RepoAuditor 0.2.25__tar.gz → 0.2.27__tar.gz

{repoauditor-0.2.25 → repoauditor-0.2.27}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: RepoAuditor
-Version: 0.2.25
+Version: 0.2.27
 Summary: Add your description here
 Project-URL: Homepage, https://github.com/gt-sse-center/RepoAuditor
 Project-URL: Documentation, https://github.com/gt-sse-center/RepoAuditor

{repoauditor-0.2.25 → repoauditor-0.2.27}/pyproject.toml

@@ -39,6 +39,7 @@ repo_auditor = "RepoAuditor:EntryPoint.app"
 [project.entry-points.RepoAuditor]
 GitHubPlugin = "RepoAuditor.Plugins.GitHubPlugin"
 GitHubCustomizationPlugin = "RepoAuditor.Plugins.GitHubCustomizationPlugin"
+GitHubRulesetPlugin="RepoAuditor.Plugins.GitHubRuleset"
 
 [build-system]
 requires = ["hatchling"]

{repoauditor-0.2.25 → repoauditor-0.2.27}/src/RepoAuditor/Plugins/GitHub/StandardQueryRequirements/SecretScanning.py

@@ -24,12 +24,12 @@ class SecretScanning(StandardEnableRequirementImpl):
             True,
             "false",
             "settings/security_analysis",
-            "Secret scanning",
-            "Secret scanning",
+            "Secret Protection",
+            "Secret protection",
             _GetValue,
             textwrap.dedent(
                 """\
-                The default behavior is to enable secret scanning.
+                The default behavior is to enable secret protection.
 
                 Reasons for this Default
                 ------------------------

{repoauditor-0.2.25 → repoauditor-0.2.27}/src/RepoAuditor/Plugins/GitHub/StandardQueryRequirements/SecretScanningPushProtection.py

@@ -24,7 +24,7 @@ class SecretScanningPushProtection(StandardEnableRequirementImpl):
             True,
             "false",
             "settings/security_analysis",
-            "Secret scanning",
+            "Secret Protection",
             "Push protection",
             _GetValue,
             textwrap.dedent(

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRuleset.py

@@ -0,0 +1,20 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains Plugin functionality."""
+
+import pluggy
+
+from RepoAuditor import APP_NAME
+from RepoAuditor.Module import Module
+
+from RepoAuditor.Plugins.GitHubRulesets.Module import GitHubRulesetModule
+
+
+@pluggy.HookimplMarker(APP_NAME)
+def GetModule() -> Module:
+    """Return GitHubRulesetModule Module."""
+    return GitHubRulesetModule()

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRulesets/Module.py

@@ -0,0 +1,49 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the GitHubRulesetModule object."""
+
+import typer
+
+from dbrownell_Common.TyperEx import TypeDefinitionItemType
+from dbrownell_Common.Types import override
+
+from RepoAuditor.Module import ExecutionStyle
+from RepoAuditor.Plugins.GitHubBase.Module import GitHubBaseModule
+from RepoAuditor.Plugins.GitHubRulesets.RulesetQuery import RulesetQuery
+
+
+class GitHubRulesetModule(GitHubBaseModule):
+    """Module that validates GitHub repository rulesets."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            "GitHubRuleset",
+            "Validates GitHub repository rulesets.",
+            ExecutionStyle.Parallel,
+            [RulesetQuery()],
+            requires_explicit_include=True,
+        )
+
+    @override
+    def GetDynamicArgDefinitions(self) -> dict[str, TypeDefinitionItemType]:
+        """Get the definitions for the arguments to this requirement."""
+        return {
+            "url": (
+                str,
+                typer.Option(
+                    ...,
+                    help="[REQUIRED] GitHub repository URL (e.g., https://github.com/owner/repo).",
+                ),
+            ),
+            "branch": (
+                str,
+                typer.Option(
+                    None,
+                    help="Branch to evaluate. The default branch will be used if not specified.",
+                ),
+            ),
+        }

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRulesets/Requirements/RequirePullRequests.py

