Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🌱 Logging a warning if readGitHubTokens finds several values which clash. #4483

Merged
merged 5 commits into from
Jan 9, 2025

Conversation

aunovis-heidrich
Copy link
Contributor

What kind of change does this PR introduce?

Print a warning if several GitHub Access Tokens with different values are found.

What is the current behavior?

Scorecard ignores any GitHub PAT environment variables after the first one it finds.

What is the new behavior (if this is a feature change)?**

Scorecards checks all possible PAT env vars and prints a warning if their values differ. It still uses the first one it finds, such that the behaviour is non-breaking.

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #4475

Special notes for your reviewer

The local tests failed already for a clean checkout of the main branch. I am hoping for the CI to sucessfully run them for me.

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Print a warning if several GitHub PAT environment variables with different values are set.

@aunovis-heidrich aunovis-heidrich requested a review from a team as a code owner January 8, 2025 05:16
@aunovis-heidrich aunovis-heidrich requested review from spencerschrock and raghavkaul and removed request for a team January 8, 2025 05:16
Copy link

codecov bot commented Jan 8, 2025

Codecov Report

Attention: Patch coverage is 60.00000% with 8 lines in your changes missing coverage. Please review.

Project coverage is 68.46%. Comparing base (353ed60) to head (0c6dc70).
Report is 97 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4483      +/-   ##
==========================================
+ Coverage   66.80%   68.46%   +1.65%     
==========================================
  Files         230      246      +16     
  Lines       16602    18444    +1842     
==========================================
+ Hits        11091    12627    +1536     
- Misses       4808     4991     +183     
- Partials      703      826     +123     

Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally looks good. Left a few comments, and make sure to run make check-linter.

clients/githubrepo/roundtripper/tokens/accessor_test.go Outdated Show resolved Hide resolved
clients/githubrepo/roundtripper/tokens/accessor.go Outdated Show resolved Hide resolved
clients/githubrepo/roundtripper/tokens/accessor_test.go Outdated Show resolved Hide resolved
clients/githubrepo/roundtripper/tokens/accessor_test.go Outdated Show resolved Hide resolved
Copy link
Member

@spencerschrock spencerschrock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@spencerschrock spencerschrock merged commit 43d5832 into ossf:main Jan 9, 2025
38 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Done
Development

Successfully merging this pull request may close these issues.

Detect and warn about conflicting Github Tokens
2 participants