capitalone / checks-out Goto Github PK

View Code? Open in Web Editor NEW

76.0 10.0 18.0 3.35 MB

Checks-Out pull request approval system

License: Apache License 2.0

Makefile 0.33% Go 82.74% HTML 2.41% JavaScript 1.02% CSS 13.50%

github approvals versioning tagging go golang workflow-management approval-management

checks-out's Introduction

Due to changes in the priorities, this project is currently not being supported. The project is archived as of 2/15/22 and will be available in a read-only state. Please note, since archival, the project is not maintained or reviewed.

Checks-Out

Checks-Out is a simple pull request approval system using GitHub protected branches and maintainers files. Pull requests are locked and cannot be merged until the minimum number of approvals are received. Project maintainers can indicate their approval by commenting on the pull request and including "I approve" in their approval text. Checks-Out also provides integration with GitHub Reviews. An accepted GitHub Review is counted as an approval. GitHub Review that requests additional changes blocks the pull request from merging.

Read the online documentation to find out more about Checks-Out.

Development

Checks-Out is a fork of LGTM. Our git repository contains the commit history from the upstream project. We are actively seeking contributions from the community. If you'd like to contribute we recommend taking a look at the issues page. You can pick up an open issue and work on it, submit a bug, or submit a new feature request for feedback.

Features

Checks-Out has several features that distinguish itself from the parent LGTM project.

The most popular feature is the ability to specify multiple approval policies. Policies are based around the concept of organizations. An organization is a set of project maintainers. Various types of thresholds can be configured for organizations and boolean conditions can be used to combine policies. Policies can be configured to apply to specific file paths and/or git branches. Refer to the customization documentation for more information about policies.

Checks-Out has optional support for automatic tagging of merges. Tags can configured based on timestamp or semantic versioning.

Checks-Out has optional support for automatic merging of pull requests when all status checks have passed.

Checks-Out has changed the default behavior when new commits are added to a pull request. By default only comments that have a later timestamp than the latest commit are processed by Checks-Out. There is a configuration property to use the original LGTM behavior which is to consider all comments on a pull request.

Usage

.checks-out file

Each repository managed by Checks-Out must have a .checks-out file in the root of the repository. This file provides the configuration that Checks-Out uses for the repository. The configuration file is described in detail in the customization section of the online documentation.

This repository has an .checks-out file that you can use as an example. It is likely that you will need a simple .checks-out file, so you can use the following template:

approvals:
[
  {
    match: "all[count=1,self=false]"
  }
]

MAINTAINERS file

Each repository managed by Checks-Out should have a MAINTAINERS file that specifies who is allowed to approve pull requests. The format of the file is described in the maintainers section of the online documentation. Here is a sample MAINTAINERS file to get you started:

github-org repo-self

Build

Checks-Out uses the Go dep dependency management tool. Dependencies are not stored in the repository. Run dep ensure to install dependencies.

Commands to build from source:

make build   # Build the binary

Contributors

We welcome your interest in Capital One’s Open Source Projects (the “Project”). Any Contributor to the Project must accept and sign a CLA indicating agreement to the license terms. Except for the license granted in this CLA to Capital One and to recipients of software distributed by Capital One, You reserve all right, title, and interest in and to your Contributions; this CLA does not impact your rights to use your own contributions for any other purpose.

Link to Individual CLA

Link to Corporate CLA

This project adheres to the Capital One Open Source Code of Conduct. By participating, you are expected to honor this code.

Contribution Guidelines

We encourage any contributions that align with the intent of this project and add more functionality or languages that other developers can make use of. To contribute to the project, please submit a PR for our review. Before contributing any source code, familiarize yourself with the Apache License 2.0, which controls the licensing for this project.

License

Checks-Out is available under the Apache License 2.0.

This distribution has a binary dependency on errwrap, which is available under the Mozilla Public License 2.0 License. The source code of errwrap can be found at https://github.com/hashicorp/errwrap.

This distribution has a binary dependency on go-version, which is available under the Mozilla Public License 2.0 License. The source code of go-version can be found at https://github.com/hashicorp/go-version.

This distribution has a binary dependency on go-multierror, which is available under the Mozilla Public License 2.0 License. The source code of go-multierror can be found at https://github.com/mspiegel/go-multierror.

