[ { "path": ".binny.yaml", "content": "tools:\n # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)\n - name: binny\n version:\n want: v0.12.0\n method: github-release\n with:\n repo: anchore/binny\n\n # used to produce SBOMs during release\n - name: syft\n version:\n want: latest\n method: github-release\n with:\n repo: anchore/syft\n\n # used to sign mac binaries at release\n - name: quill\n version:\n want: v0.7.1\n method: github-release\n with:\n repo: anchore/quill\n\n # used for linting\n - name: golangci-lint\n version:\n want: v2.11.3\n method: github-release\n with:\n repo: golangci/golangci-lint\n\n # used for showing the changelog at release\n - name: glow\n version:\n want: v2.1.1\n method: github-release\n with:\n repo: charmbracelet/glow\n\n # used for signing the checksums file at release\n - name: cosign\n version:\n want: v3.0.5\n method: github-release\n with:\n repo: sigstore/cosign\n\n # used in integration tests to verify JSON schemas\n - name: yajsv\n version:\n want: v1.4.1\n method: github-release\n with:\n repo: neilpa/yajsv\n\n # used to release all artifacts\n - name: goreleaser\n version:\n want: v2.14.3\n method: github-release\n with:\n repo: goreleaser/goreleaser\n\n # used for organizing imports during static analysis\n - name: gosimports\n version:\n want: v0.3.8\n method: github-release\n with:\n repo: rinchsan/gosimports\n\n # used at release to generate the changelog\n - name: chronicle\n version:\n want: v0.8.0\n method: github-release\n with:\n repo: anchore/chronicle\n\n # used during static analysis for license compliance\n - name: bouncer\n version:\n want: v0.4.0\n method: github-release\n with:\n repo: wagoodman/go-bouncer\n\n # used for running all local and CI tasks\n - name: task\n version:\n want: v3.49.1\n method: github-release\n with:\n repo: go-task/task\n\n # used for triggering a release\n - name: gh\n version:\n want: v2.88.1\n method: github-release\n with:\n repo: cli/cli\n\n # used to upload test fixture cache\n - name: oras\n version:\n want: v1.3.1\n method: github-release\n with:\n repo: oras-project/oras\n\n # used to upload test fixture cache\n - name: yq\n version:\n want: v4.52.4\n method: github-release\n with:\n repo: mikefarah/yq\n" }, { "path": ".bouncer.yaml", "content": "permit:\n - BSD.*\n - CC0.*\n - MIT.*\n - Apache.*\n - MPL.*\n - ISC\n - WTFPL\n - Unlicense\n\nignore-packages:\n # https://github.com/sorairolake/lzip-go/blob/34a2615d2abf740175c6b0a835baa08364e09430/go.sum.license#L3\n # has `SPDX-License-Identifier: Apache-2.0 OR MIT`, both of which are acceptable\n - github.com/sorairolake/lzip-go\n # packageurl-go is released under the MIT license located in the root of the repo at /mit.LICENSE\n - github.com/anchore/packageurl-go\n\n # both of these dependencies are specified as Apache-2.0 in their respective GitHub READMEs\n - github.com/alibabacloud-go/cr-20160607/client\n - github.com/alibabacloud-go/tea-xml/service\n\n # crypto/internal/boring is released under the openSSL license as a part of the Golang Standard Libary\n - crypto/internal/boring\n\n # from: https://github.com/spdx/tools-golang/blob/main/LICENSE.code\n # The tools-golang source code is provided and may be used, at your option,\n # under either:\n # * Apache License, version 2.0 (Apache-2.0), OR\n # * GNU General Public License, version 2.0 or later (GPL-2.0-or-later).\n # (we choose Apache-2.0)\n - github.com/spdx/tools-golang\n\n # from: https://github.com/xi2/xz/blob/master/LICENSE\n # All these files have been put into the public domain.\n # You can do whatever you want with these files.