cloud-platform-repository-checker 1.0.4 → 1.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 60d229973369bc0c5340def8a8e75649c381264b514ed62621c1e035dbde224e
-  data.tar.gz: d881956db6b61be7f794869f983cab1658a4c90437a6567467d251a86aa28961
+  metadata.gz: d306587c4bb81554d8dd4c6b37f9e8e74d2068274dab46250b6542fc37e4f168
+  data.tar.gz: 29eee854a7436f2ce24164dcf8216fe9011fa6ab5bc271b1b12b58743014a059
 SHA512:
-  metadata.gz: a893a66211f292b3058e6715d6ecb0bd93b2c54217978a6a1eec6b25ff57913fe2c7747671c0a3f936b6af7cbebd2b41fb51f8ada5b7cc56f624c94f6b9181ea
-  data.tar.gz: 8bb942f8268191031e92640492d0a9e4c5e99947bf73afacf1e86b5aa6a745a203b18035a4aec777dc657c7f3bd243f04b92b8944c4165347b756b0bad8c764b
+  metadata.gz: a39aa4323f868fc6115c0d6cc18dfa5d808bddf17beb163b52e20141fa4d3c19cca489c850b009bcb7ff211f64ab054155ba3630b155e85006818430f36d6b9a
+  data.tar.gz: df74b0297eab79237fbbb0c543802f5c251f262899fc48abda7deb7d497d479e553d54059202319342e382ff158908c557bffad9750ff45a76420d1fab5e753d

data/Gemfile

@@ -8,4 +8,5 @@ gem "octokit"
 
 group :development do
   gem "pry-byebug"
+  gem "rspec"
 end

data/Gemfile.lock

@@ -5,6 +5,7 @@ GEM
       public_suffix (>= 2.0.2, < 5.0)
     byebug (11.1.3)
     coderay (1.1.2)
+    diff-lcs (1.3)
     faraday (1.0.1)
       multipart-post (>= 1.2, < 3)
     method_source (1.0.0)
@@ -19,6 +20,19 @@ GEM
       byebug (~> 11.0)
       pry (~> 0.13.0)
     public_suffix (4.0.5)
+    rspec (3.9.0)
+      rspec-core (~> 3.9.0)
+      rspec-expectations (~> 3.9.0)
+      rspec-mocks (~> 3.9.0)
+    rspec-core (3.9.2)
+      rspec-support (~> 3.9.3)
+    rspec-expectations (3.9.2)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.9.0)
+    rspec-mocks (3.9.1)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.9.0)
+    rspec-support (3.9.3)
     sawyer (0.8.2)
       addressable (>= 2.3.5)
       faraday (> 0.8, < 2.0)
@@ -29,6 +43,7 @@ PLATFORMS
 DEPENDENCIES
   octokit
   pry-byebug
+  rspec
 
 BUNDLED WITH
    2.1.2

data/README.md

@@ -1,2 +1,21 @@
 # cloud-platform-repository-checker
+
 Checks all Cloud Platform repositories for compliance
+
+## Updating
+
+This code is published as a [ruby gem].
+
+To publish a new version:
+
+* Authenticate to `rubygems.org` as `ministryofjustice` (credentials are in LastPass)
+* Update the `VERSION` value in the `makefile`
+* Run `make publish`
+
+This will repackage the gem using the latest code, and push a new release to
+rubygems.org
+
+> Please remember to keep the unit tests in `spec` up to date wrt. your code
+> changes.
+
+[ruby gem]: https://rubygems.org/gems/cloud-platform-repository-checker

data/bin/cloud-platform-repository-checker

@@ -16,8 +16,15 @@ require_relative "../lib/repository_report"
 
 ############################################################
 
+# Exceptions are repos which are allowed to break the rules.
+# e.g. a repo to which compiled html files for a github pages
+# site can't implement branch protection, but we don't want it
+# to show up as an error
+exceptions = ENV["REPO_EXCEPTIONS"].to_s.split(" ")
+
 params = {
   organization: ENV.fetch("ORGANIZATION"),
+  exceptions: exceptions,
   regexp: Regexp.new(ENV.fetch("REGEXP")),
   team: ENV.fetch("TEAM"),
   github_token: ENV.fetch("GITHUB_TOKEN")

data/bin/list-master-repos.rb

@@ -0,0 +1,31 @@
+#!/usr/bin/env ruby
+
+# Script to list repositories in the ministryofjustice organisation whose names
+# match a regular expression, and whose default branch is "master"
+
+require "json"
+require "net/http"
+require "uri"
+require "octokit"
+
+require_relative "../lib/github_graph_ql_client"
+require_relative "../lib/repository_lister"
+require_relative "../lib/repository_report"
+
+############################################################
+
+params = {
+  organization: ENV.fetch("ORGANIZATION"),
+  regexp: Regexp.new(ENV.fetch("REGEXP")),
+  team: ENV.fetch("TEAM"),
+  github_token: ENV.fetch("GITHUB_TOKEN")
+}
+
+repositories = RepositoryLister.new(params)
+  .repository_names
+  .inject([]) do |arr, repo_name|
+    report = RepositoryReport.new(params.merge(repo_name: repo_name)).report
+    arr << report
+end
+
+repositories.filter { |report| report.fetch(:default_branch) == "master" }.each { |report| puts report.fetch(:name) }

data/lib/repository_report.rb

@@ -1,13 +1,14 @@
 class RepositoryReport < GithubGraphQlClient
-  attr_reader :organization, :repo_name, :team
+  attr_reader :organization, :exceptions, :repo_name, :team
 
