chore: create a new release #476
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR adds support for the detection of Dockerfiles, so as to cover scenarios where Docker gets used as a build tool. * Docker presence is detected by finding files either named Dockerfile or in the formats *.Dockerfile or Dockerfile.* to cover different naming conventions of dockerfiles, e.g. dev.Dockerfile or like Macaron's own Dockerfile.base and Dockerfile.final. This is defined in defaults.ini under [builder.docker] * The supported build command keyword is build, and supported deploy command keyword is push, defined in defaults.ini under [builder.docker] *For CI deploy commands the GitHub action docker/build-push-action is supported, defined in defaults.ini under [builder.docker.ci.deploy] Signed-off-by: Tim Yarkov <[email protected]>
…#461) Signed-off-by: Nathan Nguyen <[email protected]>
This PR sets `encode=True` to encode qualifiers of a PURL string as a normalized string while converting it to a dictionary and storing it to the SQLite database because SQLite doesn't support dict type. It also adds exception handling for deserializing a PURL string while initializing a Component instance. Signed-off-by: behnazh-w <[email protected]>
…467) If a repository is not available for an artifact/analysis target identified by a PURL string, the `mcn_provenance_available_1` check throws an exception. This PR fixes this bug by checking if the repository is available before running the check. Signed-off-by: behnazh-w <[email protected]>
The micronaut-core release is generating provenances again and our provenance checks pass now. This PR updates the expected result for micronaut-core. Signed-off-by: behnazh-w <[email protected]>
…find the check result (#473) This PR fixes the following bug in the policy engine: Bug description: the policy test failed to apply the policy because it was using the `repo_id` instead the `component_id`, and the related check result could not be found by the policy engine. Signed-off-by: behnazh-w <[email protected]>
…to >=6.21.0,<6.84.4 (#470)
… >=3.0.0,<3.5.0 (#462)
… list (#459) GitPython 3.1.35 fixes CVE-2023-40590 and CVE-2023-41040. This PR removes these CVEs from the pip-audit ignore list. See https://github.com/gitpython-developers/GitPython/releases/tag/3.1.35 Signed-off-by: behnazh-w <[email protected]>
This PR adds a new check, `mcn_infer_artifact_pipeline_1` to detect a potential pipeline from which an artifact is published. When a verifiable provenance is found for an artifact, the result of this check can be discarded. Otherwise, we check whether a CI workflow run has automatically published the artifact. This check supports Maven artifacts built using Gradle or Maven and published on Maven Central only. Support for other registries and ecosystems will be added in the future. Signed-off-by: behnazh-w <[email protected]>
Signed-off-by: behnazh-w <[email protected]>
Signed-off-by: behnazh-w <[email protected]>
oracle-contributor-agreement
bot
added
the
OCA Verified
tromai
approved these changes
Sep 14, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.