Skip to content

Commit 7e031f1

Browse files
timweritimweri
committed
PR scan
1 parent 64513f5 commit 7e031f1

1 file changed

Lines changed: 26 additions & 154 deletions

File tree

‎.github/workflows/sigscanner-check.yml‎

Lines changed: 26 additions & 154 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,7 @@ concurrency:
99
group: ${{ github.workflow }}-pr-${{ github.event.pull_request.number || github.run_id }}
1010
cancel-in-progress: true
1111

12-
permissions:
13-
pull-requests: read
12+
permissions: {}
1413

1514
jobs:
1615
sigscanner-check:
@@ -23,168 +22,41 @@ jobs:
2322
PR_NUMBER: ${{ github.event.pull_request.number }}
2423
VERIFY_MAX_ATTEMPTS: "3"
2524
steps:
26-
- name: "Fetch PR commits"
27-
id: fetch-commits
28-
env:
29-
GH_TOKEN: ${{ github.token }}
30-
run: |
31-
# Fetch all commit hashes and their corresponding committers in this PR
32-
gh api "repos/$REPOSITORY/pulls/$PR_NUMBER/commits" --paginate \
33-
--jq '.[] | [.sha, (.committer.login // "")] | join(",")' \
34-
> /tmp/commits_with_committer.csv
35-
36-
commit_count=$(wc -l < /tmp/commits_with_committer.csv | tr -d ' ')
37-
echo "Found $commit_count commits in PR #$PR_NUMBER"
38-
echo "commit-count=$commit_count" >> "$GITHUB_OUTPUT"
39-
40-
if [[ $commit_count -eq 0 ]]; then
41-
echo "❌ Unexpected: no commits to verify"
42-
exit 1
43-
fi
44-
4525
- name: "Sigscanner check"
4626
id: sigscanner
4727
continue-on-error: true
4828
env:
4929
SIGSCANNER_URL: ${{ secrets.SIGSCANNER_URL }}
5030
SIGSCANNER_API_KEY: ${{ secrets.SIGSCANNER_API_KEY }}
51-
COMMIT_COUNT: ${{ steps.fetch-commits.outputs.commit-count }}
5231
run: |
53-
> /tmp/verified_commits.csv
54-
55-
echo "🔎 Verifying $COMMIT_COUNT commits"
56-
57-
# Loop through all the commits
58-
# For each commit, query Sigscanner with retry to check if it's verified
59-
# Verified commit hashes with committer username are saved to /tmp/verified_commits.csv
60-
while IFS=, read -r commit_sha committer_username; do
61-
[[ -z "$commit_sha" ]] && continue
62-
63-
commit_is_verified=false
64-
request_attempt=1
65-
66-
while [[ $request_attempt -le $VERIFY_MAX_ATTEMPTS ]]; do
67-
response=$(curl -s --max-time 20 -G \
68-
-H "X-SIGSCANNER-SECRET: $SIGSCANNER_API_KEY" \
69-
--data-urlencode "commit=$commit_sha" \
70-
--data-urlencode "repository=$REPOSITORY" \
71-
--data-urlencode "author=$committer_username" \
72-
"$SIGSCANNER_URL")
73-
74-
res_verified=$(echo "$response" | jq -r '.verified')
75-
res_error=$(echo "$response" | jq -r '.error')
76-
77-
if [[ "$res_verified" == "true" ]]; then
78-
commit_is_verified=true
79-
break
80-
elif [[ "$res_error" == "null" || "$res_error" == "" ]]; then
81-
# This means the commit is explicitly unverified and shouldn't be retried
82-
break
83-
fi
84-
85-
[[ $request_attempt -lt $VERIFY_MAX_ATTEMPTS ]] && sleep 15
86-
request_attempt=$((request_attempt + 1))
87-
done
88-
89-
if [[ "$commit_is_verified" == "true" ]]; then
90-
echo "✅ $commit_sha"
91-
echo "$commit_sha,$committer_username" >> /tmp/verified_commits.csv
32+
request_attempt=1
33+
while [[ $request_attempt -le $VERIFY_MAX_ATTEMPTS ]]; do
34+
response=$(curl -s --max-time 300 -G \
35+
-H "X-SIGSCANNER-SECRET: $SIGSCANNER_API_KEY" \
36+
--data-urlencode "pr=$PR_NUMBER" \
37+
--data-urlencode "repository=$REPOSITORY" \
38+
"$SIGSCANNER_URL")
39+
40+
res_verified=$(echo "$response" | jq -r '.verified')
41+
res_unverified_commits=$(echo "$response" | jq '.unverified_commits')
42+
res_error=$(echo "$response" | jq -r '.error')
