pinner 0.0.13

Secure CI/CD workflows by pinning mutable tags to immutable SHA-1 hashes. A high-performance Rust CLI that preserves YAML formatting and comments. Supports GitHub, GitLab, Bitbucket, Forgejo, and Docker image pinning.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

use crate::error::PinnerError;
use crate::pipeline::Pipeline;
use std::path::PathBuf;

impl Pipeline {
    /// Exports an SBOM for all dependencies in the provided paths.
    pub async fn export_sbom(&self, paths: &[PathBuf]) -> Result<(), PinnerError> {
        let (tasks, _) = self.scanner.collect_tasks(paths).await?;

        #[derive(serde::Serialize)]
        struct Sbom {
            #[serde(rename = "bomFormat")]
            bom_format: String,
            #[serde(rename = "specVersion")]
            spec_version: String,
            components: Vec<Component>,
        }

        #[derive(serde::Serialize)]
        struct Component {
            name: String,
            version: String,
            #[serde(rename = "type")]
            component_type: String,
            purl: String,
        }

        let mut components = Vec::new();
        for task in tasks {
            let name = task.action.to_string();
            let version = task
                .current_tag
                .clone()
                .unwrap_or_else(|| "latest".to_string());
            let (component_type, purl) = if name.contains('/') && !name.contains('.') {
                (
                    "library",
                    format!("pkg:github/{}@{}", name, version.replace('@', "")),
                )
            } else {
                ("container", format!("pkg:oci/{}@{}", name, version))
            };

            components.push(Component {
                name,
                version,
                component_type: component_type.to_string(),
                purl,
            });
        }

        let sbom = Sbom {
            bom_format: "CycloneDX".to_string(),
            spec_version: "1.5".to_string(),
            components,
        };

        println!(
            "{}",
            serde_json::to_string_pretty(&sbom).map_err(|e| PinnerError::Config(e.to_string()))?
        );
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::cli::UpgradeStrategy;
    use crate::resolver::provider::MockRemoteProvider;
    use crate::resolver::registry::MockRegistryProvider;
    use crate::resolver::OsvClient;
    use crate::resolver::Resolver;
    use std::sync::Arc;
    use tempfile::tempdir;

    #[tokio::test]
    async fn test_export_sbom() {
        let dir = tempdir().unwrap();
        let file_path = dir.path().join("action.yml");
        std::fs::write(&file_path, "uses: actions/checkout@v3").unwrap();

        let remote = Arc::new(MockRemoteProvider::new());
        let registry = Arc::new(MockRegistryProvider::new());
        let osv = Arc::new(OsvClient::new(
            None,
            false,
            std::time::Duration::from_secs(0),
        ));
        let resolver = Resolver::new(remote, registry, osv, UpgradeStrategy::Latest, 10);
        let scanner = crate::scanner::Scanner::new(vec![]);
        let patcher = crate::patcher::Patcher::new(
            crate::patcher::Formatter::new(
                crate::cli::OutputFormat::Text,
                false,
                vec![],
                vec![],
                true,
            ),
            Arc::new(crate::patcher::ui::TestUi { response: true }),
            false,
        );
        let pipeline = Pipeline::new(scanner, resolver, patcher);

        let result = pipeline.export_sbom(&[file_path]).await;
        assert!(result.is_ok());
    }
}