-  MASTER = "master"
+  MAIN_BRANCH = "main"
   ADMIN = "admin"
   PASS = "PASS"
   FAIL = "FAIL"
 
   def initialize(params)
     @organization = params.fetch(:organization)
+    @exceptions = params.fetch(:exceptions) # repos which are allowed to break the rules
     @repo_name = params.fetch(:repo_name)
     @team = params.fetch(:team)
     super(params)
@@ -23,6 +24,7 @@ class RepositoryReport < GithubGraphQlClient
     {
       organization: organization,
       name: repo_name,
+      default_branch: default_branch,
       url: repo_url,
       status: status,
       report: all_checks_result
@@ -40,17 +42,21 @@ class RepositoryReport < GithubGraphQlClient
   end
 
   def status
-    all_checks_result.values.all? ? PASS : FAIL
+    if exceptions.include?(repo_name)
+      PASS
+    else
+      all_checks_result.values.all? ? PASS : FAIL
+    end
   end
 
   def all_checks_result
     @all_checks_result ||= {
-      has_master_branch_protection: has_master_branch_protection?,
+      default_branch_main: default_branch_main?,
+      has_main_branch_protection: has_main_branch_protection?,
       requires_approving_reviews: has_branch_protection_property?("requiresApprovingReviews"),
       requires_code_owner_reviews: has_branch_protection_property?("requiresCodeOwnerReviews"),
       administrators_require_review: has_branch_protection_property?("isAdminEnforced"),
       dismisses_stale_reviews: has_branch_protection_property?("dismissesStaleReviews"),
-      requires_strict_status_checks: has_branch_protection_property?("requiresStrictStatusChecks"),
       team_is_admin: is_team_admin?,
     }
   end
@@ -81,6 +87,9 @@ class RepositoryReport < GithubGraphQlClient
           owner {
             login
           }
+          defaultBranchRef {
+            name
+          }
           branchProtectionRules(first: 50) {
             edges {
               node {
@@ -98,11 +107,15 @@ class RepositoryReport < GithubGraphQlClient
     ]
   end
 
+  def default_branch
+    repo_data.dig("data", "repository", "defaultBranchRef", "name")
+  end
+
   def is_team_admin?
     client = Octokit::Client.new(access_token: github_token)
 
-    client.repo_teams([organization, repo_name].join("/")).select do |team|
-      team[:name] == team && team[:permission] == ADMIN
+    client.repo_teams([organization, repo_name].join("/")).select do |t|
+      t[:name] == team && t[:permission] == ADMIN
     end.any?
   rescue Octokit::NotFound
     # This happens if our token does not have permission to view repo settings
@@ -113,11 +126,15 @@ class RepositoryReport < GithubGraphQlClient
     @rules ||= repo_data.dig("data", "repository", "branchProtectionRules", "edges")
   end
 
-  def has_master_branch_protection?
+  def default_branch_main?
+    default_branch == MAIN_BRANCH
+  end
+
+  def has_main_branch_protection?
     requiring_branch_protection_rules do |rules|
 
       rules
-        .select { |edge| edge.dig("node", "pattern") == MASTER }
+        .select { |edge| edge.dig("node", "pattern") == MAIN_BRANCH }
         .any?
     end
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cloud-platform-repository-checker
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.4.1
 platform: ruby
 authors:
 - David Salgado
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-05-14 00:00:00.000000000 Z
+date: 2020-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: octokit
@@ -24,10 +24,11 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '4'
-description: 
+description:
 email: platforms@digital.justice.gov.uk
 executables:
 - cloud-platform-repository-checker
+- list-master-repos.rb
 extensions: []
 extra_rdoc_files:
 - README.md
@@ -37,6 +38,7 @@ files:
 - LICENSE
 - README.md
 - bin/cloud-platform-repository-checker
+- bin/list-master-repos.rb
 - env.example
 - lib/github_graph_ql_client.rb
 - lib/repository_lister.rb
@@ -45,7 +47,7 @@ homepage: https://github.com/ministryofjustice/cloud-platform
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options:
 - "--main"
 - README.md
@@ -63,7 +65,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.0.3
-signing_key: 
+signing_key:
 specification_version: 4
-summary: What this thing does
+summary: Check that ministryofjustice/cloud-platform-* github repositories comply
+  with our standards
 test_files: []