├── .codeguru-ignore.yml ├── .github └── workflows │ ├── cicd-demo.yml │ ├── java-compatible.yml │ └── self-test-and-release.yml ├── .gitignore ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── LICENSE ├── NOTICE ├── README.md ├── build.gradle ├── config ├── checkstyle │ ├── checkstyle.xml │ └── suppressions.xml └── spotbugs │ └── spotbugs-exclude.xml ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat ├── lombok.config ├── settings.gradle ├── src ├── main │ ├── java │ │ └── com │ │ │ └── amazonaws │ │ │ └── gurureviewercli │ │ │ ├── Main.java │ │ │ ├── adapter │ │ │ ├── ArtifactAdapter.java │ │ │ ├── AssociationAdapter.java │ │ │ ├── GitAdapter.java │ │ │ ├── ResultsAdapter.java │ │ │ └── ScanAdapter.java │ │ │ ├── exceptions │ │ │ └── GuruCliException.java │ │ │ ├── model │ │ │ ├── Configuration.java │ │ │ ├── ErrorCodes.java │ │ │ ├── GitMetaData.java │ │ │ ├── Recommendation.java │ │ │ ├── ScanMetaData.java │ │ │ ├── bitbucket │ │ │ │ ├── CodeInsightsAnnotation.java │ │ │ │ ├── CodeInsightsReport.java │ │ │ │ └── CodeInsightsReportData.java │ │ │ └── configfile │ │ │ │ ├── CustomConfiguration.java │ │ │ │ └── ExcludeRecommendation.java │ │ │ └── util │ │ │ ├── CodeInsightExport.java │ │ │ ├── JsonUtil.java │ │ │ ├── Log.java │ │ │ ├── RecommendationPrinter.java │ │ │ ├── RecommendationsFilter.java │ │ │ ├── SarifConverter.java │ │ │ └── ZipUtils.java │ └── resources │ │ └── log4j2.properties └── test │ └── java │ └── com │ └── amazonaws │ └── gurureviewercli │ ├── adapter │ ├── ArtifactAdapterTest.java │ ├── AssociationAdapterTest.java │ ├── GitAdapterTest.java │ ├── ResultsAdapterTest.java │ └── ScanAdapterTest.java │ └── util │ ├── CodeInsightExportTest.java │ ├── RecommendationsFilterTest.java │ └── ZipUtilsTest.java └── test-data ├── custom-configs ├── exclude-id.yml ├── exclude-recommendations.yml ├── exclude-severity.yml └── exclude-tag.yml ├── fake-repo-with-config ├── aws-codeguru-reviewer.yml ├── other-dir │ └── should-not-be-included.txt ├── should-not-be-included.txt └── src-dir │ └── included-src.txt ├── fake-repo ├── build-dir │ ├── lib │ │ └── included.txt │ └── should-not-be-included.txt └── should-not-be-included.txt ├── fresh-repo-no-remote └── git │ ├── HEAD │ ├── config │ ├── description │ ├── hooks │ ├── applypatch-msg.sample │ ├── commit-msg.sample │ ├── fsmonitor-watchman.sample │ ├── post-update.sample │ ├── pre-applypatch.sample │ ├── pre-commit.sample │ ├── pre-merge-commit.sample │ ├── pre-push.sample │ ├── pre-rebase.sample │ ├── pre-receive.sample │ ├── prepare-commit-msg.sample │ └── update.sample │ └── info │ └── exclude ├── fresh-repo-with-remote └── git │ ├── HEAD │ ├── config │ ├── description │ ├── hooks │ ├── applypatch-msg.sample │ ├── commit-msg.sample │ ├── fsmonitor-watchman.sample │ ├── post-update.sample │ ├── pre-applypatch.sample │ ├── pre-commit.sample │ ├── pre-merge-commit.sample │ ├── pre-push.sample │ ├── pre-rebase.sample │ ├── pre-receive.sample │ ├── prepare-commit-msg.sample │ └── update.sample │ └── info │ └── exclude ├── one-commit ├── git │ ├── COMMIT_EDITMSG │ ├── HEAD │ ├── config │ ├── description │ ├── hooks │ │ ├── applypatch-msg.sample │ │ ├── commit-msg.sample │ │ ├── fsmonitor-watchman.sample │ │ ├── post-update.sample │ │ ├── pre-applypatch.sample │ │ ├── pre-commit.sample │ │ ├── pre-merge-commit.sample │ │ ├── pre-push.sample │ │ ├── pre-rebase.sample │ │ ├── pre-receive.sample │ │ ├── prepare-commit-msg.sample │ │ └── update.sample │ ├── index │ ├── info │ │ └── exclude │ ├── logs │ │ ├── HEAD │ │ └── refs │ │ │ └── heads │ │ │ └── master │ ├── objects │ │ ├── 69 │ │ │ └── e978a2558e8b47b25058af8e10482831feded6 │ │ ├── 9a │ │ │ └── 71f81a4b4754b686fd37cbb3c72d0250d344aa │ │ └── cd │ │ │ └── b0fcad7400610b1d1797a326a89414525160fe │ └── refs │ │ └── heads │ │ └── master └── test.txt ├── recommendations ├── exclude01.json └── recommendations.json ├── source-and-class ├── src │ └── org │ │ └── owasp │ │ └── benchmark │ │ └── testcode │ │ └── BenchmarkTest00001.java ├── target │ └── org │ │ └── owasp │ │ └── benchmark │ │ └── testcode │ │ └── BenchmarkTest00001.class └── unrelated │ └── some.txt └── two-commits ├── git ├── COMMIT_EDITMSG ├── HEAD ├── config ├── description ├── hooks │ ├── applypatch-msg.sample │ ├── commit-msg.sample │ ├── fsmonitor-watchman.sample │ ├── post-update.sample │ ├── pre-applypatch.sample │ ├── pre-commit.sample │ ├── pre-merge-commit.sample │ ├── pre-push.sample │ ├── pre-rebase.sample │ ├── pre-receive.sample │ ├── prepare-commit-msg.sample │ └── update.sample ├── index ├── info │ └── exclude ├── logs │ ├── HEAD │ └── refs │ │ └── heads │ │ └── master ├── objects │ ├── 69 │ │ └── e978a2558e8b47b25058af8e10482831feded6 │ ├── 96 │ │ └── f7fe170993c91f42a92e4ce8b1663d18ae7f54 │ ├── 7f │ │ └── 112b196b963ff72675febdbb97da5204f9497e │ ├── 8e │ │ └── ce465b7ecf8337bf767c9602d21bb92f2fad8a │ ├── 9a │ │ └── 71f81a4b4754b686fd37cbb3c72d0250d344aa │ └── cd │ │ └── b0fcad7400610b1d1797a326a89414525160fe └── refs │ └── heads │ └── master ├── not-versioned.txt └── test.txt /.codeguru-ignore.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | 3 | ExcludeById: 4 | - 'security-764ea718423ce472134805f16e2616a36c3636fab21927453102041' 5 | 6 | ExcludeTags: 7 | - 'maintainability' 8 | 9 | excludeFiles: 10 | - "tst/**" 11 | - "test-data/**" 12 | -------------------------------------------------------------------------------- /.github/workflows/cicd-demo.yml: -------------------------------------------------------------------------------- 1 | name: Demo of how to use a CodeGuru Reviewer CLI release in CICD. 2 | 3 | on: [ push, pull_request, workflow_dispatch ] 4 | 5 | permissions: 6 | id-token: write 7 | contents: read 8 | 9 | jobs: 10 | RunDemo: 11 | name: Run CodeGuru Reviewer CLI in CICD 12 | runs-on: ubuntu-latest 13 | steps: 14 | # Setup Java 8 or higher. 15 | - name: Set up JDK 1.8 16 | uses: actions/setup-java@v1 17 | with: 18 | java-version: 1.8 19 | 20 | # To configure this role, use this CDK example: 21 | # https://github:com/aws-samples/aws-codeguru-reviewer-cicd-cdk-sample 22 | - name: Configure AWS credentials 23 | uses: aws-actions/configure-aws-credentials@v1 24 | continue-on-error: true 25 | id: iam-role 26 | with: 27 | role-to-assume: arn:aws:iam::048169001733:role/GuruGitHubCICDRole 28 | aws-region: us-west-2 29 | 30 | # Only continue if fetching the AWS credentials was successful. 31 | - uses: actions/checkout@v2 32 | if: steps.iam-role.outcome == 'success' 33 | with: 34 | fetch-depth: 0 # the fetch depth needs to be provided if we only want to check a certain commit range. 35 | - name: Build project 36 | if: steps.iam-role.outcome == 'success' 37 | run: ./gradlew clean installDist 38 | 39 | # Download a release of the CodeGuru Reviewer CLI. 40 | - name: Download CodeGuru Reviewer CLI 41 | shell: bash 42 | env: 43 | VERSION: 0.2.4 44 | run: curl -OL "https://github.com/aws/aws-codeguru-cli/releases/download/$VERSION/aws-codeguru-cli.zip" 45 | - run: unzip aws-codeguru-cli.zip 46 | 47 | # Run CodeGuru Reviewer on the current project and use the --fail-on-recommendations option to fail 48 | # if any recommendations are reported. 