43+
44+
if [[ "$res_verified" == "true" ]]; then
45+
echo "✅ All commits verified"
46+
exit 0
47+
break
48+
elif [[ "$(echo "$response" | jq '(.unverified_commits // []) | length > 0')" == "true" ]]; then
49+
# Non-empty unverified_commits: definitive result, do not retry
50+
echo "❌ Unverified commits:"
51+
echo "$res_unverified_commits"
52+
break
9253
else
93-
echo "❌ $commit_sha"
54+
echo "❌ Error: $res_error"
9455
fi
95-
done < /tmp/commits_with_committer.csv
9656
97-
verified_commit_count=$(wc -l < /tmp/verified_commits.csv | tr -d ' ')
98-
echo "Verified: $verified_commit_count / $COMMIT_COUNT"
99-
100-
if [[ $verified_commit_count -eq $COMMIT_COUNT ]]; then
101-
echo "✅ All commits verified"
102-
exit 0
103-
fi
57+
[[ $request_attempt -lt $VERIFY_MAX_ATTEMPTS ]] && sleep 15
58+
request_attempt=$((request_attempt + 1))
59+
done
10460
10561
echo "❌ Not all commits verified"
10662
exit 1
107-
108-
- name: "Sigscanner fallback check"
109-
if: ${{ steps.sigscanner.outcome == 'failure' }}
110-
env:
111-
API_TOKEN: ${{ secrets.SIGSCANNER_API_TOKEN }}
112-
API_URL: ${{ secrets.SIGSCANNER_API_URL }}
113-
COMMIT_COUNT: ${{ steps.fetch-commits.outputs.commit-count }}
114-
run: |
115-
touch /tmp/verified_commits.csv
116-
117-
# Extract commits failed to verify earlier by comparing the verified commits file
118-
# with the full list of commits
119-
grep -vxFf /tmp/verified_commits.csv /tmp/commits_with_committer.csv \
120-
> /tmp/pending_commits.csv
121-
122-
pending_commit_count=$(wc -l < /tmp/pending_commits.csv | tr -d ' ')
123-
124-
if [[ $pending_commit_count -eq 0 ]]; then
125-
echo "✅ All commits verified"
126-
exit 0
127-
fi
128-
129-
echo "🔎 Fallback: verifying $pending_commit_count remaining commits"
130-
131-
# Loop through all the commits again with retry with the fallback API
132-
while IFS=, read -r commit_sha committer_username; do
133-
[[ -z "$commit_sha" ]] && continue
134-
135-
commit_is_verified=false
136-
request_attempt=1
137-
138-
while [[ $request_attempt -le $VERIFY_MAX_ATTEMPTS ]]; do
139-
body=$(jq -n \
140-
--arg commit "$commit_sha" \
141-
--arg repository "$REPOSITORY" \
142-
--arg author "$committer_username" \
143-
'{commit: $commit, repository: $repository, author: $author}')
144-
145-
http_status=$(curl --silent --output /dev/null --write-out '%{http_code}' \
146-
--max-time 20 -X POST \
147-
-H "Content-Type: application/json" \
148-
-H "Authorization: $API_TOKEN" \
149-
--url "$API_URL" \
150-
--data "$body")
151-
152-
case $http_status in
153-
200)
154-
commit_is_verified=true
155-
break
156-
;;
157-
400)
158-
echo "❌ $commit_sha - Bad request"
159-
break
160-
;;
161-
403) break ;;
162-
5??)
163-
[[ $request_attempt -lt $VERIFY_MAX_ATTEMPTS ]] && sleep 15
164-
;;
165-
*)
166-
echo "❌ $commit_sha - Unexpected: $http_status"
167-
break
168-
;;
169-
esac
170-
171-
request_attempt=$((request_attempt + 1))
172-
done
173-
174-
if [[ "$commit_is_verified" == "true" ]]; then
175-
echo "✅ $commit_sha"
176-
echo "$commit_sha,$committer_username" >> /tmp/verified_commits.csv
177-
else
178-
echo "❌ $commit_sha"
179-
fi
180-
done < /tmp/pending_commits.csv
181-
182-
total_verified_count=$(wc -l < /tmp/verified_commits.csv | tr -d ' ')
183-
echo "Verified: $total_verified_count / $COMMIT_COUNT"
184-
185-
if [[ $total_verified_count -ne $COMMIT_COUNT ]]; then
186-
echo "❌ Not all commits verified by fallback"
187-
exit 1
188-
fi
189-
190-
echo "✅ All commits verified"

0 commit comments

Comments
 (0)