This distribution has a binary dependency on go-sql-driver/mysql, which is available under the Mozilla Public License 2.0 License. The source code of go-sql-driver/mysql can be found at https://github.com/go-sql-driver/mysql

FAQ

1. How is this different from GitHub Reviews?

Please use GitHub Reviews if it meets all your requirements. Some significant features in Checks-Out that are not (yet) in GitHub Reviews are: custom approval policies, different approval policies for different branches and/or file paths, optional auto-merge when all status checks have passed, optional auto-tagging of merges.

checks-out's People

Contributors

Stargazers

Watchers

Forkers

jonbodner mspiegel mukteshkrmishra jonathana bryantidd bnygld vishalgupta04 daosyn komony gitter-badger orlamaclean nagu4dwh creatigent isabella232 headorb vnwosu9 azurecloudmonk ghas-results

checks-out's Issues

CVE-2020-11022 (Medium) detected in jquery-3.0.0-alpha1.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-3.0.0-alpha1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-alpha1/jquery.min.js

Path to dependency file: checks-out/web/template/files/brand.html

Path to vulnerable library: checks-out/web/template/files/brand.html

Dependency Hierarchy:

❌ jquery-3.0.0-alpha1.min.js (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with WhiteSource here

Add trace support to the UI and API

The most common support question is: "I don't know why checks-out didn't approve my PR." So far, we haven't found any bugs in checks-out, but we have found that it is often unclear why checks-out makes the approvals that it does. It would be good to have a way for users to find out what checks-out current opinion of a PR is. This should be available via API and UI.

Add PR comment when commits are _from the future_

The default behavior of checks-out is to only accept approvals that occur at a later time than the HEAD commit on the compare branch. The commits are timestamped by the local clock at the time of commit, not a clock on the GitHub server. If the local clock is significantly into the future then checks-out will ignore all approvals. We can detect this condition and report it as a comment on the pull request.

Add monorepo support

Right now, a single rule is selected to determine whether or not checks-out see sufficient approvals to accept a PR. When working in a monorepo, this isn't sufficient; different paths in the same project will have different approval rules, and you don't know ahead of time which combination of them need to be active for a given PR. Adding the ability to specify that multiple approval rules can be active at once, determined per-PR would enable a flexible monorepo approval system.

Approval/Disapproval Comments Not Captured from Review Changes Comments

If a user comments an Approval or Disapproval from the following place, LGTM does not capture the feedback:

Ex of how the comments show up differently. The first is not captured by LGTM (made through the Review Changes comment section), but the second is captured by LGTM (made through the conversation page of the PR):

Make MAINTAINERS optional

The MAINTAINERS file is a historical relic that was inherited from the original LGTM project. We should have a section of the .checksout file that lets you specify your users and groups. Also, we should consider auto-importing all groups and users defined for the repo/org without any MAINTAINERS specification.

Move from an OAuth app to a Github app

Currently, checks-out integrates as an OAuth app. The newer style is a GitHub app. We should switch to that: https://developer.github.com/apps/differences-between-apps/

Delete Function is broken

The delete function in merge is broken. The logic appears to only work if match approval policy is set to off.

Attached is sample lgtmeow file with to replicate:

approvals:
[
{
match: "all[count=2,self=false]"
}
]

merge:
{
enable: true
delete: true
method: "merge"
uptodate: true
}

commit:
{
range: head
antirange: head
tagrange: head
ignoreuimerge: true
}

comment:
{
enable: true
targets: [
{
target: github
}
]
}

github-team repo-self [orgname] support

github-team repo-self [orgname] should have the same advantages as github-team repo-self. It should automatically import all members of the organization including members that are not a part of any team. It should also load teams on-demand only when needed.

Refactor code base

The code structure isn't one that is recommended by modern Go projects. We should consider refactoring to a more standard structure, but not before we improve test coverage #53 .

Support Gitlab

Right now, checks-out is tied to Github (enterprise or public). We should support more git-based VCSes, and maybe some non-git ones, too. Gitlab is an obvious first choice.

Upgrade to v4 GitHub API

checks-out currently uses v3 of Github's API. v4 is GraphQL-based. The main advantage of upgrading is that it seamlessly handles org and repo renames.

CVE-2020-26160 (High) detected in github.com/dgrijalva/jwt-go-dc14462fd58732591c7fa58cc8496d6824316a82

CVE-2020-26160 - High Severity Vulnerability

Vulnerable Library - github.com/dgrijalva/jwt-go-dc14462fd58732591c7fa58cc8496d6824316a82

Golang implementation of JSON Web Tokens (JWT)

Dependency Hierarchy:

❌ github.com/dgrijalva/jwt-go-dc14462fd58732591c7fa58cc8496d6824316a82 (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Publish Date: 2020-09-30

URL: CVE-2020-26160

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11023 (Medium) detected in jquery-3.0.0-alpha1.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-3.0.0-alpha1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-alpha1/jquery.min.js

Path to dependency file: checks-out/web/template/files/brand.html

Path to vulnerable library: checks-out/web/template/files/brand.html

Dependency Hierarchy:

❌ jquery-3.0.0-alpha1.min.js (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

Step up your Open Source Security Game with WhiteSource here

Support CODEOWNERS file

CODEOWNERS can be setup to be used with GitHub reviews and provides a better GitHub integrated way for reviewing code. checks-out should be able to use the CODEOWNERS concept as well so that I can use the teams features/pathing and all it supports as well.