49 | - name: Run Code Guru 50 | if: steps.iam-role.outcome == 'success' 51 | run: ./aws-codeguru-cli/bin/aws-codeguru-cli --region us-west-2 -r ./ -s ./src/main/java -b ./build/classes/java/main -c "${{ github.event.before }}:${{ github.event.after }}" --no-prompt --fail-on-recommendations 52 | -------------------------------------------------------------------------------- /.github/workflows/java-compatible.yml: -------------------------------------------------------------------------------- 1 | 2 | name: Build with different JDKs 3 | 4 | on: push 5 | 6 | permissions: 7 | id-token: write 8 | contents: write 9 | 10 | jobs: 11 | build: 12 | runs-on: ${{ matrix.os }} 13 | strategy: 14 | matrix: 15 | java: [ '8', '11', '16', '17' ] 16 | os: [ubuntu-latest, windows-latest] 17 | name: Java ${{ matrix.Java }} build on ${{ matrix.os }} 18 | 19 | steps: 20 | - uses: actions/checkout@v2 21 | - name: Setup java 22 | uses: actions/setup-java@v2 23 | with: 24 | distribution: 'temurin' 25 | java-version: ${{ matrix.java }} 26 | - name: Build project 27 | run: ./gradlew clean test installDist --info 28 | - name: Run cli 29 | run: ./build/install/aws-codeguru-cli/bin/aws-codeguru-cli 30 | 31 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | build 2 | .gradle 3 | .vscode 4 | .guru 5 | code-guru 6 | .DS_Store 7 | .idea 8 | test-output* 9 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | ## Code of Conduct 2 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 3 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 4 | opensource-codeofconduct@amazon.com with any additional questions or comments. 5 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributing Guidelines 2 | 3 | Thank you for your interest in contributing to our project. Whether it's a bug report, new feature, correction, or additional 4 | documentation, we greatly value feedback and contributions from our community. 5 | 6 | Please read through this document before submitting any issues or pull requests to ensure we have all the necessary 7 | information to effectively respond to your bug report or contribution. 8 | 9 | 10 | ## Reporting Bugs/Feature Requests 11 | 12 | We welcome you to use the GitHub issue tracker to report bugs or suggest features. 13 | 14 | When filing an issue, please check existing open, or recently closed, issues to make sure somebody else hasn't already 15 | reported the issue. Please try to include as much information as you can. Details like these are incredibly useful: 16 | 17 | * A reproducible test case or series of steps 18 | * The version of our code being used 19 | * Any modifications you've made relevant to the bug 20 | * Anything unusual about your environment or deployment 21 | 22 | 23 | ## Contributing via Pull Requests 24 | Contributions via pull requests are much appreciated. Before sending us a pull request, please ensure that: 25 | 26 | 1. You are working against the latest source on the *main* branch. 27 | 2. You check existing open, and recently merged, pull requests to make sure someone else hasn't addressed the problem already. 28 | 3. You open an issue to discuss any significant work - we would hate for your time to be wasted. 29 | 30 | To send us a pull request, please: 31 | 32 | 1. Fork the repository. 33 | 2. Modify the source; please focus on the specific change you are contributing. If you also reformat all the code, it will be hard for us to focus on your change. 34 | 3. Ensure local tests pass. 35 | 4. Commit to your fork using clear commit messages. 36 | 5. Send us a pull request, answering any default questions in the pull request interface. 37 | 6. Pay attention to any automated CI failures reported in the pull request, and stay involved in the conversation. 38 | 39 | GitHub provides additional document on [forking a repository](https://help.github.com/articles/fork-a-repo/) and 40 | [creating a pull request](https://help.github.com/articles/creating-a-pull-request/). 41 | 42 | 43 | ## Finding contributions to work on 44 | Looking at the existing issues is a great way to find something to contribute on. As our projects, by default, use the default GitHub issue labels (enhancement/bug/duplicate/help wanted/invalid/question/wontfix), looking at any 'help wanted' issues is a great place to start. 45 | 46 | 47 | ## Code of Conduct 48 | This project has adopted the [Amazon Open Source Code of Conduct](https://aws.github.io/code-of-conduct). 49 | For more information see the [Code of Conduct FAQ](https://aws.github.io/code-of-conduct-faq) or contact 50 | opensource-codeofconduct@amazon.com with any additional questions or comments. 51 | 52 | 53 | ## Security issue notifications 54 | If you discover a potential security issue in this project we ask that you notify AWS/Amazon Security via our [vulnerability reporting page](http://aws.amazon.com/security/vulnerability-reporting/). Please do **not** create a public github issue. 55 | 56 | 57 | ## Licensing 58 | 59 | See the [LICENSE](LICENSE) file for our project's licensing. We will ask you to confirm the licensing of your contribution. 60 | -------------------------------------------------------------------------------- /NOTICE: -------------------------------------------------------------------------------- 1 | Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. 2 | -------------------------------------------------------------------------------- /build.gradle: -------------------------------------------------------------------------------- 1 | buildscript { 2 | repositories { 3 | maven { 4 | url "https://plugins.gradle.org/m2/" 5 | } 6 | } 7 | dependencies { 8 | classpath "com.github.spotbugs.snom:spotbugs-gradle-plugin:5.0.6" 9 | } 10 | } 11 | 12 | plugins { 13 | id 'java' 14 | id 'application' 15 | 16 | id "com.github.spotbugs" version "5.0.6" 17 | id 'checkstyle' 18 | } 19 | 20 | repositories { 21 | mavenCentral() 22 | } 23 | 24 | defaultTasks 'clean', 'check', 'installDist' 25 | 26 | version = '0.2.4' 27 | jar.archiveName = "${jar.baseName}.