Skip to content

Commit fc10e35

Browse files
authored
Move GitHub vulnerabilities verifier to its own Job (#8146)
* Move PVA Verify command to its own job, use Key Vault secrets for db auth
1 parent 92db7eb commit fc10e35

14 files changed

Lines changed: 499 additions & 248 deletions

NuGetGallery.sln

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GitHubVulnerabilities2Db",
5050
EndProject
5151
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "GitHubVulnerabilities2Db.Facts", "tests\GitHubVulnerabilities2Db.Facts\GitHubVulnerabilities2Db.Facts.csproj", "{E50953CB-209A-484E-951D-A68F5CF3C546}"
5252
EndProject
53+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "VerifyGitHubVulnerabilities", "src\VerifyGitHubVulnerabilities\VerifyGitHubVulnerabilities.csproj", "{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}"
54+
EndProject
5355
Global
5456
GlobalSection(SolutionConfigurationPlatforms) = preSolution
5557
Debug|Any CPU = Debug|Any CPU
@@ -124,6 +126,10 @@ Global
124126
{E50953CB-209A-484E-951D-A68F5CF3C546}.Debug|Any CPU.Build.0 = Debug|Any CPU
125127
{E50953CB-209A-484E-951D-A68F5CF3C546}.Release|Any CPU.ActiveCfg = Release|Any CPU
126128
{E50953CB-209A-484E-951D-A68F5CF3C546}.Release|Any CPU.Build.0 = Release|Any CPU
129+
{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
130+
{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}.Debug|Any CPU.Build.0 = Debug|Any CPU
131+
{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}.Release|Any CPU.ActiveCfg = Release|Any CPU
132+
{C0B764D2-D376-439E-A5C4-1AC41B11E9DE}.Release|Any CPU.Build.0 = Release|Any CPU
127133
EndGlobalSection
128134
GlobalSection(SolutionProperties) = preSolution
129135
HideSolutionNode = FALSE
@@ -146,6 +152,7 @@ Global
146152
{98765110-844D-41BE-8083-22E064136E05} = {39E54EC3-CBAA-453A-BE64-748FE1559A58}
147153
{26BB718A-E1C1-4E70-9008-FB8EE7A7F7E5} = {2204C510-A559-4ED7-9590-FDC09093575B}
148154
{E50953CB-209A-484E-951D-A68F5CF3C546} = {39E54EC3-CBAA-453A-BE64-748FE1559A58}
155+
{C0B764D2-D376-439E-A5C4-1AC41B11E9DE} = {2204C510-A559-4ED7-9590-FDC09093575B}
149156
EndGlobalSection
150157
GlobalSection(ExtensibilityGlobals) = postSolution
151158
SolutionGuid = {064A3BDE-5203-4AD6-A6C9-5CF08301EC8F}

build.ps1

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ Invoke-BuildStep 'Creating artifacts' { `
116116
New-Package (Join-Path $PSScriptRoot "src\AccountDeleter\Gallery.AccountDeleter.nuspec") -Configuration $Configuration -BuildNumber $BuildNumber -Version $SemanticVersion -Branch $Branch -MSBuildVersion "15"
117117
New-Package (Join-Path $PSScriptRoot "src\GitHubVulnerabilities2Db\GitHubVulnerabilities2Db.nuspec") -Configuration $Configuration -BuildNumber $BuildNumber -Version $SemanticVersion -Branch $Branch -MSBuildVersion "15"
118118
New-Package (Join-Path $PSScriptRoot "src\GalleryTools\Gallery.GalleryTools.nuspec") -Configuration $Configuration -BuildNumber $BuildNumber -Version $SemanticVersion -Branch $Branch -MSBuildVersion "15"
119+
New-Package (Join-Path $PSScriptRoot "src\VerifyGitHubVulnerabilities\VerifyGitHubVulnerabilities.nuspec") -Configuration $Configuration -BuildNumber $BuildNumber -Version $SemanticVersion -Branch $Branch -MSBuildVersion "15"
119120

120121
if (!$VerifyMicrosoftPackageVersion) { $VerifyMicrosoftPackageVersion = $SemanticVersion }
121122
New-Package (Join-Path $PSScriptRoot "src\VerifyMicrosoftPackage\VerifyMicrosoftPackage.nuspec") -Configuration $Configuration -BuildNumber $BuildNumber -Version $VerifyMicrosoftPackageVersion -Branch $Branch -MSBuildVersion "15"

src/GalleryTools/Commands/VerifyGitHubVulnerabilitiesCommand.cs

Lines changed: 0 additions & 246 deletions
This file was deleted.