On auto merge, merge commit overwrites change titles

When I have the merge config set to merge the PR on all approvals, the merge that results overwrites the PR's change title such that if I have tags in my PR title that are needed by my CI/CD process, then those tags are lost.

We use tagging in the PR title to signify additional things the build should do for that PR -> like increment version numbers, tagging, issue resolution, etc.

Checks-out breaks this functionality when merge is set to enabled.

so either checks-out should append to that or provide an option to not do that.

Example:

My PR Title:
[MAJOR] This adds breaking functionality

Checks-out merges with change title:

Merged by checks-out
Approved by:
<person>

I would expect it to be:

[MAJOR] This adds breaking functionality

Merged by checks-out
Approved by:
<person>

Update UI

The UI is still based on Angular 1. It should be updated to something more modern and easier to maintain. Also, it's not the prettiest UI in the world.

Broken link to web-site with documentation

http://www.capitalone.io/checks-out/ - 404 error

Where can I find the documentation for this project? :)

Add wizard to UI

Writing a checks-out file is non-trivial. It'd be nice to have a tool to help users build something that handles the common cases automatically, including uploading the .checksout and MAINTAINERS file to the repository.

CVE-2019-14863 (Medium) detected in angular-1.4.8.js

CVE-2019-14863 - Medium Severity Vulnerability

Vulnerable Library - angular-1.4.8.js

AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.8/angular.js

Path to dependency file: checks-out/web/template/files/index.html

Path to vulnerable library: checks-out/web/template/files/index.html

Dependency Hierarchy:

❌ angular-1.4.8.js (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.

Publish Date: 2020-01-02

URL: CVE-2019-14863

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: angular/angular.js#12524

Release Date: 2020-01-02

Fix Resolution: angular - v1.5.0-beta.1;org.webjars:angularjs:1.5.0-rc.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7676 (Medium) detected in angular-1.4.8.js

CVE-2020-7676 - Medium Severity Vulnerability

Vulnerable Library - angular-1.4.8.js

Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.4.8/angular.js

Path to dependency file: checks-out/web/template/files/index.html

Path to vulnerable library: checks-out/web/template/files/index.html

Dependency Hierarchy:

❌ angular-1.4.8.js (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code. Publish Date: 2020-06-08 URL: CVE-2020-7676 CVSS 3 Score Details (5.4) Base Score Metrics: Exploitability Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Impact Metrics: Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None For more information on CVSS3 Scores, click here. Suggested Fix Type: Upgrade version Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7676 Release Date: 2020-06-08 Fix Resolution: 1.8.0 Step up your Open Source Security Game with WhiteSource here

Improve test coverage

The test coverage (and test patterns) for checks-out are not great. We should increase test coverage and make it possible to run most of the tests without being connected to a github instance.

Auto merge failing on large repos

Checks-out fails to automatically merge even when all status checks are successfully passing on large repos that have multiple PRs.

When looking at the webhook response it seems like Check-out thinks the status checks have not passed even when it has - it would be helpful if there are additional logging and checks in place to ensure that this does not happen.

CVE-2019-11358 (Medium) detected in jquery-3.0.0-alpha1.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-3.0.0-alpha1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.0.0-alpha1/jquery.min.js

Path to dependency file: checks-out/web/template/files/brand.html

Path to vulnerable library: checks-out/web/template/files/brand.html

Dependency Hierarchy:

❌ jquery-3.0.0-alpha1.min.js (Vulnerable Library)

Found in HEAD commit: 79dc019e37586af9b400528748552a3d3d655898

Found in base branch: dev

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

Step up your Open Source Security Game with WhiteSource here

Update documentation

The documentation needs some updates. In particular, examples of how to write .checks-out files for standard use cases. The API docs could also use examples and reformatting.

capitalone / checks-out Goto Github PK

checks-out's Introduction

Due to changes in the priorities, this project is currently not being supported. The project is archived as of 2/15/22 and will be available in a read-only state. Please note, since archival, the project is not maintained or reviewed.

Checks-Out

Development

Features

Usage

.checks-out file

MAINTAINERS file

Build

Contributors

Contribution Guidelines

License

FAQ

checks-out's People

Contributors

Stargazers

Watchers

Forkers

checks-out's Issues

CVE-2020-11022 - Medium Severity Vulnerability

CVE-2020-26160 - High Severity Vulnerability

CVE-2020-11023 - Medium Severity Vulnerability

CVE-2019-14863 - Medium Severity Vulnerability

CVE-2020-7676 - Medium Severity Vulnerability

CVE-2019-11358 - Medium Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org