${jar.extension}" 28 | distZip.archiveName = "${jar.baseName}.zip" 29 | 30 | application { 31 | mainClass = 'com.amazonaws.gurureviewercli.Main' 32 | } 33 | 34 | dependencies { 35 | implementation 'software.amazon.awssdk:s3:2.17.113' 36 | implementation 'software.amazon.awssdk:sts:2.17.113' 37 | implementation 'software.amazon.awssdk:codegurureviewer:2.17.113' 38 | implementation 'software.amazon.awssdk:sdk-core:2.17.113' 39 | 40 | implementation 'com.fasterxml.jackson.core:jackson-databind:2.13.0' 41 | implementation 'com.fasterxml.jackson.core:jackson-core:2.13.0' 42 | implementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.13.0' 43 | 44 | implementation 'com.beust:jcommander:1.81' 45 | 46 | implementation 'org.eclipse.jgit:org.eclipse.jgit:5.13.0.202109080827-r' 47 | 48 | implementation 'com.contrastsecurity:java-sarif:2.0' 49 | 50 | implementation 'org.apache.logging.log4j:log4j-core:2.17.1' 51 | implementation 'org.slf4j:slf4j-nop:2.0.0-alpha5' 52 | 53 | // For Java 9+ 54 | implementation 'javax.xml.bind:jaxb-api:2.3.1' 55 | 56 | implementation 'org.commonmark:commonmark:0.18.1' 57 | 58 | implementation 'org.beryx:text-io:3.4.1' 59 | 60 | implementation 'com.google.code.findbugs:jsr305:3.0.2' 61 | 62 | implementation("com.google.guava:guava:31.1-jre") 63 | 64 | compileOnly 'org.projectlombok:lombok:1.18.22' 65 | annotationProcessor 'org.projectlombok:lombok:1.18.22' 66 | 67 | testCompileOnly 'org.projectlombok:lombok:1.18.22' 68 | testAnnotationProcessor 'org.projectlombok:lombok:1.18.22' 69 | 70 | testImplementation 'org.junit.jupiter:junit-jupiter-api:5.8.2' 71 | testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine:5.8.2' 72 | testImplementation 'org.mockito:mockito-junit-jupiter:4.2.0' 73 | 74 | } 75 | 76 | test { 77 | useJUnitPlatform() 78 | } 79 | 80 | apply plugin: 'checkstyle' 81 | checkstyle { 82 | toolVersion = '8.37' 83 | configFile = file("${rootDir}/config/checkstyle/checkstyle.xml") 84 | ignoreFailures = true 85 | } 86 | checkstyleMain { 87 | source = 'src/main/java' 88 | } 89 | checkstyleTest { 90 | source = 'src/test/java' 91 | } 92 | 93 | /** 94 | * SpotBugs Plugin 95 | */ 96 | spotbugs { 97 | showStackTraces = false 98 | reportsDir = file("$buildDir/reports/spotbugs") 99 | ignoreFailures = false 100 | includeFilter = file("config/spotbugs/spotbugs-exclude.xml") 101 | showProgress = true 102 | effort = 'default' 103 | reportLevel = 'default' 104 | } 105 | 106 | 107 | 108 | -------------------------------------------------------------------------------- /config/checkstyle/checkstyle.xml: -------------------------------------------------------------------------------- 1 | 2 | 5 | 6 | 22 | 23 | 24 | 25 | 26 | 27 | 28 | 29 | 30 | 31 | 32 | 33 | 34 | 35 | 36 | 37 | 38 | 39 | 40 | 41 | 42 | 43 | 44 | 45 | 46 | 47 | 48 | 49 | 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 69 | 70 | 80 | 81 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | 118 | 119 | 120 | 121 | 122 | 123 | 124 | 125 | 126 | 127 | 128 | 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | 137 | 138 | 139 | 140 | 141 | 142 | 143 | 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | 168 | 169 | 170 | 171 | 172 | 173 | 174 | 175 | 176 | 177 | 178 | 179 | -------------------------------------------------------------------------------- /config/checkstyle/suppressions.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | -------------------------------------------------------------------------------- /config/spotbugs/spotbugs-exclude.xml: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.2-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /gradlew: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env sh 2 | 3 | # 4 | # Copyright 2015 the original author or authors. 5 | # 6 | # Licensed under the Apache License, Version 2.0 (the "License"); 7 | # you may not use this file except in compliance with the License. 8 | # You may obtain a copy of the License at 9 | # 10 | # https://www.apache.org/licenses/LICENSE-2.0 11 | # 12 | # Unless required by applicable law or agreed to in writing, software 13 | # distributed under the License is distributed on an "AS IS" BASIS, 14 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 | # See the License for the specific language governing permissions and 16 | # limitations under the License. 17 | # 18 | 19 | ############################################################################## 20 | ## 21 | ## Gradle start up script for UN*X 22 | ## 23 | ############################################################################## 24 | 25 | # Attempt to set APP_HOME 26 | # Resolve links: $0 may be a link 27 | PRG="$0" 28 | # Need this for relative symlinks. 29 | while [ -h "$PRG" ] ; do 30 | ls=`ls -ld "$PRG"` 31 | link=`expr "$ls" : '.*-> \(.*\)$'` 32 | if expr "$link" : '/.*' > /dev/null; then 33 | PRG="$link" 34 | else 35 | PRG=`dirname "$PRG"`"/$link" 36 | fi 37 | done 38 | SAVED="`pwd`" 39 | cd "`dirname \"$PRG\"`/" >/dev/null 40 | APP_HOME="`pwd -P`" 41 | cd "$SAVED" >/dev/null 42 | 43 | APP_NAME="Gradle" 44 | APP_BASE_NAME=`basename "$0"` 45 | 46 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 47 | DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' 48 | 49 | # Use the maximum available, or set MAX_FD != -1 to use that value. 50 | MAX_FD="maximum" 51 | 52 | warn () { 53 | echo "$*" 54 | } 55 | 56 | die () { 57 | echo 58 | echo "$*" 59 | echo 60 | exit 1 61 | } 62 | 63 | # OS specific support (must be 'true' or 'false'). 64 | cygwin=false 65 | msys=false 66 | darwin=false 67 | nonstop=false 68 | case "`uname`" in 69 | CYGWIN* ) 70 | cygwin=true 71 | ;; 72 | Darwin* ) 73 | darwin=true 74 | ;; 75 | MINGW* ) 76 | msys=true 77 | ;; 78 | NONSTOP* ) 79 | nonstop=true 80 | ;; 81 | esac 82 | 83 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar 84 | 85 | 86 | # Determine the Java command to use to start the JVM. 87 | if [ -n "$JAVA_HOME" ] ; then 88 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 89 | # IBM's JDK on AIX uses strange locations for the executables 90 | JAVACMD="$JAVA_HOME/jre/sh/java" 91 | else 92 | JAVACMD="$JAVA_HOME/bin/java" 93 | fi 94 | if [ ! -x "$JAVACMD" ] ; then 95 | die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME 96 | 97 | Please set the JAVA_HOME variable in your environment to match the 98 | location of your Java installation." 99 | fi 100 | else 101 | JAVACMD="java" 102 | which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 103 | 104 | Please set the JAVA_HOME variable in your environment to match the 105 | location of your Java installation." 106 | fi 107 | 108 | # Increase the maximum file descriptors if we can. 109 | if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then 110 | MAX_FD_LIMIT=`ulimit -H -n` 111 | if [ $? -eq 0 ] ; then 112 | if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then 113 | MAX_FD="$MAX_FD_LIMIT" 114 | fi 115 | ulimit -n $MAX_FD 116 | if [ $? -ne 0 ] ; then 117 | warn "Could not set maximum file descriptor limit: $MAX_FD" 118 | fi 119 | else 120 | warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" 121 | fi 122 | fi 123 | 124 | # For Darwin, add options to specify how the application appears in the dock 125 | if $darwin; then 126 | GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" 127 | fi 128 | 129 | # For Cygwin or MSYS, switch paths to Windows format before running java 130 | if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then 131 | APP_HOME=`cygpath --path --mixed "$APP_HOME"` 132 | CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` 133 | 134 | JAVACMD=`cygpath --unix "$JAVACMD"` 135 | 136 | # We build the pattern for arguments to be converted via cygpath 137 | ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` 138 | SEP="" 139 | for dir in $ROOTDIRSRAW ; do 140 | ROOTDIRS="$ROOTDIRS$SEP$dir" 141 | SEP="|" 142 | done 143 | OURCYGPATTERN="(^($ROOTDIRS))" 144 | # Add a user-defined pattern to the cygpath arguments 145 | if [ "$GRADLE_CYGPATTERN" != "" ] ; then 146 | OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" 147 | fi 148 | # Now convert the arguments - kludge to limit ourselves to /bin/sh 149 | i=0 150 | for arg in "$@" ; do 151 | CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` 152 | CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option 153 | 154 | if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition 155 | eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` 156 | else 157 | eval `echo args$i`="\"$arg\"" 158 | fi 159 | i=`expr $i + 1` 160 | done 161 | case $i in 162 | 0) set -- ;; 163 | 1) set -- "$args0" ;; 164 | 2) set -- "$args0" "$args1" ;; 165 | 3) set -- "$args0" "$args1" "$args2" ;; 166 | 4) set -- "$args0" "$args1" "$args2" "$args3" ;; 167 | 5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; 168 | 6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; 169 | 7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; 170 | 8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; 171 | 9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; 172 | esac 173 | fi 174 | 175 | # Escape application args 176 | save () { 177 | for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done 178 | echo " " 179 | } 180 | APP_ARGS=`save "$@"` 181 | 182 | # Collect all arguments for the java command, following the shell quoting and substitution rules 183 | eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" 184 | 185 | exec "$JAVACMD" "$@" 186 | -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @rem 2 | @rem Copyright 2015 the original author or authors. 3 | @rem 4 | @rem Licensed under the Apache License, Version 2.0 (the "License"); 5 | @rem you may not use this file except in compliance with the License. 6 | @rem You may obtain a copy of the License at 7 | @rem 8 | @rem https://www.apache.org/licenses/LICENSE-2.0 9 | @rem 10 | @rem Unless required by applicable law or agreed to in writing, software 11 | @rem distributed under the License is distributed on an "AS IS" BASIS, 12 | @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | @rem See the License for the specific language governing permissions and 14 | @rem limitations under the License. 15 | @rem 16 | 17 | @if "%DEBUG%" == "" @echo off 18 | @rem ########################################################################## 19 | @rem 20 | @rem Gradle startup script for Windows 21 | @rem 22 | @rem ########################################################################## 23 | 24 | @rem Set local scope for the variables with windows NT shell 25 | if "%OS%"=="Windows_NT" setlocal 26 | 27 | set DIRNAME=%~dp0 28 | if "%DIRNAME%" == "" set DIRNAME=. 29 | set APP_BASE_NAME=%~n0 30 | set APP_HOME=%DIRNAME% 31 | 32 | @rem Resolve any "." and ".." in APP_HOME to make it shorter. 33 | for %%i in ("%APP_HOME%") do set APP_HOME=%%~fi 34 | 35 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 36 | set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" 37 | 38 | @rem Find java.exe 39 | if defined JAVA_HOME goto findJavaFromJavaHome 40 | 41 | set JAVA_EXE=java.exe 42 | %JAVA_EXE% -version >NUL 2>&1 43 | if "%ERRORLEVEL%" == "0" goto execute 44 | 45 | echo. 46 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 47 | echo. 48 | echo Please set the JAVA_HOME variable in your environment to match the 49 | echo location of your Java installation. 50 | 51 | goto fail 52 | 53 | :findJavaFromJavaHome 54 | set JAVA_HOME=%JAVA_HOME:"=% 55 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 56 | 57 | if exist "%JAVA_EXE%" goto execute 58 | 59 | echo. 60 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 61 | echo. 62 | echo Please set the JAVA_HOME variable in your environment to match the 63 | echo location of your Java installation. 64 | 65 | goto fail 66 | 67 | :execute 68 | @rem Setup the command line 69 | 70 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 71 | 72 | 73 | @rem Execute Gradle 74 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %* 75 | 76 | :end 77 | @rem End local scope for the variables with windows NT shell 78 | if "%ERRORLEVEL%"=="0" goto mainEnd 79 | 80 | :fail 81 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 82 | rem the _cmd.exe /c_ return code! 83 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 84 | exit /b 1 85 | 86 | :mainEnd 87 | if "%OS%"=="Windows_NT" endlocal 88 | 89 | :omega 90 | -------------------------------------------------------------------------------- /lombok.config: -------------------------------------------------------------------------------- 1 | lombok.anyConstructor.addConstructorProperties=true 2 | -------------------------------------------------------------------------------- /settings.gradle: -------------------------------------------------------------------------------- 1 | // Always define a settings file: 2 | // https://docs.gradle.org/current/userguide/organizing_gradle_projects.html#always_define_a_settings_file 3 | rootProject.name = 'aws-codeguru-cli' 4 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/adapter/ResultsAdapter.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.adapter; 2 | 3 | import java.io.FileOutputStream; 4 | import java.io.IOException; 5 | import java.io.OutputStreamWriter; 6 | import java.nio.charset.StandardCharsets; 7 | import java.nio.file.Path; 8 | import java.util.Collections; 9 | import java.util.List; 10 | import java.util.stream.Collectors; 11 | 12 | import lombok.val; 13 | import org.commonmark.node.Node; 14 | import org.commonmark.parser.Parser; 15 | import org.commonmark.renderer.html.HtmlRenderer; 16 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 17 | 18 | import com.amazonaws.gurureviewercli.model.ScanMetaData; 19 | import com.amazonaws.gurureviewercli.util.JsonUtil; 20 | import com.amazonaws.gurureviewercli.util.Log; 21 | import com.amazonaws.gurureviewercli.util.SarifConverter; 22 | 23 | /** 24 | * Util to save Guru recommendations to disk and convert them to HTML. 25 | */ 26 | public final class ResultsAdapter { 27 | 28 | public static void saveResults(final Path outputDir, 29 | final List results, 30 | final ScanMetaData scanMetaData) throws IOException { 31 | val jsonFile = outputDir.resolve("recommendations.json"); 32 | JsonUtil.storeRecommendations(results, jsonFile); 33 | Log.info("Recommendations in Json format written to:%n%s", jsonFile.normalize().toUri()); 34 | val sarifFile = outputDir.resolve("recommendations.sarif.json"); 35 | JsonUtil.writeSarif(SarifConverter.createSarifReport(results), sarifFile); 36 | Log.info("Recommendations in SARIF format written to:%n%s", sarifFile.normalize().toUri()); 37 | 38 | createHtmlReport(outputDir, scanMetaData, results); 39 | } 40 | 41 | private static void createHtmlReport(final Path outputDir, 42 | final ScanMetaData scanMetaData, 43 | final List recommendations) throws IOException { 44 | 45 | int validFindings = 0; 46 | // sort by file name and line number 47 | sortByFileName(recommendations); 48 | 49 | Parser parser = Parser.builder().build(); 50 | HtmlRenderer renderer = HtmlRenderer.builder().build(); 51 | 52 | val htmlFile = outputDir.resolve("codeguru-report.html"); 53 | try (OutputStreamWriter writer = 54 | new OutputStreamWriter(new FileOutputStream(htmlFile.toFile()), StandardCharsets.UTF_8)) { 55 | 56 | writer.write("\n\n"); 57 | writer.write("\n"); 58 | writer.write("