\n - github.com/xi2/xz\n\n # from: https://gitlab.com/cznic/sqlite/-/blob/v1.15.4/LICENSE\n # This is a BSD-3-Clause license\n - modernc.org/libc\n - modernc.org/libc/errno\n - modernc.org/libc/fcntl\n - modernc.org/libc/fts\n - modernc.org/libc/grp\n - modernc.org/libc/langinfo\n - modernc.org/libc/limits\n - modernc.org/libc/netdb\n - modernc.org/libc/netinet/in\n - modernc.org/libc/poll\n - modernc.org/libc/pthread\n - modernc.org/libc/pwd\n - modernc.org/libc/signal\n - modernc.org/libc/stdio\n - modernc.org/libc/stdlib\n - modernc.org/libc/sys/socket\n - modernc.org/libc/sys/stat\n - modernc.org/libc/sys/types\n - modernc.org/libc/termios\n - modernc.org/libc/time\n - modernc.org/libc/unistd\n - modernc.org/libc/utime\n - modernc.org/libc/uuid/uuid\n - modernc.org/libc/wctype\n - modernc.org/mathutil\n - modernc.org/memory\n" }, { "path": ".chronicle.yaml", "content": "enforce-v0: false\ntitle: \"\"\n\ngithub:\n host: github.com\n include-issue-pr-authors: true\n include-issue-prs: true\n include-issues-not-planned: false\n include-prs: true\n include-issues: true\n include-unlabeled-issues: true\n include-unlabeled-prs: true\n issues-require-linked-prs: false\n consider-pr-merge-commits: true\n\n exclude-labels:\n - duplicate\n - question\n - invalid\n - wontfix\n - wont-fix\n - release-ignore\n - changelog-ignore\n - ignore\n\n changes:\n\n - name: security-fixes\n title: Security Fixes\n semver-field: patch\n labels:\n - security\n - vulnerability\n\n - name: added-feature\n title: Added Features\n semver-field: minor\n labels:\n - enhancement\n - feature\n - minor\n\n - name: bug-fix\n title: Bug Fixes\n semver-field: patch\n labels:\n - bug\n - fix\n - bug-fix\n - patch\n\n - name: breaking-feature\n title: Breaking Changes\n semver-field: major\n labels:\n - breaking\n - backwards-incompatible\n - breaking-change\n - breaking-feature\n - major\n - detected-breaking-change\n\n - name: removed-feature\n title: Removed Features\n semver-field: major\n labels:\n - removed\n\n - name: deprecated-feature\n title: Deprecated Features\n semver-field: minor\n labels:\n - deprecated\n\n - name: unknown\n title: Additional Changes\n semver-field: \"\"\n labels: []\n" }, { "path": ".github/ISSUE_TEMPLATE/bug_report.md", "content": "---\nname: Bug report\nabout: Create a report to help us improve\ntitle: ''\nlabels: bug\nassignees: ''\n\n---\n\n**What happened**:\n\n**What you expected to happen**:\n\n**Steps to reproduce the issue**:\n\n**Anything else we need to know?**:\n\n**Environment**:\n- Output of `syft version`:\n- OS (e.g: `cat /etc/os-release` or similar):\n" }, { "path": ".github/ISSUE_TEMPLATE/config.yml", "content": "contact_links:\n\n - name: Join our Discourse community šŸ’¬\n # link to our community Discourse site\n url: https://anchore.com/discourse\n about: 'Come chat with us! Ask for help, join our software development efforts, or just give us feedback!'\n" }, { "path": ".github/ISSUE_TEMPLATE/feature_request.md", "content": "---\nname: Feature request\nabout: Suggest an idea for this project\ntitle: ''\nlabels: enhancement\nassignees: ''\n\n---\n\n**What would you like to be added**:\n\n**Why is this needed**:\n\n**Additional context**:\n\n" }, { "path": ".github/actions/bootstrap/action.yaml", "content": "name: \"Bootstrap\"\n\ndescription: \"Bootstrap all tools and dependencies\"\ninputs:\n go-version:\n description: \"Go version to install\"\n required: true\n default: \"1.26.x\"\n go-dependencies:\n description: \"Download go dependencies\"\n required: true\n default: \"true\"\n cache-key-prefix:\n description: \"Prefix all cache keys with this value\"\n required: true\n default: \"53ac821810\"\n download-test-fixture-cache:\n description: \"Download test fixture cache from OCI and github actions\"\n required: true\n default: \"false\"\n tools:\n description: \"whether to install tools\"\n