Merge pull request #94 from ossf/b3

Improve SAST check.
ossf · Dec 15, 2020 · 1991617 · 1991617
2 parents c5abb92 + 7a10bed
commit 1991617
Showing 1 changed file with 19 additions and 2 deletions.
diff --git a/checks/sast.go b/checks/sast.go
@@ -22,10 +22,10 @@ import (
 var sastTools map[string]bool = map[string]bool{"github-code-scanning": true, "sonarcloud": true}
 
 func init() {
-	registerCheck("SAST", checker.MultiCheck(CodeQLActionRuns))
+	registerCheck("SAST", checker.MultiCheck(CodeQLInCheckDefinitions, SASTToolInCheckRuns))
 }
 
-func CodeQLActionRuns(c checker.Checker) checker.CheckResult {
+func SASTToolInCheckRuns(c checker.Checker) checker.CheckResult {
 	prs, _, err := c.Client.PullRequests.List(c.Ctx, c.Owner, c.Repo, &github.PullRequestListOptions{
 		State: "closed",
 	})
@@ -63,3 +63,20 @@ func CodeQLActionRuns(c checker.Checker) checker.CheckResult {
 	}
 	return checker.ProportionalResult(totalTested, totalMerged, .75)
 }
+
+func CodeQLInCheckDefinitions(c checker.Checker) checker.CheckResult {
+	searchQuery := ("github/codeql-action path:/.github/workflows repo:" + c.Owner + "/" + c.Repo)
+	results, _, err := c.Client.Search.Code(c.Ctx, searchQuery, &github.SearchOptions{})
+	if err != nil {
+		return checker.RetryResult(err)
+	}
+
+	for _, result := range results.CodeResults {
+		c.Logf("found CodeQL definition: %s", result.GetPath())
+	}
+
+	return checker.CheckResult{
+		Pass:       *results.Total > 0,
+		Confidence: 10,
+	}
+}