Hook up the front end
This commit is contained in:
Justin Hutchings
@@ -16,55 +16,142 @@ import dotenv from 'dotenv'
|
||||
import { Context } from '@actions/github/lib/context'
|
||||
import { unmockedModulePathPatterns } from './jest.config'
|
||||
dotenv.config();
|
||||
export default class ComponentDetection {
|
||||
private componentDetectionPath = './component-detection';
|
||||
private outputPath = './output.json';
|
||||
|
||||
export const componentDetectionPath = './component-detection';
|
||||
const outputPath = './output.json';
|
||||
dependencyGraphs: {
|
||||
manifest: {
|
||||
graph: {
|
||||
dependencies: [],
|
||||
},
|
||||
explicitlyReferencedComponentIds: [],
|
||||
developmentDependencies: [],
|
||||
dependencies: []
|
||||
// This is the default entry point for this class.
|
||||
static async scanAndGetManifests(path: string): Promise<Manifest[] | undefined> {
|
||||
await this.downloadLatestRelease();
|
||||
await this.runComponentDetection(path);
|
||||
return await this.getManifestsFromResults();
|
||||
}
|
||||
// Get the latest release from the component-detection repo, download the tarball, and extract it
|
||||
private static async downloadLatestRelease() {
|
||||
try {
|
||||
const downloadURL = await getLatestReleaseURL();
|
||||
const blob = await (await fetch(new URL(downloadURL))).blob();
|
||||
const arrayBuffer = await blob.arrayBuffer();
|
||||
const buffer = Buffer.from(arrayBuffer);
|
||||
|
||||
// Write the blob to a file
|
||||
await fs.writeFile(componentDetectionPath, buffer, {mode: 0o777, flag: 'w'},
|
||||
(err: any) => {
|
||||
if (err) {
|
||||
core.error(err);
|
||||
}
|
||||
});
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
}
|
||||
}
|
||||
|
||||
// Run the component-detection CLI on the path specified
|
||||
private static async runComponentDetection(path: string) {
|
||||
try {
|
||||
await exec.exec(`${componentDetectionPath} scan --SourceDirectory ${path} --ManifestFile ${outputPath}`);
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
}
|
||||
}
|
||||
|
||||
private static async getManifestsFromResults(): Promise<Manifest[]| undefined> {
|
||||
|
||||
try {
|
||||
// Parse the result file and add the packages to the package cache
|
||||
const packageCache = new PackageCache();
|
||||
const packages: Array<ComponentDetectionPackage>= [];
|
||||
|
||||
const results = await fs.readFileSync(outputPath, 'utf8');
|
||||
|
||||
var json: any = JSON.parse(results);
|
||||
json.componentsFound.forEach(async (component: any) => {
|
||||
const packageUrl = makePackageUrl(component.component.packageUrl);
|
||||
|
||||
if (!packageCache.hasPackage(packageUrl)) {
|
||||
const pkg = new ComponentDetectionPackage(packageUrl, component.component.id,
|
||||
component.isDevelopmentDependency,component.topLevelReferrers,component.locationsFoundAt, component.containerDetailIds, component.containerLayerIds);
|
||||
packageCache.addPackage(pkg);
|
||||
packages.push(pkg);
|
||||
}
|
||||
});
|
||||
|
||||
// Set the transitive dependencies
|
||||
packages.forEach(async (pkg: ComponentDetectionPackage) => {
|
||||
pkg.toplevelReferrers.forEach(async (referrer: any) => {
|
||||
const referrerPackage = packageCache.lookupPackage(makePackageUrl(referrer.packageUrl));
|
||||
if (referrerPackage) {
|
||||
referrerPackage.dependsOn(pkg);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Create manifests
|
||||
const manifests: Array<Manifest> = [];
|
||||
|
||||
// Check the locationsFoundAt for every package and add each as a manifest
|
||||
packages.forEach(async (pkg: ComponentDetectionPackage) => {
|
||||
pkg.locationsFoundAt.forEach(async (location: any) => {
|
||||
if (!manifests[location.filePath]) {
|
||||
const manifest = new Manifest(location.filePath, location.filePath);
|
||||
manifests.push(manifest);
|
||||
}
|
||||
if (pkg.toplevelReferrers.length == 0) {