default: \"true\"\n bootstrap-apt-packages:\n description: \"Space delimited list of tools to install via apt\"\n default: \"libxml2-utils\"\n\nruns:\n using: \"composite\"\n steps:\n # note: go mod and build is automatically cached on default with v4+\n - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0\n if: inputs.go-version != ''\n with:\n go-version: ${{ inputs.go-version }}\n check-latest: true\n\n - name: Restore tool cache\n if: inputs.tools == 'true'\n id: tool-cache\n uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3\n with:\n path: ${{ github.workspace }}/.tool\n key: ${{ inputs.cache-key-prefix }}-${{ runner.os }}-tool-${{ hashFiles('.binny.yaml') }}\n\n - name: Install project tools\n shell: bash\n if: inputs.tools == 'true'\n run: |\n make tools\n .tool/binny list\n .tool/binny check\n\n - name: Install go dependencies\n if: inputs.go-dependencies == 'true'\n shell: bash\n run: make ci-bootstrap-go\n\n - name: Install apt packages\n if: inputs.bootstrap-apt-packages != ''\n shell: bash\n env:\n APT_PACKAGES: ${{ inputs.bootstrap-apt-packages }}\n run: |\n IFS=' ' read -ra packages <<< \"$APT_PACKAGES\"\n DEBIAN_FRONTEND=noninteractive sudo apt update && sudo -E apt install -y \"${packages[@]}\"\n\n - name: Restore ORAS cache from github actions\n if: inputs.download-test-fixture-cache == 'true'\n uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3\n with:\n path: ${{ github.workspace }}/.tmp/oras-cache\n key: ${{ inputs.cache-key-prefix }}-oras-cache\n\n - name: Download test fixture cache\n if: inputs.download-test-fixture-cache == 'true'\n shell: bash\n run: make download-test-fixture-cache\n" }, { "path": ".github/dependabot.yml", "content": "# Dependabot configuration\n#\n# Grouping behavior (see inline comments for details):\n# - Minor + patch updates: grouped into a single PR per ecosystem\n# - Major version bumps: individual PR per dependency\n# - Security updates: individual PR per dependency\n#\n# Note: \"patch\" refers to semver version bumps (1.2.3 -> 1.2.4), not security fixes.\n# Security updates are identified separately via GitHub's Advisory Database and\n# can be any version bump (patch, minor, or major) that fixes a known CVE.\n\nversion: 2\n\nupdates:\n\n - package-ecosystem: gomod\n directory: \"/\"\n cooldown:\n default-days: 7\n schedule:\n interval: \"weekly\"\n day: \"friday\"\n open-pull-requests-limit: 10\n labels:\n - \"dependencies\"\n groups:\n go-minor-patch:\n applies-to: version-updates # security updates get individual PRs\n patterns:\n - \"*\"\n update-types: # major omitted, gets individual PRs\n - \"minor\"\n - \"patch\"\n\n - package-ecosystem: \"github-actions\"\n directories:\n - \"/\"\n - \"/.github/actions/bootstrap\"\n cooldown:\n default-days: 7\n schedule:\n interval: \"weekly\"\n day: \"friday\"\n open-pull-requests-limit: 10\n labels:\n - \"dependencies\"\n groups:\n actions-minor-patch:\n applies-to: version-updates # security updates get individual PRs\n patterns:\n - \"*\"\n update-types: # major omitted, gets individual PRs\n - \"minor\"\n - \"patch\"\n" }, { "path": ".github/pull_request_template.md", "content": "## Description\n\n\n\n\n\n\n\n## Type of change\n\n\n\n- [ ] Bug fix (non-breaking change which fixes an issue)\n- [ ] New feature (non-breaking change which adds functionality)\n- [ ] Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)\n- [ ] Documentation (updates the documentation)\n- [ ] Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)\n- [ ] Performance (make Syft run faster or use less memory, without changing visible behavior much)\n\n## Checklist\n\n- [ ] I have added unit tests that cover changed behavior\n- [ ] I have tested my code in common scenarios and confirmed there are no regressions\n- [ ] I have added comments to my code, particularly in hard-to-understand sections\n\n## Issue references\n\n\n" }, { "path": ".github/scripts/capability-drift-check.sh", "content": "#!