CodeGuru Reviewer Recommendations

\n"); 59 | val awsUrlPrfix = "https://console.aws.amazon.com/codeguru/reviewer"; 60 | val associationUrl = String.format("%s?region=%s#/ciworkflows/associationdetails/%s", 61 | awsUrlPrfix, scanMetaData.getRegion(), scanMetaData.getAssociationArn()); 62 | val scanUrl = String.format("%s?region=%s#/codereviews/details/%s", 63 | awsUrlPrfix, scanMetaData.getRegion(), scanMetaData.getCodeReviewArn()); 64 | 65 | writer.write(renderer.render(parser.parse(String.format("**CodeGuru Repository ARN**: [%s](%s)%n", 66 | scanMetaData.getAssociationArn(), 67 | associationUrl)))); 68 | writer.write(renderer.render(parser.parse(String.format("**CodeGuru Scan ARN**: [%s](%s)%n", 69 | scanMetaData.getCodeReviewArn(), 70 | scanUrl)))); 71 | writer.write("\n

\n"); 72 | 73 | for (val recommendation : recommendations) { 74 | val filePath = scanMetaData.getRepositoryRoot().resolve(recommendation.filePath()).toAbsolutePath(); 75 | if (filePath == null || !filePath.toFile().isFile()) { 76 | if (filePath != null && !(filePath.endsWith(".") || filePath.endsWith("/"))) { 77 | Log.warn("Dropping finding because file not found on disk: %s", filePath); 78 | } 79 | continue; 80 | } 81 | validFindings++; 82 | String lineMsg; 83 | if (!recommendation.startLine().equals(recommendation.endLine()) 84 | && recommendation.endLine() != null) { 85 | lineMsg = String.format("### In: [%s](%s) L%d %n", 86 | filePath, filePath.toUri(), 87 | recommendation.startLine()); 88 | } else { 89 | lineMsg = String.format("### In: [%s](%s) L%d - L%d %n", 90 | filePath, filePath.toUri(), 91 | recommendation.startLine(), 92 | recommendation.endLine()); 93 | } 94 | 95 | Node document = parser.parse(String.format("### In: [%s](%s) L%d %n", 96 | filePath, filePath.toUri(), 97 | recommendation.startLine())); 98 | writer.write(renderer.render(document)); 99 | 100 | document = parser.parse("**Issue:** " + recommendation.description()); 101 | writer.write(renderer.render(document)); 102 | 103 | writer.write(String.format("

Severity: %s

", recommendation.severity())); 104 | 105 | if (recommendation.ruleMetadata() != null && recommendation.ruleMetadata().ruleId() != null) { 106 | val manifest = recommendation.ruleMetadata(); 107 | writer.write(String.format("

Rule ID: %s

", manifest.ruleId())); 108 | writer.write(String.format("

Rule Name: %s

", manifest.ruleName())); 109 | document = parser.parse("**Description:** " + manifest.longDescription()); 110 | writer.write(renderer.render(document)); 111 | if (manifest.ruleTags() != null && !manifest.ruleTags().isEmpty()) { 112 | val mdList = manifest.ruleTags().stream() 113 | .map(s -> String.format("- %s%n", s)) 114 | .collect(Collectors.joining()); 115 | document = parser.parse("**Tags:**\n" + mdList); 116 | writer.write(renderer.render(document)); 117 | } 118 | } 119 | writer.write("\n

\n"); 120 | } 121 | writer.write("\n"); 122 | writer.write("\n"); 123 | } 124 | Log.info("Report with %d recommendations written to:%n%s", validFindings, htmlFile.normalize().toUri()); 125 | } 126 | 127 | 128 | private static void sortByFileName(final List recommendations) { 129 | Collections.sort(recommendations, (o1, o2) -> { 130 | int pathComp = o1.filePath().compareTo(o2.filePath()); 131 | if (pathComp == 0) { 132 | return o1.startLine().compareTo(o2.startLine()); 133 | } 134 | return pathComp; 135 | }); 136 | } 137 | 138 | private ResultsAdapter() { 139 | // do not instantiate 140 | } 141 | } 142 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/exceptions/GuruCliException.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.exceptions; 2 | 3 | import lombok.Getter; 4 | 5 | import com.amazonaws.gurureviewercli.model.ErrorCodes; 6 | 7 | public class GuruCliException extends RuntimeException { 8 | 9 | public GuruCliException(final ErrorCodes errorCode) { 10 | this.errorCode = errorCode; 11 | } 12 | 13 | public GuruCliException(final ErrorCodes errorCode, final String msg) { 14 | super(msg); 15 | this.errorCode = errorCode; 16 | } 17 | 18 | public GuruCliException(final ErrorCodes errorCode, final String msg, final Throwable cause) { 19 | super(msg, cause); 20 | this.errorCode = errorCode; 21 | } 22 | 23 | @Getter 24 | private ErrorCodes errorCode; 25 | 26 | } 27 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/Configuration.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model; 2 | 3 | import javax.annotation.Nullable; 4 | import java.nio.file.Path; 5 | import java.util.Collection; 6 | 7 | import lombok.Builder; 8 | import lombok.Data; 9 | import org.beryx.textio.TextIO; 10 | import software.amazon.awssdk.services.codegurureviewer.CodeGuruReviewerClient; 11 | import software.amazon.awssdk.services.s3.S3Client; 12 | 13 | /** 14 | * Class to hold all shared configuration data. This object is mutable and information is added as it becomes 15 | * available. 16 | */ 17 | @Data 18 | @Builder 19 | public class Configuration { 20 | 21 | private boolean interactiveMode; 22 | 23 | private CodeGuruReviewerClient guruFrontendService; 24 | 25 | private S3Client s3Client; 26 | 27 | private String accountId; 28 | 29 | private String region; 30 | 31 | private String repoName; 32 | 33 | private String keyId; 34 | 35 | private Path rootDir; 36 | 37 | private TextIO textIO; 38 | 39 | private String bucketName; 40 | 41 | private @Nullable 42 | String beforeCommit; 43 | 44 | private @Nullable 45 | String afterCommit; 46 | 47 | private @Nullable 48 | Collection versionedFiles; 49 | } 50 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/ErrorCodes.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model; 2 | 3 | import lombok.Getter; 4 | 5 | /** 6 | * Error Codes for the CLI. 7 | */ 8 | public enum ErrorCodes { 9 | 10 | ASSOCIATION_FAILED("Failed to associate with CodeGuru"), 11 | GIT_INVALID_DIR("Invalid Git Directory"), 12 | GIT_BRANCH_MISSING("Cannot determine Git branch"), 13 | DIR_NOT_FOUND("Provided path is not a valid directory"), 14 | GIT_INVALID_COMMITS("Not a valid commit"), 15 | GIT_EMPTY_DIFF("Git Diff is empty"), 16 | AWS_INIT_ERROR("Failed to initialize AWS API"), 17 | BAD_BUCKET_NAME("CodeGuru Reviewer expects bucket names to start with codeguru-reviewer-"), 18 | USER_ABORT("Abort"); 19 | 20 | @Getter 21 | final String errorMessage; 22 | 23 | ErrorCodes(String msg) { 24 | this.errorMessage = msg; 25 | } 26 | 27 | @Override 28 | public String toString() { 29 | return errorMessage; 30 | } 31 | } 32 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/GitMetaData.