146b7651 # v1.6.4
4040
with:
4141
upload_url: ${{ github.event.release.upload_url }}
4242
asset_path: ./bin/*

.github/workflows/smoke-test.yml

+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: Smoke Tests
2+
3+
on:
4+
push:
5+
pull_request:
6+
schedule:
7+
- cron: "0 0 * * *" # every day at midnight
8+
9+
jobs:
10+
smoke-test:
11+
runs-on: ["self-hosted", "1ES.Pool=1ES-OSE-GH-Pool"]
12+
strategy:
13+
matrix:
14+
language:
15+
[
16+
{ name: "CocoaPods", repo: "realm/realm-swift" },
17+
{ name: "Gradle", repo: "microsoft/ApplicationInsights-Java" },
18+
{ name: "Go", repo: "kubernetes/kubernetes" },
19+
{ name: "Maven", repo: "apache/kafka" },
20+
{ name: "NPM", repo: "axios/axios" },
21+
{ name: "NuGet", repo: "Radarr/Radarr" },
22+
{ name: "Pip", repo: "django/django" },
23+
{ name: "Pnpm", repo: "pnpm/pnpm" },
24+
{ name: "Poetry", repo: "Textualize/rich" },
25+
{ name: "Ruby", repo: "rails/rails" },
26+
{ name: "Rust", repo: "alacritty/alacritty" },
27+
{ name: "Yarn", repo: "gatsbyjs/gatsby" },
28+
]
29+
fail-fast: false
30+
name: ${{ matrix.language.name }}
31+
steps:
32+
- name: Checkout Component Detection
33+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
34+
35+
- name: Setup .NET
36+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3.0.3
37+
38+
- name: Setup NuGet cache
39+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
40+
with:
41+
path: ~/.nuget/packages
42+
key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props') }}
43+
restore-keys: ${{ runner.os }}-nuget-
44+
45+
- name: Install Apache Ivy
46+
run: curl https://downloads.apache.org/ant/ivy/2.5.1/apache-ivy-2.5.1-bin.tar.gz | tar xOz apache-ivy-2.5.1/ivy-2.5.1.jar > /usr/share/ant/lib/ivy.jar
47+
48+
- name: Checkout Smoke Test Repo
49+
uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
50+
with:
51+
repository: ${{ matrix.language.repo }}
52+
path: smoke-test-repo
53+
54+
- name: Restore Smoke Test NuGet Packages
55+
if: ${{ matrix.language.name == 'NuGet'}}
56+
working-directory: smoke-test-repo/src
57+
run: dotnet restore
58+
59+
- name: Run Smoke Test
60+
working-directory: src/Microsoft.ComponentDetection
61+
run: |
62+
for i in $(seq 1 10); do
63+
dotnet run -c Release -- scan --SourceDirectory ${{ github.workspace }}/smoke-test-repo --Verbosity Verbose || exit 1
64+
done
65+
66+
create-issue:
67+
runs-on: ubuntu-latest
68+
needs: smoke-test
69+
name: Create Issue
70+
if: always() && github.event_name == 'schedule' && needs.smoke-test.result == 'failure'
71+
permissions:
72+
issues: write
73+
steps:
74+
- name: Create GitHub Issue
75+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
76+
with:
77+
script: |
78+
const failed_tests = [];
79+
const jobs = await github.rest.actions.listJobsForWorkflowRun({
80+
owner: context.repo.owner,
81+
repo: context.repo.repo,
82+
run_id: context.runId,
83+
});
84+
for (const job of jobs.data.jobs) {
85+
if (job.status === 'completed' && job.conclusion === 'failure') {
86+
failed_tests.push('* ' + job.name);
87+
}
88+
}
89+
const issue_body = `# :x: Smoke Test Failure\nThe following smoke tests failed:\n\n${failed_tests.join('\n')}\n\n[View Run](${context.payload.repository.html_url}/actions/runs/${context.runId})\n\ncc: @microsoft/ose-component-detection-maintainers`;
90+
await github.rest.issues.create({
91+
owner: context.repo.owner,
92+
repo: context.repo.repo,
93+
title: 'Smoke Test Failure',
94+
body: issue_body,
95+
labels: ['bug']
96+
})

