Repository navigation
Retrieve Data from Project Security Insights Files - #53
Open
eddie-knight wants to merge 12 commits into
Open
eddie-knight wants to merge 12 commits into
eddie-knight wants to merge 12 commits into
Conversation
…restating name/url Every entry in data/working-groups/*.yml drops name and url; insights: now holds either the file's GitHub URL or owner/repo for discovery. Working groups gain a description sourced from their README. data/generated/ insights.json is the committed snapshot si fetch produced from those targets. Signed-off-by: Eddie Knight <knight@linux.com>
…ity Insights snapshot catalog.rb joins each record to its snapshot row by insights: target and hides records whose row is missing or not ok, listing them under catalog.awaiting_insights (rendered on /projects/). catalog_pages.rb fails on duplicate insights: targets, warns on a missing one, and resolves relationship targets against hidden records too. record-detail skips related ids that have no page. Signed-off-by: Eddie Knight <knight@linux.com>
…ly PR make refresh-insights runs si fetch from a si-tooling checkout and only replaces the snapshot on exit 0. The workflow pins a fork ref until upstream ships the command, then opens a PR when the file changes. Signed-off-by: Eddie Knight <knight@linux.com>
The refresh workflow pinned a branch name, which is not a pin. Use the si-fetch-cli commit sha. setup-go's cache needs a go.sum in the checkout and this repo has none (si-tooling is cloned later in the job), so turn it off. Signed-off-by: Eddie Knight <knight@linux.com>
Security Insights enriches a record, it never gates it. name returns to each entry (exact values from main) so a record renders when its SI file is missing or invalid; url stays removed and derives from the repo. WG file headers describe the enrich-not-gate model. Signed-off-by: Eddie Knight <knight@linux.com>
…available catalog.rb no longer excludes records: on an ok row the SI project name wins and homepage/repositories come from the file; otherwise the local name and description render, url derives from the repo, and si_available/si_status carry the reason. The hero shows a notice via si-notice.html when SI is unavailable; /projects/ lists those records by name. about.md tolerates a record with no url. The hidden-target degrade in record-detail is reverted since every id renders again. Signed-off-by: Eddie Knight <knight@linux.com>
Signed-off-by: Eddie Knight <knight@linux.com>
…ts fact The hero now leads with the record's openssf_url on every WG-hosted record, and the build fails when one is missing. The homepage link renders only when the Security Insights file provides one; without the file there is no homepage link, just the notice with the repository. Seven records lacked an openssf_url: model-signing has a page, the two SLSA sub-projects and the Gemara whitepaper use their parent project's page, and three with no page yet point at the technical-initiatives index with a TODO. Signed-off-by: Eddie Knight <knight@linux.com>
Upstream shipped the fetch command and discovery in v2.3.0, so the workflow no longer clones a fork: the Makefile pins the release as SI_FETCH and the workflow just calls make. Scorecard moved its file to the repo root and fixed its schema, so its entry becomes a discovery target and now renders from Security Insights. Snapshot regenerated through the pinned release. Signed-off-by: Eddie Knight <knight@linux.com>
Kusari Analysis Results:
No pinned version dependency changes, code issues or exposed secrets detected! Note View full detailed analysis result for more information on the output and the checks that were run.
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
…icense and status from Security Insights Repositories were joined from the snapshot but never rendered. The hero's "Project site" link also fell back to the SI file's repository url when project.homepage was absent, labelling a repo as a homepage; the homepage is now homepage-only and the repo is reachable from the Repositories list. Administrator emails are dropped at the join so neither the pages nor the catalog.json mirror publish them. Signed-off-by: Eddie Knight <knight@linux.com>
|
Kusari PR Analysis rerun based on - 2d9b1d9 performed at: 2026-10-09T19:14:15Z - link to updated analysis |
…out credentials Addresses the Kusari review on #53. The job holds contents: write and pull-requests: write, so a repointed tag could run arbitrary code with write access. create-pull-request takes its own token, so the checkout step no longer needs to persist one. Signed-off-by: Eddie Knight <knight@linux.com>
|
Kusari PR Analysis rerun based on - b3d4c4b performed at: 2026-10-09T19:17:48Z - link to updated analysis |
Conflicts: Makefile, theme/_plugins/catalog.rb, every data/working-groups/*.yml. main's #38 remapped projects between working-group files and deleted securing-critical-projects-wg.yml and security-tooling.yml, while this branch had edited every record. Resolution takes main's roster, record order and working-group urls as the base and re-applies this branch's record edits on top: `url:` dropped from every record, `insights:` placed after `name:` with the value that keys data/generated/insights.json, the working-group description added, and the header comment carried over. Records main added (ampel, bomhort, darnit, openvex, privateer, osv-schema) get the openssf.org project page this branch requires; cve-bin-tool has none yet and uses the same technical-initiatives placeholder as the other pageless records. osv-openvex's Security Insights target moves to osv-schema, which main split it into. The five records main dropped (fuzzingbrain, in-toto, slsa-github-generator, slsa-verifier, osv-openvex) stay dropped; main's project list is authoritative. Makefile and catalog.rb are unions; theme/_plugins also gets the rubocop autocorrections main's new `make lint` demands. Signed-off-by: Eddie Knight <knight@linux.com>
eddie-knight
marked this pull request as ready for review
October 9, 2026 19:49
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.