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model; 2 | 3 | import javax.annotation.Nullable; 4 | import java.nio.file.Path; 5 | import java.util.Collection; 6 | 7 | import lombok.Builder; 8 | import lombok.Data; 9 | 10 | /** 11 | * Metadata collected about the analyzed git repo. 12 | */ 13 | @Builder 14 | @Data 15 | public class GitMetaData { 16 | 17 | private Path repoRoot; 18 | 19 | private String userName; 20 | 21 | private String currentBranch; 22 | 23 | @Builder.Default 24 | private String pullRequestId = "0"; 25 | 26 | private @Nullable String remoteUrl; 27 | 28 | private @Nullable String beforeCommit; 29 | 30 | private @Nullable String afterCommit; 31 | 32 | private @Nullable Collection versionedFiles; 33 | 34 | } 35 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/Recommendation.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model; 2 | 3 | import java.util.List; 4 | 5 | import lombok.Data; 6 | import lombok.NoArgsConstructor; 7 | import lombok.val; 8 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 9 | 10 | /** 11 | * Serializable recommendation class 12 | */ 13 | @Data 14 | @NoArgsConstructor 15 | public class Recommendation { 16 | 17 | private String filePath; 18 | private String recommendationId; 19 | private Integer startLine; 20 | private Integer endLine; 21 | private String description; 22 | private String recommendationCategory; 23 | private RuleMetadata ruleMetadata; 24 | private String severity; 25 | 26 | @Data 27 | public static final class RuleMetadata { 28 | private String ruleId; 29 | private String ruleName; 30 | private String shortDescription; 31 | private String longDescription; 32 | private List ruleTags; 33 | } 34 | 35 | public RecommendationSummary toRecommendationSummary() { 36 | val rm = software.amazon.awssdk.services.codegurureviewer.model. 37 | RuleMetadata.builder() 38 | .ruleId(ruleMetadata.ruleId) 39 | .longDescription(ruleMetadata.longDescription) 40 | .shortDescription(ruleMetadata.shortDescription) 41 | .ruleName(ruleMetadata.ruleName) 42 | .ruleTags(ruleMetadata.ruleTags) 43 | .build(); 44 | return RecommendationSummary.builder() 45 | .description(description) 46 | .recommendationId(recommendationId) 47 | .recommendationCategory(recommendationCategory) 48 | .filePath(filePath) 49 | .startLine(startLine) 50 | .endLine(endLine) 51 | .severity(severity) 52 | .ruleMetadata(rm) 53 | .build(); 54 | } 55 | } 56 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/ScanMetaData.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model; 2 | 3 | import java.nio.file.Path; 4 | import java.util.List; 5 | 6 | import lombok.AllArgsConstructor; 7 | import lombok.Builder; 8 | import lombok.Data; 9 | import lombok.NoArgsConstructor; 10 | 11 | /** 12 | * Data class to store information about a started CodeGuru Review. 13 | */ 14 | @Data 15 | @Builder 16 | @NoArgsConstructor 17 | @AllArgsConstructor 18 | public class ScanMetaData { 19 | 20 | private String associationArn; 21 | 22 | private String codeReviewArn; 23 | 24 | private String region; 25 | 26 | private Path repositoryRoot; 27 | 28 | private List sourceDirectories; 29 | 30 | private String bucketName; 31 | 32 | private String sourceKey; 33 | 34 | private String buildKey; 35 | } 36 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/bitbucket/CodeInsightsAnnotation.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model.bitbucket; 2 | 3 | import com.fasterxml.jackson.annotation.JsonProperty; 4 | import lombok.AllArgsConstructor; 5 | import lombok.Builder; 6 | import lombok.Data; 7 | import lombok.NoArgsConstructor; 8 | import lombok.extern.log4j.Log4j2; 9 | 10 | /** 11 | * Bitbucket CodeInsight annotation. 12 | * See https://developer.atlassian.com/cloud/bitbucket/rest/api-group-reports/#api-group-reports 13 | * 14 | * Example 15 | * { 16 | * "external_id": "CodeGuruReviewer-02-annotation002", 17 | * "title": "Bug report", 18 | * "annotation_type": "BUG", 19 | * "summary": "This line might introduce a bug.", 20 | * "severity": "MEDIUM", 21 | * "path": "my-service/src/main/java/com/myCompany/mysystem/logic/Helper.java", 22 | * "line": 13 23 | * } 24 | */ 25 | @Log4j2 26 | @Builder 27 | @Data 28 | @AllArgsConstructor 29 | @NoArgsConstructor 30 | public class CodeInsightsAnnotation { 31 | 32 | private String title; 33 | 34 | @JsonProperty("external_id") 35 | private String externalId; 36 | 37 | @JsonProperty("annotation_type") 38 | private String annotationType; 39 | 40 | private String path; 41 | 42 | private long line; 43 | 44 | private String summary; 45 | 46 | private String severity; 47 | 48 | private String details; 49 | 50 | private String link; 51 | } 52 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/bitbucket/CodeInsightsReport.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model.bitbucket; 2 | 3 | import java.util.List; 4 | 5 | import com.fasterxml.jackson.annotation.JsonProperty; 6 | import lombok.AllArgsConstructor; 7 | import lombok.Builder; 8 | import lombok.Data; 9 | import lombok.NoArgsConstructor; 10 | import lombok.extern.log4j.Log4j2; 11 | 12 | /** 13 | * Bitbucket CodeInsight report format. 14 | * See https://developer.atlassian.com/cloud/bitbucket/rest/api-group-reports/#api-group-reports 15 | * Example: 16 | * { 17 | * "title": "Amazon CodeGuru Reviewer Scan Report", 18 | * "details": "Some more text.", 19 | * "report_type": "SECURITY", 20 | * "reporter": "Amazon CodeGuru Reviewer", 21 | * "link": "http://www.CodeGuruReviewer.com/reports/001", 22 | * "result": "FAILED", 23 | * "data": [ 24 | * { 25 | * "title": "Duration (seconds)", 26 | * "type": "DURATION", 27 | * "value": 14 28 | * }, 29 | * { 30 | * "title": "Safe to merge?", 31 | * "type": "BOOLEAN", 32 | * "value": false 33 | * } 34 | * ] 35 | * } 36 | */ 37 | @Log4j2 38 | @Builder 39 | @Data 40 | @AllArgsConstructor 41 | @NoArgsConstructor 42 | public class CodeInsightsReport { 43 | 44 | private String title; 45 | 46 | private String details; 47 | 48 | private String result; 49 | 50 | private String link; 51 | 52 | private List data; 53 | 54 | @JsonProperty("reporter") 55 | private String reporter; 56 | 57 | @JsonProperty("report_type") 58 | private final String reportType = "SECURITY"; 59 | 60 | } 61 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/bitbucket/CodeInsightsReportData.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model.bitbucket; 2 | 3 | import lombok.AllArgsConstructor; 4 | import lombok.Builder; 5 | import lombok.Data; 6 | import lombok.NoArgsConstructor; 7 | import lombok.extern.log4j.Log4j2; 8 | 9 | /** 10 | * Bitbucket CodeInsight report data. 11 | * See https://developer.atlassian.com/cloud/bitbucket/rest/api-group-reports/#api-group-reports 12 | */ 13 | @Log4j2 14 | @Builder 15 | @Data 16 | @AllArgsConstructor 17 | @NoArgsConstructor 18 | public class CodeInsightsReportData { 19 | 20 | private String title; 21 | 22 | private String type; 23 | 24 | private Object value; 25 | } 26 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/configfile/CustomConfiguration.