|
||||
manifests.find((manifest: Manifest) => manifest.file == location.filePath)?.addDirectDependency(pkg, getDependencyScope(pkg));
|
||||
} else {
|
||||
manifests.find((manifest: Manifest) => manifest.file == location.filePath)?.addIndirectDependency(pkg, getDependencyScope(pkg)); }
|
||||
});
|
||||
});
|
||||
core.debug(JSON.stringify(manifests));
|
||||
return manifests;
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
private static getDependencyScope(pkg: ComponentDetectionPackage) {
|
||||
return pkg.isDevelopmentDependency ? 'development' : 'runtime'
|
||||
}
|
||||
|
||||
private static makePackageUrl(packageUrlJson: any): string {
|
||||
var packageUrl = `${packageUrlJson.Scheme}:${packageUrlJson.Type}/`;
|
||||
if (packageUrlJson.Namespace) {
|
||||
packageUrl += `${packageUrlJson.Namespace.replace("@", "%40")}/`;
|
||||
}
|
||||
packageUrl += `${packageUrlJson.Name.replace("@", "%40")}`;
|
||||
if (packageUrlJson.Version) {
|
||||
packageUrl += `@${packageUrlJson.Version}`;
|
||||
}
|
||||
if (packageUrlJson.Qualifiers) {
|
||||
packageUrl += `?${packageUrlJson.Qualifiers}`;
|
||||
}
|
||||
return packageUrl;
|
||||
}
|
||||
|
||||
private static getLatestReleaseURL(): Promise<string> {
|
||||
const githubToken = core.getInput('token') || process.env.GITHUB_TOKEN2 || "";
|
||||
const octokit = github.getOctokit(githubToken);
|
||||
const owner = "microsoft";
|
||||
const repo = "component-detection";
|
||||
|
||||
const latestRelease = await octokit.rest.repos.getLatestRelease({
|
||||
owner, repo
|
||||
});
|
||||
|
||||
var downloadURL: string = "";
|
||||
latestRelease.data.assets.forEach((asset: any) => {
|
||||
if (asset.name === "component-detection-linux-x64") {
|
||||
downloadURL = asset.browser_download_url;
|
||||
}
|
||||
},
|
||||
componentsFound: [
|
||||
{
|
||||
locationsFoundAt: [
|
||||
filePath: string
|
||||
],
|
||||
component: {
|
||||
name: string,
|
||||
version: string,
|
||||
hash: string,
|
||||
author: string,
|
||||
type: string,
|
||||
id: string,
|
||||
packageUrl: {
|
||||
Scheme: string,
|
||||
Type: string,
|
||||
Namespace: string,
|
||||
Name: string,
|
||||
Version: string,
|
||||
Qualifiers: string,
|
||||
Subpath: string
|
||||
},
|
||||
},
|
||||
detectorId: string,
|
||||
isDevelopmentDependency: boolean,
|
||||
dependencyScope: string,
|
||||
topLevelReferrers: [],
|
||||
containerDetailIds: [],
|
||||
containerLayerIds: []
|
||||
}
|
||||
],
|
||||
detectorsInScan: [],
|
||||
sourceDirectory: string,
|
||||
};
|
||||
*/
|
||||
});
|
||||
|
||||
return downloadURL;
|
||||
}
|
||||
}
|
||||
|
||||
class ComponentDetectionPackage extends Package {
|
||||
|
||||
constructor(packageUrl: string, id: string, isDevelopmentDependency:boolean, topLevelReferrers: [],
|
||||
locationsFoundAt: [], containerDetailIds: [], containerLayerIds: []) {
|
||||
super(packageUrl);
|
||||
@@ -84,129 +171,11 @@ class ComponentDetectionPackage extends Package {
|
||||
}
|
||||
|
||||
|
||||
// Get the latest release from the component-detection repo, download the tarball, and extract it
|
||||
export async function downloadLatestRelease() {
|
||||
try {
|
||||
const downloadURL = await getLatestReleaseURL();
|
||||
const blob = await (await fetch(new URL(downloadURL))).blob();
|
||||
const arrayBuffer = await blob.arrayBuffer();
|
||||
const buffer = Buffer.from(arrayBuffer);
|
||||
|
||||
// Write the blob to a file
|
||||
await fs.writeFile(componentDetectionPath, buffer, {mode: 0o777, flag: 'w'},
|
||||
(err: any) => {
|
||||
if (err) {
|
||||
core.error(err);
|
||||
}
|
||||
});
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
}
|
||||
}
|
||||
|
||||
// Run the component-detection CLI on the path specified
|
||||
export async function runComponentDetection(path: string) {
|
||||
try {
|
||||