/usr/bin/env bash\nset -u\n\nif [ \"$(git status --porcelain | wc -l)\" -ne \"0\" ]; then\n echo \" šŸ”“ there are uncommitted changes, please commit them before running this check\"\n exit 1\nfi\n\nif ! make generate-capabilities REFRESH=false; then\n echo \"Generating capability descriptions failed\"\n exit 1\nfi\n\nif [ \"$(git status --porcelain | wc -l)\" -ne \"0\" ]; then\n echo \" šŸ”“ there is drift in capability descriptions! Please run 'make generate-capabilities' and commit the changes.\"\n exit 1\nfi" }, { "path": ".github/scripts/check_binary_fixture_size.sh", "content": "#!/bin/bash\n\n# current limit for fixture size\nsize=1000\n\nif [ $# -eq 0 ]; then\n echo \"Usage: $0 \"\n exit 1\nfi\n\ndirectory=\"$1\"\n\n# Remove trailing slash using parameter expansion\ndirectory=\"${directory%/}\"\n\nif [ ! -d \"$directory\" ]; then\n echo \"Directory not found: $directory\"\n exit 1\nfi\n\nfound_large_files=0\nwhile IFS= read -r -d '' file; do\n if [ $(wc -c < \"$file\") -gt $size ]; then\n echo \"File $file is greater than ${size} bytes.\"\n found_large_files=1\n fi\ndone < <(git ls-files -z \"$directory\")\n\nif [ \"$found_large_files\" -eq 1 ]; then\n echo \"Script failed: Some files are greater than ${size} bytes.\"\n exit 1\nelse\n echo \"All files in $directory and its subdirectories are ${size} bytes or smaller. Check passed.\"\n exit 0\nfi\n\n" }, { "path": ".github/scripts/ci-check.sh", "content": "#!/usr/bin/env bash\n\nred=$(tput setaf 1)\nbold=$(tput bold)\nnormal=$(tput sgr0)\n\n# assert we are running in CI (or die!)\nif [[ -z \"$CI\" ]]; then\n echo \"${bold}${red}This step should ONLY be run in CI. Exiting...${normal}\"\n exit 1\nfi\n" }, { "path": ".github/scripts/coverage.py", "content": "#!/usr/bin/env python3\nimport subprocess\nimport sys\nimport shlex\n\n\nclass bcolors:\n HEADER = '\\033[95m'\n OKBLUE = '\\033[94m'\n OKCYAN = '\\033[96m'\n OKGREEN = '\\033[92m'\n WARNING = '\\033[93m'\n FAIL = '\\033[91m'\n ENDC = '\\033[0m'\n BOLD = '\\033[1m'\n UNDERLINE = '\\033[4m'\n\n\nif len(sys.argv) < 3:\n print(\"Usage: coverage.py [threshold] [go-coverage-report]\")\n sys.exit(1)\n\n\nthreshold = float(sys.argv[1])\nreport = sys.argv[2]\n\n\nargs = shlex.split(f\"go tool cover -func {report}\")\np = subprocess.run(args, capture_output=True, text=True)\n\npercent_coverage = float(p.stdout.splitlines()[-1].split()[-1].replace(\"%\", \"\"))\nprint(f\"{bcolors.BOLD}Coverage: {percent_coverage}%{bcolors.ENDC}\")\n\nif percent_coverage < threshold:\n print(f\"{bcolors.BOLD}{bcolors.FAIL}Coverage below threshold of {threshold}%{bcolors.ENDC}\")\n sys.exit(1)\n" }, { "path": ".github/scripts/find_cache_paths.py", "content": "#!/usr/bin/env python3\nfrom __future__ import annotations\n\nimport os\nimport glob\nimport sys\nimport json\nimport hashlib\n\n\nIGNORED_PREFIXES = []\n\n\ndef find_fingerprints_and_check_dirs(base_dir):\n all_fingerprints = set(glob.glob(os.path.join(base_dir, '**', 'test*', '**', '*.fingerprint'), recursive=True))\n\n all_fingerprints = {os.path.relpath(fp) for fp in all_fingerprints\n if not any(fp.startswith(prefix) for prefix in IGNORED_PREFIXES)}\n\n if not all_fingerprints:\n show(\"No .fingerprint files or cache directories found.