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model.configfile; 2 | 3 | import java.io.IOException; 4 | import java.nio.file.Path; 5 | import java.util.ArrayList; 6 | import java.util.List; 7 | 8 | import com.fasterxml.jackson.core.JsonParseException; 9 | import com.fasterxml.jackson.databind.JsonMappingException; 10 | import com.fasterxml.jackson.databind.MapperFeature; 11 | import com.fasterxml.jackson.databind.ObjectMapper; 12 | import com.fasterxml.jackson.dataformat.yaml.YAMLMapper; 13 | import lombok.AllArgsConstructor; 14 | import lombok.Builder; 15 | import lombok.Data; 16 | import lombok.NoArgsConstructor; 17 | import lombok.extern.log4j.Log4j2; 18 | 19 | import com.amazonaws.gurureviewercli.util.Log; 20 | 21 | /** 22 | * Guru Configuration file. Customers can leave such a file in their repository to customize the behavior of 23 | * CodeGuru. E.g., to suppress recommendations in parts of the repository. 24 | */ 25 | @Log4j2 26 | @Builder 27 | @Data 28 | @AllArgsConstructor 29 | @NoArgsConstructor 30 | public class CustomConfiguration { 31 | 32 | private static final ObjectMapper YAML_MAPPER = 33 | YAMLMapper.builder() 34 | .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true) 35 | .build(); 36 | 37 | public static CustomConfiguration load(final Path file) throws IOException { 38 | try { 39 | return YAML_MAPPER.readValue(file.toFile(), CustomConfiguration.class); 40 | } catch (JsonParseException | JsonMappingException e) { 41 | Log.error("Failed to parse " + file); 42 | Log.error(e); 43 | } 44 | return null; 45 | } 46 | 47 | private static final String VERSION = "1.0"; 48 | 49 | @Builder.Default 50 | private String version = VERSION; 51 | 52 | @Builder.Default 53 | private List excludeFiles = new ArrayList<>(); 54 | 55 | private String excludeBelowSeverity; 56 | 57 | @Builder.Default 58 | private List excludeTags = new ArrayList<>(); 59 | 60 | @Builder.Default 61 | private List excludeById = new ArrayList<>(); 62 | 63 | @Builder.Default 64 | private List excludeRecommendations = new ArrayList<>(); 65 | 66 | } 67 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/model/configfile/ExcludeRecommendation.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.model.configfile; 2 | 3 | import java.util.List; 4 | 5 | import lombok.AllArgsConstructor; 6 | import lombok.Builder; 7 | import lombok.Data; 8 | import lombok.NoArgsConstructor; 9 | 10 | /** 11 | * Model class to exclude a detector in a given file. 12 | */ 13 | @Builder 14 | @Data 15 | @AllArgsConstructor 16 | @NoArgsConstructor 17 | public class ExcludeRecommendation { 18 | 19 | private String detectorId; 20 | 21 | private List locations; 22 | 23 | } 24 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/CodeInsightExport.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.io.IOException; 4 | import java.nio.file.Path; 5 | import java.util.ArrayList; 6 | import java.util.Collection; 7 | import java.util.stream.Collectors; 8 | 9 | import com.fasterxml.jackson.annotation.JsonInclude; 10 | import com.fasterxml.jackson.databind.DeserializationFeature; 11 | import com.fasterxml.jackson.databind.SerializationFeature; 12 | import com.fasterxml.jackson.databind.json.JsonMapper; 13 | import lombok.val; 14 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 15 | import software.amazon.awssdk.services.codegurureviewer.model.Severity; 16 | 17 | import com.amazonaws.gurureviewercli.model.ScanMetaData; 18 | import com.amazonaws.gurureviewercli.model.bitbucket.CodeInsightsAnnotation; 19 | import com.amazonaws.gurureviewercli.model.bitbucket.CodeInsightsReport; 20 | 21 | /** 22 | * Export Report and Annotations file for BitBucket CodeInsights. 23 | */ 24 | public final class CodeInsightExport { 25 | private static final String REPORT_FILE_NAME = "report.json"; 26 | private static final String ANNOTATIONS_FILE_NAME = "annotations.json"; 27 | 28 | private static final JsonMapper JSON_MAPPER = 29 | JsonMapper.builder() 30 | .serializationInclusion(JsonInclude.Include.NON_ABSENT) 31 | .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) 32 | .disable(SerializationFeature.WRITE_DURATIONS_AS_TIMESTAMPS) 33 | .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE) 34 | .enable(DeserializationFeature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE) 35 | .build(); 36 | 37 | public static void report(final Collection recommendations, 38 | final ScanMetaData scanMetaData, 39 | final Path outputDir) throws IOException { 40 | val reportTitle = "CodeGuru Reviewer report"; 41 | val url = String.format("https://console.aws.amazon.com/codeguru/reviewer?region=%s#/codereviews/details/%s", 42 | scanMetaData.getRegion(), scanMetaData.getCodeReviewArn()); 43 | val report = CodeInsightsReport.builder() 44 | .title(reportTitle) 45 | .reporter("CodeGuru Reviewer CLI") 46 | .details(String.format("CodeGuru Reviewer reported %d recommendations", 47 | recommendations.size())) 48 | .result(recommendations.isEmpty() ? "PASSED" : "FAILED") 49 | .link(url) 50 | .data(new ArrayList<>()) 51 | .build(); 52 | 53 | val annotations = recommendations.stream().map(r -> convert(r, reportTitle, url)) 54 | .collect(Collectors.toList()); 55 | 56 | JSON_MAPPER.writeValue(outputDir.resolve(REPORT_FILE_NAME).toFile(), report); 57 | JSON_MAPPER.writeValue(outputDir.resolve(ANNOTATIONS_FILE_NAME).toFile(), annotations); 58 | } 59 | 60 | private static CodeInsightsAnnotation convert(final RecommendationSummary recommendation, 61 | final String reportTitle, 62 | final String url) { 63 | String description = recommendation.recommendationCategoryAsString(); 64 | if (recommendation.ruleMetadata() != null) { 65 | description = recommendation.ruleMetadata().shortDescription(); 66 | } 67 | 68 | return CodeInsightsAnnotation.builder() 69 | .title(reportTitle) 70 | .externalId(recommendation.recommendationId()) 71 | .path(recommendation.filePath()) 72 | .line(recommendation.startLine()) 73 | .summary(description) 74 | .details(recommendation.description()) 75 | .link(url) 76 | .annotationType("Vulnerability".toUpperCase()) 77 | .severity(convertSeverity(recommendation.severity())) 78 | .build(); 79 | } 80 | 81 | private static String convertSeverity(Severity guruSeverity) { 82 | if (guruSeverity != null) { 83 | return guruSeverity.toString().toUpperCase(); // Bitbucket uses the same severity levels as CodeGuru. 84 | } 85 | return "Unknown"; 86 | } 87 | 88 | } 89 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/JsonUtil.