.github/workflows/snapshot-publish.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ jobs:
1818
os: [ubuntu-latest, windows-latest, macos-latest]
1919

2020
steps:
21-
- uses: actions/checkout@v3
21+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2222

2323
- name: Setup .NET Core
24-
uses: actions/setup-dotnet@v3
24+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3
2525

2626
- name: Setup NuGet cache
27-
uses: actions/cache@v3
27+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
2828
with:
2929
path: ~/.nuget/packages
3030
key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props') }}
@@ -55,7 +55,7 @@ jobs:
5555
--DetectorArgs DockerReference=EnableIfDefaultOff,SPDX22SBOM=EnableIfDefaultOff
5656

5757
- name: Upload output folder
58-
uses: actions/upload-artifact@v3
58+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3
5959
with:
6060
name: release-snapshot-output-${{ matrix.os }}
6161
path: ${{ github.workspace }}/output

.github/workflows/snapshot-verify.yml

+5-5
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ jobs:
1414
os: [ubuntu-latest, windows-latest, macos-latest]
1515

1616
steps:
17-
- uses: actions/checkout@v3
17+
- uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
1818

1919
- name: Make release snapshot output directory
2020
run: mkdir ${{ github.workspace }}/release-output
2121

2222
- name: Get latest release snapshot download url
2323
id: download-latest-release-snapshot
24-
uses: actions/github-script@v6
24+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
2525
with:
2626
result-encoding: string
2727
script: |
@@ -47,10 +47,10 @@ jobs:
4747
rm output.zip
4848
4949
- name: Setup .NET Core
50-
uses: actions/setup-dotnet@v3
50+
uses: actions/setup-dotnet@607fce577a46308457984d59e4954e075820f10a # v3
5151

5252
- name: Setup NuGet cache
53-
uses: actions/cache@v3
53+
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3
5454
with:
5555
path: ~/.nuget/packages
5656
key: ${{ runner.os }}-nuget-${{ hashFiles('**/*.csproj', '**/*.props') }}
@@ -98,7 +98,7 @@ jobs:
9898
ALLOWED_TIME_DRIFT_RATIO: ".75"
9999

100100
- name: Upload logs
101-
uses: actions/[email protected]
101+
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
102102
if: ${{ !cancelled() }}
103103
with:
104104
name: verify-snapshot-output-${{ matrix.os }}

Directory.Packages.props

+3-2
Original file line numberDiff line numberDiff line change
@@ -31,15 +31,16 @@
3131
<PackageVersion Include="Polly" Version="7.2.3" />
3232
<PackageVersion Include="SemanticVersioning" Version="2.0.2" />
3333
<PackageVersion Include="Serilog" Version="2.12.0" />
34-
<PackageVersion Include="Serilog.Extensions.Hosting" Version="5.0.1" />
35-
<PackageVersion Include="Serilog.Extensions.Logging" Version="3.1.0" />
34+
<PackageVersion Include="Serilog.Extensions.Hosting" Version="7.0.0" />
35+
<PackageVersion Include="Serilog.Extensions.Logging" Version="7.0.0" />
3636
<PackageVersion Include="Serilog.Sinks.Async" Version="1.5.0" />
3737
<PackageVersion Include="Serilog.Sinks.Console" Version="4.1.0" />
3838
<PackageVersion Include="Serilog.Sinks.File" Version="5.0.0" />
3939
<PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.435" />
4040
<PackageVersion Include="System.Memory" Version="4.5.5" />
4141
<PackageVersion Include="System.Reactive" Version="5.0.0" />
4242
<PackageVersion Include="System.Runtime.Loader" Version="4.3.0" />
43+
<PackageVersion Include="System.Text.Json" Version="6.0.7" />
4344
<PackageVersion Include="System.Threading.Tasks.Dataflow" Version="7.0.0" />
4445
<PackageVersion Include="Tomlyn.Signed" Version="0.16.2" />
4546
<PackageVersion Include="yamldotnet" Version="13.1.0" />

docs/environment-variables.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ Otherwise, the Go detector uses go-cli command: `go list -m all` to discover Go
1010
## `PyPiMaxCacheEntries`
1111

1212
The environment variable `PyPiMaxCacheEntries` is used to control the size of the in-memory LRU cache that caches responses from PyPi.
13-
The default value is 128.
13+
The default value is 4096.
1414