\")\n exit(1)\n\n missing_content = []\n valid_paths = set()\n fingerprint_contents = []\n\n for fingerprint in all_fingerprints:\n path = fingerprint.replace('.fingerprint', '')\n\n if not os.path.exists(path):\n missing_content.append(path)\n continue\n\n if not os.path.isdir(path):\n valid_paths.add(path)\n continue\n\n if os.listdir(path):\n valid_paths.add(path)\n else:\n missing_content.append(path)\n\n with open(fingerprint, 'r') as f:\n content = f.read().strip()\n fingerprint_contents.append((fingerprint, content))\n\n return sorted(valid_paths), missing_content, fingerprint_contents\n\n\ndef parse_fingerprint_contents(fingerprint_content):\n input_map = {}\n for line in fingerprint_content.splitlines():\n digest, path = line.split()\n input_map[path] = digest\n return input_map\n\n\ndef calculate_sha256(fingerprint_contents):\n sorted_fingerprint_contents = sorted(fingerprint_contents, key=lambda x: x[0])\n\n concatenated_contents = ''.join(content for _, content in sorted_fingerprint_contents)\n\n sha256_hash = hashlib.sha256(concatenated_contents.encode()).hexdigest()\n\n return sha256_hash\n\n\ndef calculate_file_sha256(file_path):\n sha256_hash = hashlib.sha256()\n with open(file_path, 'rb') as f:\n for byte_block in iter(lambda: f.read(4096), b\"\"):\n sha256_hash.update(byte_block)\n return sha256_hash.hexdigest()\n\n\ndef show(*s: str):\n print(*s, file=sys.stderr)\n\n\ndef main(file_path: str | None):\n base_dir = '.'\n valid_paths, missing_content, fingerprint_contents = find_fingerprints_and_check_dirs(base_dir)\n\n if missing_content:\n show(\"The following paths are missing or have no content, but have corresponding .fingerprint files:\")\n for path in sorted(missing_content):\n show(f\"- {path}\")\n # when adding new cache directories there is a time where it is not possible to have this directory without\n # running the tests first... but this step is a prerequisite for running the tests. We should not block on this.\n # show(\"Please ensure these paths exist and have content if they are directories.\")\n # exit(1)\n\n sha256_hash = calculate_sha256(fingerprint_contents)\n\n paths_with_digests = []\n for path in sorted(valid_paths):\n fingerprint_file = f\"{path}.fingerprint\"\n try:\n if os.path.exists(fingerprint_file):\n file_digest = calculate_file_sha256(fingerprint_file)\n\n # Parse the fingerprint file to get the digest/path tuples\n with open(fingerprint_file, 'r') as f:\n fingerprint_content = f.read().strip()\n input_map = parse_fingerprint_contents(fingerprint_content)\n\n paths_with_digests.append({\n \"path\": path,\n \"digest\": file_digest,\n \"input\": input_map\n })\n\n except Exception as e:\n show(f\"Error processing {fingerprint_file}: {e}\")\n raise e\n\n\n output = {\n \"digest\": sha256_hash,\n \"paths\": paths_with_digests\n }\n\n content = json.dumps(output, indent=2, sort_keys=True)\n\n if file_path:\n with open(file_path, 'w') as f:\n f.write(content)\n\n print(content)\n\n\nif __name__ == \"__main__\":\n file_path = None\n if len(sys.argv) > 1:\n file_path = sys.argv[1]\n main(file_path)\n" }, { "path": ".github/scripts/fingerprint_docker_fixtures.py", "content": "#!/usr/bin/env python3\n\nimport os\nimport subprocess\nimport hashlib\n\nBOLD = '\\033[1m'\nYELLOW = '\\033[0;33m'\nRESET = '\\033[0m'\n\n\ndef print_message(message):\n print(f\"{YELLOW}{message}{RESET}\")\n\n\ndef sha256sum(filepath):\n h = hashlib.sha256()\n with open(filepath, 'rb') as f:\n for chunk in iter(lambda: f.read(4096), b\"\"):\n h.update(chunk)\n return h.hexdigest()\n\n\ndef is_git_tracked_or_untracked(directory):\n \"\"\"Returns a sorted list of files in the directory that are tracked or not ignored by Git.\"\"\"\n result = subprocess.run(\n [\"git\", \"ls-files\", \"--cached\", \"--others\", \"--exclude-standard\"],\n cwd=directory,\n stdout=subprocess.PIPE,\n text=True\n )\n return sorted(result.stdout.strip().splitlines())\n\n\ndef find_test_fixture_dirs_with_images(base_dir):\n \"\"\"Find directories that contain 'testdata' and at least one 'image-*' directory.