@@ -0,0 +1,47 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RequirePullRequests object."""
+
+from typing import override, Any
+from RepoAuditor.Requirement import EvaluateResult, ExecutionStyle, Requirement
+
+
+class RequirePullRequests(Requirement):
+    """Implement the Pull Requests required ruleset for the branch."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            name="RequirePullRequests",
+            description="Require pull requests before merging to default branch",
+            style=ExecutionStyle.Parallel,
+            resolution_template="Enable pull request requirements in repository rulesets",
+            rationale_template="Pull request reviews help maintain code quality and collaboration",
+        )
+
+    @override
+    def _EvaluateImpl(
+        self,
+        query_data: dict[str, Any],
+        requirement_args: dict[str, Any],
+    ) -> Requirement.EvaluateImplResult:
+        rulesets = query_data.get("rulesets", [])
+
+        for ruleset in rulesets:
+            if (
+                ruleset.get("enforcement", "") == "active"
+                and ruleset.get("target", "") == "branch"
+                and ruleset.get("parameters", {}).get("pull_request", {}).get("required", False)
+            ):
+                return self.EvaluateImplResult(
+                    EvaluateResult.Success, f"Ruleset '{ruleset['name']}' enforces pull requests"
+                )
+
+        return self.EvaluateImplResult(
+            EvaluateResult.Error,
+            "No active branch ruleset requiring pull requests found",
+            provide_resolution=True,
+        )

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRulesets/Requirements/RequireSignedCommits.py

@@ -0,0 +1,47 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RequireSignedCommits object."""
+
+from typing import override, Any
+from RepoAuditor.Requirement import EvaluateResult, ExecutionStyle, Requirement
+
+
+class RequireSignedCommits(Requirement):
+    """Implement the Signed Commits required ruleset for a branch."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            name="RequireSignedCommits",
+            description="Require signed commits",
+            style=ExecutionStyle.Parallel,
+            resolution_template="Enable commit signing requirement in repository rulesets",
+            rationale_template="Signed commits ensure commit authenticity",
+        )
+
+    @override
+    def _EvaluateImpl(
+        self,
+        query_data: dict[str, Any],
+        requirement_args: dict[str, Any],
+    ) -> Requirement.EvaluateImplResult:
+        rulesets = query_data.get("rulesets", [])
+
+        for ruleset in rulesets:
+            if (
+                ruleset.get("enforcement", "") == "active"
+                and ruleset.get("target", "") == "branch"
+                and ruleset.get("parameters", {}).get("commit_signatures", False)
+            ):
+                return self.EvaluateImplResult(
+                    EvaluateResult.Success, f"Ruleset '{ruleset['name']}' enforces signed commits"
+                )
+
+        return self.EvaluateImplResult(
+            EvaluateResult.Error,
+            "No active branch ruleset requiring signed commits found",
+            provide_resolution=True,
+        )

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRulesets/Requirements/RequireStatusChecks.py

@@ -0,0 +1,47 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RequireStatusChecks object."""
+
+from typing import override, Any
+from RepoAuditor.Requirement import EvaluateResult, ExecutionStyle, Requirement
+
+
+class RequireStatusChecks(Requirement):
+    """Implement the Status Check ruleset for a branch."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            name="RequireStatusChecks",
+            description="Require status checks to pass before merging",
+            style=ExecutionStyle.Parallel,
+            resolution_template="Configure required status checks in repository rulesets",
+            rationale_template="Status checks ensure code quality and compatibility",
+        )
+
+    @override
+    def _EvaluateImpl(
+        self,
+        query_data: dict[str, Any],
+        requirement_args: dict[str, Any],
+    ) -> Requirement.EvaluateImplResult:
+        rulesets = query_data.get("rulesets", [])
+
+        for ruleset in rulesets:
+            if (
+                ruleset.get("enforcement", "") == "active"
+                and ruleset.get("target", "") == "branch"
+                and len(ruleset.get("parameters", {}).get("required_status_checks", [])) > 0
+            ):
+                return self.EvaluateImplResult(
+                    EvaluateResult.Success, f"Ruleset '{ruleset['name']}' enforces status checks"
+                )
+
+        return self.EvaluateImplResult(
+            EvaluateResult.Error,
+            "No active branch ruleset requiring status checks found",
+            provide_resolution=True,
+        )

repoauditor-0.2.27/src/RepoAuditor/Plugins/GitHubRulesets/RulesetQuery.py

@@ -0,0 +1,53 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Contains the RulesetQuery object."""
+
+from typing import Any, Optional
+
+from dbrownell_Common.Types import override
+from RepoAuditor.Impl.ParallelSequentialProcessor import ExecutionStyle
+from RepoAuditor.Query import Query
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequirePullRequests import RequirePullRequests
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequireSignedCommits import RequireSignedCommits
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequireStatusChecks import RequireStatusChecks
+
+
+class RulesetQuery(Query):
+    """Query to validate GitHub repository rulesets."""
+
+    def __init__(self) -> None:
+        super().__init__(
+            "RulesetQuery",
+            ExecutionStyle.Parallel,
+            [
+                RequireStatusChecks(),
+                RequirePullRequests(),
+                RequireSignedCommits(),
+            ],
+        )
+
+    @override
+    def GetData(
+        self,
+        module_data: dict[str, Any],
+    ) -> Optional[dict[str, Any]]:
+        """Retrieve data required for validating GitHub rulesets.
+
+        Args:
+            module_data (dict): Dictionary containing initial data from the module.
+
+        Returns:
+            Optional[dict]: A dictionary containing ruleset-related
+            data, or None if an error occurs.
+
+        """
+        # Fetch ruleset data from the GitHub API
+        ruleset_data = module_data["session"].get("rulesets")
+
+        # Add ruleset data to module_data
+        module_data["ruleset_data"] = ruleset_data
+        return module_data

