Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[github] Scan user repositories #2814

Merged
merged 1 commit into from
May 23, 2024
Merged

[github] Scan user repositories #2814

merged 1 commit into from
May 23, 2024

Conversation

rgmz
Copy link
Contributor

@rgmz rgmz commented May 9, 2024 •
edited

Description:

This fixes #949.

The prior logic was inconsistent and had a few bugs.

  1. It only attempted to scan users if for unauthenticated scanning.
  2. It looked up repos for both /orgs/{name} and /users/{name}, regardless of whether an error occurred
  3. It called getReposByUser twice in a row instead of getReposByUser and addUserGistsToCache.

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@rgmz rgmz force-pushed the fix/github-scan-users branch 2 times, most recently from ce0ea88 to 2a8e6f7 Compare May 9, 2024 13:36
rgmz
rgmz commented May 9, 2024
View reviewed changes
pkg/sources/github/github.go Show resolved Hide resolved
pkg/sources/github/github.go Show resolved Hide resolved
pkg/sources/github/github.go Show resolved Hide resolved
@rgmz rgmz marked this pull request as ready for review May 9, 2024 13:38
@rgmz rgmz requested a review from a team as a code owner May 9, 2024 13:38
@rgmz rgmz changed the title fix(github): scan user repos [github] Scan user repositories May 9, 2024
@zricethezav
Copy link
Collaborator

@rgmz thanks for tracking down this issue. I had a somewhat working branch locally to fix #949 but this is a much cleaner implementation. Changes lgtm

rgmz
rgmz commented May 10, 2024
View reviewed changes
pkg/sources/github/repo.go Outdated Show resolved Hide resolved
@rgmz rgmz force-pushed the fix/github-scan-users branch 3 times, most recently from e716486 to 17b6992 Compare May 15, 2024 19:08
@rgmz
Copy link
Contributor Author

rgmz commented May 22, 2024

@zricethezav I've resolved merge conflicts and tweaked getReposByOrgOrUser to also fetch the user's Gists.

@zricethezav zricethezav merged commit 1441289 into trufflesecurity:main May 23, 2024
11 of 12 checks passed
@rgmz rgmz deleted the fix/github-scan-users branch May 23, 2024 17:51
This was referenced May 24, 2024
Merged
Merged
itsacoyote pushed a commit to matter-labs/docs-nuxt-template that referenced this pull request May 29, 2024
@renovate
chore(deps): update trufflesecurity/trufflehog action to v3.77.0 (#34)
c8e68b7 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
|
[trufflesecurity/trufflehog](https://togithub.com/trufflesecurity/trufflehog)
| action | minor | `v3.76.3` -> `v3.77.0` |

---

### Release Notes

<details>
<summary>trufflesecurity/trufflehog
(trufflesecurity/trufflehog)</summary>

###
[`v3.77.0`](https://togithub.com/trufflesecurity/trufflehog/releases/tag/v3.77.0)

[Compare
Source](https://togithub.com/trufflesecurity/trufflehog/compare/v3.76.3...v3.77.0)

#### What's Changed

- Remove "finished verificationOverlap chunks" log line by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[trufflesecurity/trufflehog#2860
- fix(deps): update module github.com/wasilibs/go-re2 to v1.5.3 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2861
- fix(deps): update module google.golang.org/api to v0.181.0 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2857
- fix(deps): update module github.com/aws/aws-sdk-go to v1.53.5 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2859
- Update azure storage extra data by
[@&#8203;abmussani](https://togithub.com/abmussani) in
[trufflesecurity/trufflehog#2808
- Update regex for Organization in Azure Devops detector by
[@&#8203;abmussani](https://togithub.com/abmussani) in
[trufflesecurity/trufflehog#2866
- fix(deps): update module github.com/aws/aws-sdk-go to v1.53.6 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2867
- \[chore] - Use http.NewRequestWithContext by
[@&#8203;ahrav](https://togithub.com/ahrav) in
[trufflesecurity/trufflehog#2870
- adding Groq detector by [@&#8203;0x1](https://togithub.com/0x1) in
[trufflesecurity/trufflehog#2873
- Log reasons for GitLab repo exclusion by
[@&#8203;rosecodym](https://togithub.com/rosecodym) in
[trufflesecurity/trufflehog#2875
- \[github] Scan user repositories by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[trufflesecurity/trufflehog#2814
- Elastic adapter by [@&#8203;camgunz](https://togithub.com/camgunz) in
[trufflesecurity/trufflehog#2727
- Improve handling of Gist URLs by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[trufflesecurity/trufflehog#2653
- Fix some GitHub source test issues by
[@&#8203;rgmz](https://togithub.com/rgmz) in
[trufflesecurity/trufflehog#2774
- fix(deps): update module github.com/aws/aws-sdk-go to v1.53.10 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2871
- fix(deps): update module github.com/go-logr/logr to v1.4.2 by
[@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2869
- fix(deps): update module cloud.google.com/go/secretmanager to v1.13.1
by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2884
- fix(deps): update golang.org/x/exp digest to
[`4c93da0`](https://togithub.com/trufflesecurity/trufflehog/commit/4c93da0)
by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2883
- fix(deps): update module github.com/elastic/go-elasticsearch/v8 to
v8.13.1 by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2886
- fix(deps): update module github.com/gabriel-vasile/mimetype to v1.4.4
by [@&#8203;renovate](https://togithub.com/renovate) in
[trufflesecurity/trufflehog#2890
- Added extra data for LaunchDarkly by
[@&#8203;abmussani](https://togithub.com/abmussani) in
[trufflesecurity/trufflehog#2836
- feat: support docker image history scanning by
[@&#8203;jamestelfer](https://togithub.com/jamestelfer) in
[trufflesecurity/trufflehog#2882

#### New Contributors

- [@&#8203;camgunz](https://togithub.com/camgunz) made their first
contribution in
[trufflesecurity/trufflehog#2727
- [@&#8203;jamestelfer](https://togithub.com/jamestelfer) made their
first contribution in
[trufflesecurity/trufflehog#2882

**Full Changelog**:
trufflesecurity/trufflehog@v3.76.3...v3.77.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/matter-labs/docs-nuxt-template).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy4zNzcuOCIsInVwZGF0ZWRJblZlciI6IjM3LjM3Ny44IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@zricethezav zricethezav zricethezav approved these changes

Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add scanning for user repos
2 participants
@rgmz @zricethezav