\"\"\"\n for root, dirs, files in os.walk(base_dir):\n if 'testdata' in root:\n image_dirs = [d for d in dirs if d.startswith('image-')]\n if image_dirs:\n yield os.path.realpath(root)\n\n\ndef generate_fingerprints():\n print_message(\"creating fingerprint files for docker fixtures...\")\n\n for test_fixture_dir in find_test_fixture_dirs_with_images('.'):\n cache_fingerprint_path = os.path.join(test_fixture_dir, 'cache.fingerprint')\n\n with open(cache_fingerprint_path, 'w') as fingerprint_file:\n for image_dir in find_image_dirs(test_fixture_dir):\n for file in is_git_tracked_or_untracked(image_dir):\n file_path = os.path.join(image_dir, file)\n checksum = sha256sum(file_path)\n path_from_fixture_dir = os.path.relpath(file_path, test_fixture_dir)\n fingerprint_file.write(f\"{checksum} {path_from_fixture_dir}\\n\")\n\n\ndef find_image_dirs(test_fixture_dir):\n \"\"\"Find all 'image-*' directories inside a given test-fixture directory.\"\"\"\n result = []\n for root, dirs, files in os.walk(test_fixture_dir):\n for dir_name in dirs:\n if dir_name.startswith('image-'):\n result.append(os.path.join(root, dir_name))\n return sorted(result)\n\n\nif __name__ == \"__main__\":\n generate_fingerprints()\n" }, { "path": ".github/scripts/go-mod-tidy-check.sh", "content": "#!/usr/bin/env bash\nset -eu\n\nORIGINAL_STATE_DIR=$(mktemp -d \"TEMP-original-state-XXXXXXXXX\")\nTIDY_STATE_DIR=$(mktemp -d \"TEMP-tidy-state-XXXXXXXXX\")\n\ntrap \"cp -p ${ORIGINAL_STATE_DIR}/* ./ && git update-index -q --refresh && rm -fR ${ORIGINAL_STATE_DIR} ${TIDY_STATE_DIR}\" EXIT\n\n# capturing original state of files...\ncp go.mod go.sum \"${ORIGINAL_STATE_DIR}\"\n\n# capturing state of go.mod and go.sum after running go mod tidy...\ngo mod tidy\ncp go.mod go.sum \"${TIDY_STATE_DIR}\"\n\nset +e\n\n# detect difference between the git HEAD state and the go mod tidy state\nDIFF_MOD=$(diff -u \"${ORIGINAL_STATE_DIR}/go.mod\" \"${TIDY_STATE_DIR}/go.mod\")\nDIFF_SUM=$(diff -u \"${ORIGINAL_STATE_DIR}/go.sum\" \"${TIDY_STATE_DIR}/go.sum\")\n\nif [[ -n \"${DIFF_MOD}\" || -n \"${DIFF_SUM}\" ]]; then\n echo \"go.mod diff:\"\n echo \"${DIFF_MOD}\"\n echo \"go.sum diff:\"\n echo \"${DIFF_SUM}\"\n echo \"\"\n printf \"FAILED! go.mod and/or go.sum are NOT tidy; please run 'go mod tidy'.\\n\\n\"\n exit 1\nfi\n" }, { "path": ".github/scripts/json-schema-drift-check.sh", "content": "#!/usr/bin/env bash\nset -u\n\nif [ \"$(git status --porcelain | wc -l)\" -ne \"0\" ]; then\n echo \" šŸ”“ there are uncommitted changes, please commit them before running this check\"\n exit 1\nfi\n\nif ! make generate-json-schema; then\n echo \"Generating json schema failed\"\n exit 1\nfi\n\nif [ \"$(git status --porcelain | wc -l)\" -ne \"0\" ]; then\n echo \" šŸ”“ there is drift in json schema! Please run 'make generate-json-schema' and commit the changes.\"\n exit 1\nfi\n" }, { "path": ".github/scripts/labeler.py", "content": "#!/usr/bin/env python3\n\nfrom __future__ import annotations\n\nimport sys\nimport glob\nimport subprocess\nimport os\nimport re\n\nDRY_RUN = False\n\nJSON_SCHEMA_LABEL = \"json-schema\"\n\n# note: we can't use \"breaking-change\" as the label since that might be applied manually by a user. This is a\n# distinct label that we can use to indicate that the label was applied (or removed) by automation.