{repoauditor-0.2.25 → repoauditor-0.2.27}/src/RepoAuditor/__init__.py

@@ -3,4 +3,4 @@ APP_NAME = "RepoAuditor"
 # Note that this value will be overwritten by calls to `python ../../Build.py update_version` based
 # on changes observed in the git repository. The default value below will be used until the value
 # here is explicitly updated by the Continuous Integration system.
-__version__ = "0.2.25"
+__version__ = "0.2.27"

{repoauditor-0.2.25 → repoauditor-0.2.27}/tests/CommandLineProcessor_UnitTest.py

@@ -446,3 +446,22 @@ def test_InvalidArgName():
             set(),
             set(),
         )
+
+
+# ----------------------------------------------------------------------
+def test_InvalidArgs():
+    """Check if an invalid module is specified as an argument."""
+    with pytest.raises(
+        Exception,
+        match=re.escape("'InvalidModule' is not a recognized module name."),
+    ):
+        CommandLineProcessor.Create(
+            # Specify an unregistered module
+            get_dynamic_args_func=lambda dynamic_arg_definitions: {"InvalidModule-arg1": "value"},
+            # ValidModule is the registered module.
+            modules=[MyModule(name="ValidModule")],
+            includes=["InvalidModule"],
+            excludes=[],
+            warnings_as_error_module_names=set(),
+            ignore_warnings_module_names=set(),
+        )

repoauditor-0.2.27/tests/Plugins/GitHubRuleset_UnitTest.py

@@ -0,0 +1,213 @@
+# -------------------------------------------------------------------------------
+# |
+# |  Copyright (c) 2024 Scientific Software Engineering Center at Georgia Tech
+# |  Distributed under the MIT License.
+# |
+# -------------------------------------------------------------------------------
+"""Unit tests for the GitHub Rulesets Plugin"""
+
+from RepoAuditor.Requirement import EvaluateResult
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequirePullRequests import RequirePullRequests
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequireStatusChecks import RequireStatusChecks
+from RepoAuditor.Plugins.GitHubRulesets.Requirements.RequireSignedCommits import (
+    RequireSignedCommits,
+)
+
+
+def create_ruleset(name, target, enforcement, parameters):
+    """Helper function to create ruleset structure"""
+    return {"name": name, "target": target, "enforcement": enforcement, "parameters": parameters}
+
+
+# ----------------------------------------------------------------------
+class TestRequirePullRequests:
+    """Unit tests for the RequirePullRequests requirement."""
+
+    def test_Enabled(self):
+        requirement = RequirePullRequests()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="PR Rules",
+                    target="branch",
+                    enforcement="active",
+                    parameters={"pull_request": {"required": True, "require_code_owner_review": True}},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Success
+        assert "enforces pull requests" in result.context
+
+    def test_Disabled(self):
+        requirement = RequirePullRequests()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Inactive PR Rules",
+                    target="branch",
+                    enforcement="disabled",  # Wrong enforcement
+                    parameters={"pull_request": {"required": True}},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_WrongTarget(self):
+        requirement = RequirePullRequests()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Wrong Target Rules",
+                    target="tag",  # Wrong target
+                    enforcement="active",
+                    parameters={"pull_request": {"required": True}},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_MissingParameter(self):
+        requirement = RequirePullRequests()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Partial Rules",
+                    target="branch",
+                    enforcement="active",
+                    parameters={"other_rule": {}},  # Missing pull_request
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_NoRulesets(self):
+        requirement = RequirePullRequests()  # type: ignore
+        context = {"rulesets": []}
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+        assert "No active branch ruleset requiring pull requests found" in result.context
+
+
+# ----------------------------------------------------------------------
+class TestRequireSignedCommits:
+    """Unit tests for the RequireSignedCommits requirement."""
+
+    def test_Enabled(self):
+        requirement = RequireSignedCommits()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Signing Rules",
+                    target="branch",
+                    enforcement="active",
+                    parameters={"commit_signatures": True},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Success
+        assert "enforces signed commits" in result.context
+
+    def test_Disabled(self):
+        requirement = RequireSignedCommits()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Inactive Signing",
+                    target="branch",
+                    enforcement="evaluate",  # Wrong enforcement
+                    parameters={"commit_signatures": True},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_PartialConfig(self):
+        requirement = RequireSignedCommits()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Partial Config",
+                    target="branch",
+                    enforcement="active",
+                    parameters={"commit_signatures": False},  # Explicitly disabled
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_NoRulesets(self):
+        requirement = RequireSignedCommits()  # type: ignore
+        context = {"rulesets": []}
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+        assert "No active branch ruleset requiring signed commits found" in result.context
+
+
+# ----------------------------------------------------------------------
+class TestRequireStatusChecks:
+    """Unit tests for the RequireStatusChecks requirement."""
+
+    def test_Enabled(self):
+        requirement = RequireStatusChecks()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="CI Checks",
+                    target="branch",
+                    enforcement="active",
+                    parameters={
+                        "required_status_checks": [
+                            {"context": "ci-test"},
+                            {"context": "security-scan"},
+                        ]
+                    },
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Success
+        assert "enforces status checks" in result.context
+
+    def test_EmptyChecks(self):
+        requirement = RequireStatusChecks()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Empty Checks",
+                    target="branch",
+                    enforcement="active",
+                    parameters={"required_status_checks": []},  # Empty list
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_InactiveRuleset(self):
+        requirement = RequireStatusChecks()  # type: ignore
+        context = {
+            "rulesets": [
+                create_ruleset(
+                    name="Inactive Checks",
+                    target="branch",
+                    enforcement="disabled",  # Inactive
+                    parameters={"required_status_checks": [{"context": "ci-test"}]},
+                )
+            ]
+        }
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+
+    def test_NoRulesets(self):
+        requirement = RequireStatusChecks()  # type: ignore
+        context = {"rulesets": []}
+        result = requirement.Evaluate(context, {})
+        assert result.result == EvaluateResult.Error
+        assert "No active branch ruleset requiring status checks found" in result.context