src/GalleryTools/GalleryTools.csproj

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,6 @@
5252
<Compile Include="Commands\ReflowCommand.cs" />
5353
<Compile Include="Commands\UpdateIsLatestCommand.cs" />
5454
<Compile Include="Commands\VerifyApiKeyCommand.cs" />
55-
<Compile Include="Commands\VerifyGitHubVulnerabilitiesCommand.cs" />
5655
<Compile Include="Program.cs" />
5756
<Compile Include="Properties\AssemblyInfo.cs" />
5857
<Compile Include="Properties\AssemblyInfo.*.cs" />

src/GalleryTools/Program.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,6 @@ public static int Main(params string[] args)
2121
commandLineApplication.Command("filldevdeps", BackfillDevelopmentDependencyCommand.Configure);
2222
commandLineApplication.Command("verifyapikey", VerifyApiKeyCommand.Configure);
2323
commandLineApplication.Command("updateIsLatest", UpdateIsLatestCommand.Configure);
24-
commandLineApplication.Command("verifyVulnerabilities", VerifyGitHubVulnerabilitiesCommand.Configure);
2524

2625
try
2726
{
Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<startup>
4+
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
5+
</startup>
6+
</configuration>
Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
6+
namespace VerifyGitHubVulnerabilities.Configuration
7+
{
8+
public class VerifyGitHubVulnerabilitiesConfiguration
9+
{
10+
/// <summary>
11+
/// GitHub's v4 GraphQL API endpoint.
12+
/// </summary>
13+
public Uri GitHubGraphQLQueryEndpoint { get; set; } = new Uri("https://api.github.com/graphql");
14+
15+
/// <summary>
16+
/// The personal access token to use to authenticate with GitHub.
17+
/// </summary>
18+
public string GitHubPersonalAccessToken { get; set; }
19+
}
20+
}
Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
// Copyright (c) .NET Foundation. All rights reserved.
2+
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.
3+
4+
using System;
5+
using System.Net.Http;
6+
using System.Net.Http.Headers;
7+
using System.Text;
8+
using System.Threading;
9+
using System.Threading.Tasks;
10+
using GitHubVulnerabilities2Db.GraphQL;
11+
using Newtonsoft.Json;
12+
using Newtonsoft.Json.Linq;
13+
using VerifyGitHubVulnerabilities.Configuration;
14+
15+
namespace VerifyGitHubVulnerabilities.GraphQL
16+
{
17+
public class QueryService : IQueryService
18+
{
19+
/// <remarks>
20+
/// GitHub requires that every request includes a UserAgent.
21+
/// </remarks>
22+
public const string UserAgent = "NuGet.Jobs.VerifyGitHubVulnerabilities";
23+
24+
private readonly VerifyGitHubVulnerabilitiesConfiguration _configuration;
25+
private readonly HttpClient _client;
26+
27+
public QueryService(
28+
VerifyGitHubVulnerabilitiesConfiguration configuration,
29+
HttpClient client)
30+
{
31+
_configuration = configuration ?? throw new ArgumentNullException(nameof(configuration));
32+
_client = client ?? throw new ArgumentNullException(nameof(client));
33+
}
34+
35+
public async Task<QueryResponse> QueryAsync(string query, CancellationToken token)
36+
{
37+
var queryJObject = new JObject
38+
{
39+
["query"] = query
40+
};
41+
42+
var response = await MakeWebRequestAsync(queryJObject.ToString(), token);
43+
return JsonConvert.DeserializeObject<QueryResponse>(response);
44+
}
45+
46+
private async Task<string> MakeWebRequestAsync(string query, CancellationToken token)
47+
{
48+
using (var request = CreateRequest(query))
49+
using (var response = await _client.SendAsync(request, token))
50+
{
51+
return await response.Content.ReadAsStringAsync();
52+
}
53+
}
54+
55+
private HttpRequestMessage CreateRequest(string query)
56+
{
57+
var message = new HttpRequestMessage
58+
{
59+
Method = HttpMethod.Post,
60+
RequestUri = _configuration.GitHubGraphQLQueryEndpoint,
61+
Content = new StringContent(query, Encoding.UTF8, "application/json")
62+
};
63+
64+
message.Headers.Authorization = new AuthenticationHeaderValue(
65+
"Bearer", _configuration.GitHubPersonalAccessToken);
66+
message.Headers.UserAgent.TryParseAdd(UserAgent);
67+
return message;
68+
}
69+
}
70+
}

0 commit comments

Comments
 (0)