Documentation
¶
Index ¶
- Constants
- Variables
- func AlertEvent(alert *github.DependabotAlert) (map[string]any, error)
- func AlertSection(alert map[string]any) string
- func AlertSectionFromEventData(eventData any) (string, bool)
- func FindOpenPackageWorkOrder(tx *gorm.DB, factory *models.Factory, ref PackageRef) (*models.FactoryWorkOrder, error)
- func LockPackageWorkOrder(tx *gorm.DB, factory *models.Factory, ref PackageRef) error
- func MergeAlertSection(description, section string) string
- func TaskTitle(ref PackageRef) string
- func Unavailable(err error) bool
- func UnavailableError(err error) error
- type PackageRef
- type TaskCopy
Constants ¶
const AlertPayloadType = "github.dependabotAlert"
AlertPayloadType is the canvas event type emitted by github.onDependabotAlert.
const AlertsDisabledMessage = "Dependabot alerts are off for this repository. Turn them on in the repository security settings."
AlertsDisabledMessage tells the user to turn Dependabot alerts on.
const AlertsUnreadableMessage = "The GitHub App cannot read Dependabot alerts. Allow that permission for the app, then try again."
AlertsUnreadableMessage tells the user to allow the GitHub App to read alerts.
Variables ¶
var ErrAlertsDisabled = errors.New("dependabot alerts are disabled")
ErrAlertsDisabled means GitHub refused the alerts API because Dependabot alerts are turned off for the repository.
var ErrAlertsUnreadable = errors.New("dependabot alerts are not readable")
ErrAlertsUnreadable means GitHub refused the alerts API because the app cannot read them.
Functions ¶
func AlertEvent ¶
func AlertEvent(alert *github.DependabotAlert) (map[string]any, error)
AlertEvent shapes an API alert like the dependabot_alert webhook body, so a seeded item and a received webhook take the same path through the canvas.
func AlertSection ¶
AlertSection renders one alert as a block of the task description. The canvas description expression writes the same block for the first alert; keep the two in step.
func AlertSectionFromEventData ¶
AlertSectionFromEventData renders the alert carried by a canvas root event.
func FindOpenPackageWorkOrder ¶
func FindOpenPackageWorkOrder(tx *gorm.DB, factory *models.Factory, ref PackageRef) (*models.FactoryWorkOrder, error)
FindOpenPackageWorkOrder returns the factory's open task for the package, or nil. A closed task does not count: a new advisory after the fix starts a new task.
func LockPackageWorkOrder ¶
LockPackageWorkOrder serializes work-order creation for one package in this factory. The lock is held until the caller commits tx.
func MergeAlertSection ¶
MergeAlertSection appends one alert block to an existing task description. The fix guidance stays at the top, so a new alert goes at the end. A block whose alert URL is already in the description is not added twice.
func TaskTitle ¶
func TaskTitle(ref PackageRef) string
TaskTitle names the package the task fixes. It does not name a manifest or say "bump", because the right fix for a transitive package is often an update of the direct dependency that pulls it in.
func Unavailable ¶
Unavailable reports whether GitHub refused the alerts API because alerts are off or the app cannot read them.
func UnavailableError ¶
UnavailableError turns a GitHub refusal into a reason the caller can show. GitHub uses one status code for both causes and names the cause in the body.
Types ¶
type PackageRef ¶
PackageRef identifies one vulnerable package in a repository. GitHub raises one alert per advisory per manifest, and the fix for all of them is one dependency update, so every alert for the package maps to one task.
func PackageRefFromAlert ¶
func PackageRefFromAlert(repository string, alert *github.DependabotAlert) (PackageRef, bool)
PackageRefFromAlert reads the package of one API alert.
func PackageRefFromEventData ¶
func PackageRefFromEventData(eventData any) (PackageRef, bool)
PackageRefFromEventData reads the package from a canvas root event. The envelope looks like:
{ "type": "github.dependabotAlert", "data": { "alert": { "html_url": "...", "dependency": {...} } } }
func PackageRefFromURL ¶
func PackageRefFromURL(rawURL string) (PackageRef, bool)
PackageRefFromURL reads the package back out of an origin URL built by PackageRef.OriginURL.
func (PackageRef) Matches ¶
func (r PackageRef) Matches(other PackageRef) bool
Matches reports whether both refs point at the same package. Repository names are case-insensitive on GitHub.
func (PackageRef) Origin ¶
func (r PackageRef) Origin() models.WorkOrderOrigin
Origin is the work order origin of the package task.
func (PackageRef) OriginLabel ¶
func (r PackageRef) OriginLabel() string
OriginLabel names the package in the task origin chip.
func (PackageRef) OriginURL ¶
func (r PackageRef) OriginURL() string
OriginURL is the repository's Dependabot alerts page filtered to the package. It is the task origin and the key that finds the open task again.
type TaskCopy ¶
TaskCopy is the backlog title and description for one package.
func TaskCopyFromAlerts ¶
func TaskCopyFromAlerts(ref PackageRef, alerts []*github.DependabotAlert) TaskCopy
TaskCopyFromAlerts builds the task for every open alert of one package.
Source Files