{repoauditor-0.2.25 → repoauditor-0.2.27}/tests/Plugins/__snapshots__/GitHub_EndToEndTest.ambr

@@ -886,15 +886,15 @@
   │                                                                                                                                                                                  │
   │ ╭─ [Error] SecretScanning ─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
   │ │                                                                                                                                                                              │ │
-  │ │ Validates that 'Secret scanning' is set to the expected value.                                                                                                               │ │
+  │ │ Validates that 'Secret protection' is set to the expected value.                                                                                                             │ │
   │ │                                                                                                                                                                              │ │
-  │ │ ERROR: 'Secret scanning' must be set to 'False' (it is currently set to 'True').                                                                                             │ │
+  │ │ ERROR: 'Secret protection' must be set to 'False' (it is currently set to 'True').                                                                                           │ │
   │ │                                                                                                                                                                              │ │
   │ │ Resolution                                                                                                                                                                   │ │
   │ │ ----------                                                                                                                                                                   │ │
   │ │   1) Visit '<scrubbed-github-url>'<scrubbed-space>│ │
-  │ │   2) Locate the 'Secret scanning' section                                                                                                                                    │ │
-  │ │   3) Ensure that 'Secret scanning' is disabled                                                                                                                               │ │
+  │ │   2) Locate the 'Secret Protection' section                                                                                                                                  │ │
+  │ │   3) Ensure that 'Secret protection' is disabled                                                                                                                             │ │
   │ │                                                                                                                                                                              │ │
   │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
   │                                                                                                                                                                                  │
@@ -935,7 +935,7 @@
   │ │ Resolution                                                                                                                                                                   │ │
   │ │ ----------                                                                                                                                                                   │ │
   │ │   1) Visit '<scrubbed-github-url>'<scrubbed-space>│ │
-  │ │   2) Locate the 'Secret scanning' section                                                                                                                                    │ │
+  │ │   2) Locate the 'Secret Protection' section                                                                                                                                  │ │
   │ │   3) Ensure that 'Push protection' is disabled                                                                                                                               │ │
   │ │                                                                                                                                                                              │ │
   │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
@@ -1511,7 +1511,7 @@
   │ ╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯ │
   │ ╭─ [Warning] SecretScanning ───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮ │
   │ │                                                                                                                                                                              │ │
-  │ │ Validates that 'Secret scanning' is set to the expected value.                                                                                                               │ │
+  │ │ Validates that 'Secret protection' is set to the expected value.                                                                                                             │ │
   │ │                                                                                                                                                                              │ │
   │ │ WARNING: Incomplete data was encountered; please provide the GitHub PAT or update the PAT's permissions if one was provided.                                                 │ │
   │ │                                                                                                                                                                              │ │