60 Commits

Author SHA1 Message Date
dependabot[bot]
7fa82ac844 Bump actions/setup-python from 4.2.0 to 4.3.0 (flutter/engine#36794) 2022-10-17 09:44:31 +00:00
dependabot[bot]
ee7c458779 Bump github/codeql-action from 2.1.26 to 2.1.27 (flutter/engine#36684) 2022-10-10 09:28:22 +00:00
dependabot[bot]
6abd0639a1 Bump actions/checkout from 3.0.2 to 3.1.0 (flutter/engine#36683) 2022-10-10 09:24:22 +00:00
dependabot[bot]
857c56454f Bump github/codeql-action from 2.1.25 to 2.1.26 (flutter/engine#36563) 2022-10-03 09:21:12 +00:00
dependabot[bot]
b07254d691 Bump ossf/scorecard-action from 2.0.3 to 2.0.4 (flutter/engine#36562) 2022-10-03 09:11:22 +00:00
sealesj
8c24c0eb88 Revert "OSV Vulnerabiltiy Scanning (#36355)" (flutter/engine#36477)
This reverts commit 67333ec64c77c195dd764682a3095c4c1744cbc2.
2022-09-28 13:12:25 -04:00
sealesj
67333ec64c OSV Vulnerabiltiy Scanning (flutter/engine#36355)
* initial flatten deps scan

* move 3rd party scan to separate action

* allow fork to run

* install requests

* use packages

* pip install

* rename

* conditional vuln report

* trailing whitespace

* trailing whitespace

* detailed print

* add testing file

* add upload test sarif

* results sarif

* move sarif

* upload modified sarif

* test flow

* test with results.sarif

* formatting

* test naming convention

* description with text in artifactLocation

* don't use locations

* use template sarif

* just use template

* add one field mod

* add another field mod

* use actual osvReport

* add field

* add field

* test

* no information uri

* no information uri

* add name

* template NA data for results

* back to minimal template

* dynamic rules

* template update

* no results

* only use template

* test

* new test

* new test

* add back locations

* descriptive fields

* test

* use package name

* variable commit hash

* add chromium accessibility readme support

* use batch query test

* clean up

* use variables for sarif template

* initial automating ancestor commit

* allow for workflow on testing

* install gitpython in workflow

* wrap in try

* expand try

* check commit is not none

* quiet clone

* fix commit newline

* proper print for failed deps

* remove gitpython

* remove import

* fix origin source

* remove .dart from dep names

* update dep

* typo

* update

* clone into controlled name repo now

* fix github upstream clone url

* test CVE finding

* use templated rule and result

* typo

* remove test CVE

* add link straight to OSV DB

* comments

* use os mkdir

* check time of pinned commit

* quiet git

* print osv api query results if vulns found

* move upstream mapping into DEPS file

* add testing for DEPS file

* add khronos exception

* add basic ancestor commit test

* no vulns message

* do not produce empty sarif

* add yaml

* remove unused python dep

* no change?

* no more print, causing recipe issues

* string test

* string test

* no more fstrings

* convert to .format

* syntax

* remove unused dep

* test

* switch test script

* no encoding

* add back test

* typo

* remove scan flat deps tests again

* update

* fix tests

* typo

* newline

* use checkout dir

* prefix

* update to use prefix

* lint

* runhook attempt

* lint

* lint

* lint

* lint

* no license blurb

* cleanup

* enable for main

* do not raise error

* run on branch

* data indentation

* check file existence
2022-09-28 12:56:31 -04:00
dependabot[bot]
31399ab183 Bump github/codeql-action from 2.1.24 to 2.1.25 (flutter/engine#36409) 2022-09-26 09:18:22 +00:00
dependabot[bot]
247f2b74b6 Bump github/codeql-action from 2.1.22 to 2.1.24 (flutter/engine#36245) 2022-09-19 09:34:23 +00:00
sealesj
94f887388f Separate GitHub workflow jobs (flutter/engine#36152)
* boringssl metadata for vuln scan

* update date, add owners test

* move unsupported actions into new job

* temp remove branch protection for test

* minor change

* fake change

* no branch check

* re-enable branch protection

* updates

* refactor further into generic setup

* remove setup stage

* no more needs
2022-09-14 16:20:40 -04:00
sealesj
34860c0d50 Separate GitHub workflow jobs (flutter/engine#36127)
* boringssl metadata for vuln scan