1515
[1]: https://go.dev/ref/mod#go-mod-graph

renovate.json

+5-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
11
{
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3-
"extends": ["config:base"]
4-
}
3+
"extends": [
4+
"config:base",
5+
"helpers:pinGitHubActionDigests"
6+
]
7+
}

src/Microsoft.ComponentDetection.Common/DockerService.cs

+8-8
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ namespace Microsoft.ComponentDetection.Common;
44
using System.Collections.Generic;
55
using System.IO;
66
using System.Linq;
7+
using System.Text.Json;
78
using System.Threading;
89
using System.Threading.Tasks;
910
using Docker.DotNet;
@@ -12,7 +13,6 @@ namespace Microsoft.ComponentDetection.Common;
1213
using Microsoft.ComponentDetection.Contracts;
1314
using Microsoft.ComponentDetection.Contracts.BcdeModels;
1415
using Microsoft.Extensions.Logging;
15-
using Newtonsoft.Json;
1616

1717
public class DockerService : IDockerService
1818
{
@@ -52,7 +52,7 @@ public async Task<bool> CanRunLinuxContainersAsync(CancellationToken cancellatio
5252
try
5353
{
5454
var systemInfoResponse = await Client.System.GetSystemInfoAsync(cancellationToken);
55-
record.SystemInfo = JsonConvert.SerializeObject(systemInfoResponse);
55+
record.SystemInfo = JsonSerializer.Serialize(systemInfoResponse);
5656
return string.Equals(systemInfoResponse.OSType, "linux", StringComparison.OrdinalIgnoreCase);
5757
}
5858
catch (Exception e)
@@ -72,7 +72,7 @@ public async Task<bool> ImageExistsLocallyAsync(string image, CancellationToken
7272
try
7373
{
7474
var imageInspectResponse = await Client.Images.InspectImageAsync(image, cancellationToken);
75-
record.ImageInspectResponse = JsonConvert.SerializeObject(imageInspectResponse);
75+
record.ImageInspectResponse = JsonSerializer.Serialize(imageInspectResponse);
7676
return true;
7777
}
7878
catch (Exception e)
@@ -97,10 +97,10 @@ public async Task<bool> TryPullImageAsync(string image, CancellationToken cancel
9797
var createImageProgress = new List<string>();
9898
var progress = new Progress<JSONMessage>(message =>
9999
{
100-
createImageProgress.Add(JsonConvert.SerializeObject(message));
100+
createImageProgress.Add(JsonSerializer.Serialize(message));
101101
});
102102
await Client.Images.CreateImageAsync(parameters, null, progress, cancellationToken);
103-
record.CreateImageProgress = JsonConvert.SerializeObject(createImageProgress);
103+
record.CreateImageProgress = JsonSerializer.Serialize(createImageProgress);
104104
return true;
105105
}
106106
catch (Exception e)
@@ -119,7 +119,7 @@ public async Task<ContainerDetails> InspectImageAsync(string image, Cancellation
119119
try
120120
{
121121
var imageInspectResponse = await Client.Images.InspectImageAsync(image, cancellationToken);
122-
record.ImageInspectResponse = JsonConvert.SerializeObject(imageInspectResponse);
122+
record.ImageInspectResponse = JsonSerializer.Serialize(imageInspectResponse);
123123

124124
var baseImageRef = string.Empty;
125125
var baseImageDigest = string.Empty;
@@ -162,11 +162,11 @@ public async Task<ContainerDetails> InspectImageAsync(string image, Cancellation
162162
using var record = new DockerServiceTelemetryRecord
163163
{
164164
Image = image,
165-
Command = JsonConvert.SerializeObject(command),
165+
Command = JsonSerializer.Serialize(command),
166166
};
167167
await this.TryPullImageAsync(image, cancellationToken);
168168
var container = await CreateContainerAsync(image, command, cancellationToken);
169-
record.Container = JsonConvert.SerializeObject(container);
169+
record.Container = JsonSerializer.Serialize(container);
170170
var stream = await AttachContainerAsync(container.ID, cancellationToken);
171171
await StartContainerAsync(container.ID, cancellationToken);
172172
var (stdout, stderr) = await stream.ReadOutputToEndAsync(cancellationToken);

0 commit comments

Comments
 (0)