await exec.exec(`${componentDetectionPath} scan --SourceDirectory ${path} --ManifestFile ${outputPath}`);
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
export async function getManifestsFromResults(): Promise<Manifest[]| undefined> {
|
||||
|
||||
try {
|
||||
// Parse the result file and add the packages to the package cache
|
||||
const packageCache = new PackageCache();
|
||||
const packages: Array<ComponentDetectionPackage>= [];
|
||||
|
||||
const results = await fs.readFileSync(outputPath, 'utf8');
|
||||
|
||||
var json: any = JSON.parse(results);
|
||||
json.componentsFound.forEach(async (component: any) => {
|
||||
const packageUrl = makePackageUrl(component.component.packageUrl);
|
||||
|
||||
if (!packageCache.hasPackage(packageUrl)) {
|
||||
const pkg = new ComponentDetectionPackage(packageUrl, component.component.id,
|
||||
component.isDevelopmentDependency,component.topLevelReferrers,component.locationsFoundAt, component.containerDetailIds, component.containerLayerIds);
|
||||
packageCache.addPackage(pkg);
|
||||
packages.push(pkg);
|
||||
}
|
||||
});
|
||||
|
||||
// Set the transitive dependencies
|
||||
packages.forEach(async (pkg: ComponentDetectionPackage) => {
|
||||
pkg.toplevelReferrers.forEach(async (referrer: any) => {
|
||||
const referrerPackage = packageCache.lookupPackage(makePackageUrl(referrer.packageUrl));
|
||||
if (referrerPackage) {
|
||||
referrerPackage.dependsOn(pkg);
|
||||
}
|
||||
});
|
||||
});
|
||||
|
||||
// Create manifests
|
||||
const manifests: Array<Manifest> = [];
|
||||
|
||||
// Check the locationsFoundAt for every package and add each as a manifest
|
||||
packages.forEach(async (pkg: ComponentDetectionPackage) => {
|
||||
pkg.locationsFoundAt.forEach(async (location: any) => {
|
||||
if (!manifests[location.filePath]) {
|
||||
const manifest = new Manifest(location.filePath, location.filePath);
|
||||
manifests.push(manifest);
|
||||
}
|
||||
if (pkg.toplevelReferrers.length == 0) {
|
||||
manifests.find((manifest: Manifest) => manifest.file == location.filePath)?.addDirectDependency(pkg, getDependencyScope(pkg));
|
||||
} else {
|
||||
manifests.find((manifest: Manifest) => manifest.file == location.filePath)?.addIndirectDependency(pkg, getDependencyScope(pkg)); }
|
||||
});
|
||||
});
|
||||
core.debug(JSON.stringify(manifests));
|
||||
return manifests;
|
||||
} catch (error: any) {
|
||||
core.error(error);
|
||||
return undefined;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
|
||||
function getDependencyScope(pkg: ComponentDetectionPackage) {
|
||||
return pkg.isDevelopmentDependency ? 'development' : 'runtime'
|
||||
}
|
||||
|
||||
function makePackageUrl(packageUrlJson: any): string {
|
||||
var packageUrl = `${packageUrlJson.Scheme}:${packageUrlJson.Type}/`;
|
||||
if (packageUrlJson.Namespace) {
|
||||
packageUrl += `${packageUrlJson.Namespace.replace("@", "%40")}/`;
|
||||
}
|
||||
packageUrl += `${packageUrlJson.Name.replace("@", "%40")}`;
|
||||
if (packageUrlJson.Version) {
|
||||
packageUrl += `@${packageUrlJson.Version}`;
|
||||
}
|
||||
if (packageUrlJson.Qualifiers) {
|
||||
packageUrl += `?${packageUrlJson.Qualifiers}`;
|
||||
}
|
||||
return packageUrl;
|
||||
}
|
||||
|
||||
async function getLatestReleaseURL(): Promise<string> {
|
||||
const githubToken = core.getInput('token') || process.env.GITHUB_TOKEN2 || "";
|
||||
const octokit = github.getOctokit(githubToken);
|
||||
const owner = "microsoft";
|
||||
const repo = "component-detection";
|
||||
|
||||
const latestRelease = await octokit.rest.repos.getLatestRelease({
|
||||
owner, repo
|
||||
});
|
||||
|
||||
var downloadURL: string = "";
|
||||
latestRelease.data.assets.forEach((asset: any) => {
|
||||
if (asset.name === "component-detection-linux-x64") {
|
||||
downloadURL = asset.browser_download_url;
|
||||
}
|
||||
});
|
||||
|
||||
return downloadURL;
|
||||
}
|
||||
Reference in New Issue
Block a user