* update date, add owners test

* move unsupported actions into new job

* temp remove branch protection for test

* minor change

* fake change

* no branch check

* re-enable branch protection

* updates

* refactor further into generic setup
2022-09-14 15:47:44 -04:00
godofredoc
e69e84f0ee Manual update of scorecards 2.0.3 (flutter/engine#36112) 2022-09-13 15:28:46 +00:00
dependabot[bot]
2eb31ffb36 Bump ossf/scorecard-action from 1.1.2 to 2.0.2 (flutter/engine#36089) 2022-09-12 09:38:11 +00:00
dependabot[bot]
244a38c703 Bump github/codeql-action from 2.1.21 to 2.1.22 (flutter/engine#35927) 2022-09-05 15:35:24 +00:00
dependabot[bot]
7a93830e5d Bump github/codeql-action from 2.1.19 to 2.1.21 (flutter/engine#35773) 2022-08-29 09:42:21 +00:00
dependabot[bot]
8014946bca Bump github/codeql-action from 2.1.18 to 2.1.19 (flutter/engine#35595) 2022-08-22 09:20:05 +00:00
dependabot[bot]
d42b1487f2 Bump github/codeql-action from 2.1.16 to 2.1.18 (flutter/engine#35226) 2022-08-08 09:52:13 +00:00
dependabot[bot]
057884114c Bump actions/setup-python from 4.1.0 to 4.2.0 (flutter/engine#35227) 2022-08-08 09:22:13 +00:00
dependabot[bot]
b0ed3717c2 Bump github/codeql-action from 2.1.15 to 2.1.16 (flutter/engine#34711) 2022-07-18 11:58:05 +00:00
dependabot[bot]
21c6425005 Bump actions/setup-python from 3.1.2 to 4.1.0 (flutter/engine#34712) 2022-07-18 10:08:05 +00:00
dependabot[bot]
5f315373f8 Bump ossf/scorecard-action from 1.1.1 to 1.1.2 (flutter/engine#34453) 2022-07-05 00:07:05 +00:00
dependabot[bot]
28b2d09790 Bump github/codeql-action from 2.1.14 to 2.1.15 (flutter/engine#34454) 2022-07-04 09:11:07 +00:00
dependabot[bot]
a4bd8e47ca Bump github/codeql-action from 2.1.12 to 2.1.14 (flutter/engine#34259) 2022-06-23 20:13:04 +00:00
godofredoc
0cb94ef6ca Use autosubmit instead of "waiting for tree to go green" for dependabot. (flutter/engine#34153) 2022-06-23 19:15:05 +00:00
godofredoc
154c2ba7c2 Auto-land dependabot changes that pass all the tests. (flutter/engine#33940) 2022-06-09 14:28:05 -07:00
dependabot[bot]
46f02cbb90 Bump github/codeql-action from 2.1.11 to 2.1.12 (flutter/engine#33775) 2022-06-09 13:43:04 -07:00
dependabot[bot]
290404cd45 Bump ossf/scorecard-action from 1.1.0 to 1.1.1 (flutter/engine#33774) 2022-06-09 13:38:05 -07:00
dependabot[bot]
29292c67c2 Bump ossf/scorecard-action from 1.0.4 to 1.1.0 (flutter/engine#33629) 2022-05-25 19:33:04 -07:00
dependabot[bot]
7b7ff3fc71 Bump actions/upload-artifact from 3.0.0 to 3.1.0 (flutter/engine#33552) 2022-05-25 18:28:05 -07:00
dependabot[bot]
e7b93fb4fb Bump github/codeql-action from 2.1.9 to 2.1.11 (flutter/engine#33418) 2022-05-19 22:13:03 -07:00
dependabot[bot]
896b9d5df8 Bump actions/setup-python from 3.0.0 to 3.1.2 (flutter/engine#33146) 2022-05-07 11:49:03 -07:00
dependabot[bot]
12f5f87cb1 Bump actions/upload-artifact from 2.3.1 to 3 (flutter/engine#33145) 2022-05-07 11:44:05 -07:00
dependabot[bot]
22d41fbdcd Bump github/codeql-action from 1.0.26 to 2.1.9 (flutter/engine#33144) 2022-05-07 11:39:05 -07:00
dependabot[bot]
bde228f1ab Bump actions/checkout from 2.4.0 to 3.0.2 (flutter/engine#33143) 2022-05-07 11:34:06 -07:00
dependabot[bot]
69a4c789b1 Bump ossf/scorecard-action from 1.0.2 to 1.0.4 (flutter/engine#33142) 2022-05-07 11:29:05 -07:00
Drew Roen
2373205814 Create dependabot.yml (flutter/engine#33137) 2022-05-05 15:47:07 -05:00
Drew Roen
ec84ac54fa Add default read permissions to address a code scanning security issue (flutter/engine#33103) 2022-05-04 11:39:07 -07:00
godofredoc
d97de0c096 Remove the on_pull event from scorecards workflow. (flutter/engine#32363) 2022-03-31 13:00:02 -07:00
godofredoc
11a2c7e893 Add gclient parser. (flutter/engine#32135)
* Add gclient parser.

* pin python-installation version.

* Update documentation.

* Add license header.
2022-03-25 09:30:18 -07:00
godofredoc
b53488e7e1 Remove schedules from scorecards. (flutter/engine#31337) 2022-02-08 16:25:10 -08:00
godofredoc
630bd6634a Do not run score cards in forks of engine. (flutter/engine#31199) 2022-02-01 19:15:11 -08:00
godofredoc
be0f6b38f4 Create scorecards-analysis.yml (flutter/engine#31126) 2022-01-28 16:55:02 -08:00
godofredoc
3ddef3e9ad Update the token used by mirroring workflows. (flutter/engine#30000) 2021-11-30 10:59:01 -08:00
godofredoc
71b4205800 Reverse order of branch mirroring. (flutter/engine#29754)
Bug: https://github.com/flutter/flutter/issues/90476
2021-11-15 10:40:37 -08:00
Jenn Magder
ca2ad8ef8b Make mirror GitHub workflow not run on forks (flutter/engine#29336) 2021-10-26 11:08:03 -07:00
godofredoc
ae68d0409b Update documentation links to point to main branch. (flutter/engine#29326) 2021-10-26 10:48:02 -07:00
godofredoc
cbf62e52aa Mirror master to main branch. (flutter/engine#28896) 2021-09-28 09:28:01 -07:00
Chinmay Garde
d1e7b3a565 Remove presubmit flake reporting instructions from issue template. (flutter/engine#26997) 2021-06-28 10:01:02 -07:00
Abhishek Ghaskata
9f2bbf80ec Grammatical mistake on pull request template (flutter/engine#23948) 2021-01-28 17:24:02 -08:00
Ian Hickson
5f469ad84e Sync the pull request template with the flutter/flutter version (flutter/engine#23494)
This is part of a general simplification effort for our contributor docs.
2021-01-15 11:49:30 -08:00