\nBREAKING_CHANGE_LABEL = \"detected-breaking-change\"\n\n\ndef main(changed_files: str | None = None, merge_base_schema_files: str | None = None):\n global DRY_RUN\n\n pr_number = os.environ.get(\"GITHUB_PR_NUMBER\")\n comment_file_path = os.environ.get(\"CI_COMMENT_FILE\")\n\n if not comment_file_path:\n print(\"CI_COMMENT_FILE not set\")\n sys.exit(1)\n\n if not pr_number:\n DRY_RUN = True\n\n if changed_files:\n DRY_RUN = True\n\n # read lines from file... this is useful for local testing\n with open(changed_files) as f:\n pr_changed_files = f.read().splitlines()\n\n with open(merge_base_schema_files) as f:\n og_json_schema_files = sort_json_schema_files(f.read().splitlines())\n\n else:\n if not is_ci():\n print(\"Not in CI\")\n sys.exit(1)\n\n if not pr_number:\n print(\"Not a PR\")\n sys.exit(1)\n\n pr_changed_files = get_pr_changed_files(pr_number)\n # since we are running this in the context of the pull_request_target, the checkout is the merge base..\n # that is the main branch of the original repo, NOT the branch in the forked repo (or branch in the target \n # repo for non-forked PRs). This means we just need to list the current checkedout files to get a sense of\n # the changes before a merge.\n og_json_schema_files = list_json_schema_files()\n\n pr_json_schema_files = filter_to_schema_files(pr_changed_files)\n\n pr_labels = get_pr_labels(pr_number)\n\n # print(\"schema files in pr: \", summarize_schema_files(pr_json_schema_files))\n # print(\"og schema files: \", summarize_schema_files(og_json_schema_files))\n\n if not og_json_schema_files:\n print(\"No schema files found in merge base\")\n sys.exit(1)\n\n # pr_json_schema_files = set of PR files are added, removed, and changed files\n new_schema_files = set(pr_json_schema_files) - set(og_json_schema_files)\n removed_or_modified_schema_files = set(pr_json_schema_files) - set(new_schema_files)\n\n print(\"new schemas: \", summarize_schema_files(new_schema_files))\n print(\"removed or modified schemas:\", summarize_schema_files(removed_or_modified_schema_files))\n\n # if there is a new or modified schema, we should add the \"json-schema\" label to the PR...\n if new_schema_files or removed_or_modified_schema_files:\n print(\"\\nAdding json-schema label...\")\n add_label(pr_number, JSON_SCHEMA_LABEL)\n\n else:\n if JSON_SCHEMA_LABEL in pr_labels:\n remove_label(pr_number, JSON_SCHEMA_LABEL)\n\n # new schema files should be scrutinized, comparing the latest and added versions to see if it's a breaking\n # change (major version bump). Warn about it on the PR via adding a breaking-change label...\n if is_breaking_change(new_schema_files, og_json_schema_files[-1]):\n print(\"\\nBreaking change detected...\")\n add_label(pr_number, BREAKING_CHANGE_LABEL)\n else:\n if BREAKING_CHANGE_LABEL in pr_labels: \n remove_label(pr_number, BREAKING_CHANGE_LABEL)\n\n # modifying an existing schema could be a breaking change, we should warn about it on the PR via a comment...\n # removing schema files should never be allowed, we should warn about it on the PR via a comment...\n if removed_or_modified_schema_files:\n print(\"\\nRemoved or modified schema detected...\")\n schemas = sort_json_schema_files(list(removed_or_modified_schema_files))\n schemas_str = \"\\n\".join([f\" - {schema}\" for schema in schemas])\n add_comment(comment_file_path, f\"Detected modification or removal of existing json schemas:\\n{schemas_str}\", warning=True)\n\n\ndef add_comment(comment_file_path: str, comment: str, warning: bool = False, important: bool = False):\n if warning or important:\n comment_lines = comment.splitlines()\n comment = \"\\n\".join([f\"> {line}\" for line in comment_lines])\n\n if warning:\n comment = f\"> [!WARNING]\\n{comment}\" \n elif important:\n comment = f\"> [!IMPORTANT]\\n{comment}\"\n\n # create any parent directories if they don't exist\n os.makedirs(os.path.dirname(comment_file_path), exist_ok=True)\n\n with open(comment_file_path, \"w\") as f:\n f.write(comment)\n\n print(f\"Comment file contents: {comment_file_path}\")\n print(comment)\n\n\ndef add_label(pr_number: str, label: str):\n # run \"gh pr edit --add-label