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.io.IOException; 4 | import java.nio.file.Path; 5 | import java.util.List; 6 | import java.util.stream.Collectors; 7 | 8 | import com.contrastsecurity.sarif.SarifSchema210; 9 | import com.fasterxml.jackson.annotation.JsonAutoDetect; 10 | import com.fasterxml.jackson.annotation.JsonInclude; 11 | import com.fasterxml.jackson.annotation.PropertyAccessor; 12 | import com.fasterxml.jackson.core.type.TypeReference; 13 | import com.fasterxml.jackson.databind.MapperFeature; 14 | import com.fasterxml.jackson.databind.ObjectMapper; 15 | import com.fasterxml.jackson.databind.SerializationFeature; 16 | import com.fasterxml.jackson.databind.json.JsonMapper; 17 | import lombok.NonNull; 18 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 19 | 20 | import com.amazonaws.gurureviewercli.model.Recommendation; 21 | 22 | /** 23 | * Util class to load scan metadata 24 | */ 25 | public final class JsonUtil { 26 | 27 | private static final ObjectMapper OBJECT_MAPPER = 28 | JsonMapper.builder() 29 | .enable(SerializationFeature.INDENT_OUTPUT) 30 | .configure(MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES, true) 31 | .visibility(PropertyAccessor.FIELD, JsonAutoDetect.Visibility.ANY) 32 | .serializationInclusion(JsonInclude.Include.NON_EMPTY) 33 | .build(); 34 | 35 | public static List loadRecommendations(@NonNull final Path jsonFile) throws IOException { 36 | return OBJECT_MAPPER.readValue(jsonFile.toFile(), new TypeReference>() { 37 | }) 38 | .stream().map(Recommendation::toRecommendationSummary).collect(Collectors.toList()); 39 | } 40 | 41 | public static void storeRecommendations(@NonNull final List recommendations, 42 | @NonNull final Path targetFile) throws IOException { 43 | OBJECT_MAPPER.writeValue(targetFile.toFile(), recommendations); 44 | } 45 | 46 | public static void writeSarif(@NonNull final SarifSchema210 sarif, @NonNull final Path targetFile) 47 | throws IOException { 48 | OBJECT_MAPPER.writeValue(targetFile.toFile(), sarif); 49 | } 50 | 51 | private JsonUtil() { 52 | // do not initialize utility 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/Log.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.io.PrintWriter; 4 | import java.io.StringWriter; 5 | 6 | import org.beryx.textio.TextTerminal; 7 | import org.beryx.textio.system.SystemTextTerminal; 8 | 9 | public final class Log { 10 | 11 | private static final String TEXT_RESET = "\u001B[0m"; 12 | private static final String TEXT_BLACK = "\u001B[30m"; 13 | private static final String TEXT_RED = "\u001B[31m"; 14 | private static final String TEXT_GREEN = "\u001B[32m"; 15 | private static final String TEXT_YELLOW = "\u001B[33m"; 16 | private static final String TEXT_BLUE = "\u001B[34m"; 17 | private static final String TEXT_PURPLE = "\u001B[35m"; 18 | private static final String TEXT_CYAN = "\u001B[36m"; 19 | private static final String TEXT_WHITE = "\u001B[37m"; 20 | 21 | private static final String AWS_URL_PREFIX = "https://console.aws.amazon.com/codeguru/reviewer"; 22 | 23 | // can be overriden 24 | private static TextTerminal terminal = new SystemTextTerminal(); 25 | 26 | public static void setTerminal(final TextTerminal t) { 27 | terminal = t; 28 | } 29 | 30 | public static void print(final String format, final Object... args) { 31 | terminal.printf(format, args); 32 | } 33 | 34 | public static void println(final String format, final Object... args) { 35 | terminal.printf(format + "%n", args); 36 | } 37 | 38 | public static void info(final String format, final Object... args) { 39 | terminal.printf(TEXT_GREEN + format + TEXT_RESET + "%n", args); 40 | } 41 | 42 | public static void warn(final String format, final Object... args) { 43 | terminal.printf(TEXT_YELLOW + format + TEXT_RESET + "%n", args); 44 | } 45 | 46 | public static void error(final String format, final Object... args) { 47 | terminal.printf(TEXT_RED + format + TEXT_RESET + "%n", args); 48 | } 49 | 50 | public static void awsUrl(final String format, final Object... args) { 51 | terminal.printf(TEXT_CYAN + AWS_URL_PREFIX + format + TEXT_RESET + "%n", args); 52 | } 53 | 54 | public static void error(final Throwable t) { 55 | terminal.println(TEXT_RED + t.getMessage() + TEXT_RESET); 56 | StringWriter sw = new StringWriter(); 57 | PrintWriter pw = new PrintWriter(sw); 58 | t.printStackTrace(pw); 59 | terminal.println(sw.toString()); 60 | } 61 | 62 | private Log() { 63 | // do not initialize 64 | } 65 | } 66 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/RecommendationPrinter.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.util.ArrayList; 4 | import java.util.Collection; 5 | import java.util.Comparator; 6 | 7 | import lombok.NonNull; 8 | import lombok.val; 9 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 10 | import software.amazon.awssdk.services.codegurureviewer.model.Severity; 11 | 12 | /** 13 | * Utility class to print recommendations. 14 | */ 15 | public final class RecommendationPrinter { 16 | 17 | private RecommendationPrinter() { 18 | // do not instantiate 19 | } 20 | 21 | /** 22 | * Print recommendations to command line. 23 | * 24 | * @param recommendations List of recommendations 25 | */ 26 | public static void print(final Collection recommendations) { 27 | val sortedRecommendations = new ArrayList<>(recommendations); 28 | sortedRecommendations.sort(Comparator.comparing(RecommendationPrinter::severityToInt)); 29 | for (val recommendation : sortedRecommendations) { 30 | val sb = new StringBuilder(); 31 | sb.append("-----\n"); 32 | sb.append(String.format("ID: %s, rule %s with severity %s%n", 33 | recommendation.recommendationId(), 34 | recommendation.ruleMetadata().ruleId(), 35 | recommendation.severity())); 36 | sb.append(String.format("In %s line %d%n", recommendation.filePath(), recommendation.startLine())); 37 | sb.append(recommendation.description()); 38 | sb.append("\n"); 39 | Log.info(sb.toString()); 40 | } 41 | } 42 | 43 | /** 44 | * Convert the severity of a {@link RecommendationSummary} to integer, where lower number 45 | * means higher severity. 46 | * 47 | * @param rs A {@link RecommendationSummary}. 48 | * @return Integer value for severity, where 0 is the highest. 49 | */ 50 | public static Integer severityToInt(final RecommendationSummary rs) { 51 | if (rs == null || rs.severity() == null) { 52 | return 5; 53 | } 54 | return severityToInt(rs.severity().toString()); 55 | } 56 | 57 | /** 58 | * Convert the severity of a {@link RecommendationSummary} to integer, where lower number 59 | * means higher severity. 60 | * 61 | * @param severity Severity as String. 62 | * @return Integer value for severity, where 0 is the highest. 63 | */ 64 | public static Integer severityToInt(final @NonNull String severity) { 65 | if (Severity.CRITICAL.toString().equalsIgnoreCase(severity)) { 66 | return 0; 67 | } else if (Severity.HIGH.toString().equalsIgnoreCase(severity)) { 68 | return 1; 69 | } else if (Severity.MEDIUM.toString().equalsIgnoreCase(severity)) { 70 | return 2; 71 | } else if (Severity.LOW.toString().equalsIgnoreCase(severity)) { 72 | return 3; 73 | } 74 | return 5; 75 | } 76 | } 77 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/RecommendationsFilter.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.nio.file.FileSystems; 4 | import java.nio.file.PathMatcher; 5 | import java.nio.file.Paths; 6 | import java.util.ArrayList; 7 | import java.util.Collection; 8 | import java.util.List; 9 | 10 | import lombok.val; 11 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 12 | 13 | import com.amazonaws.gurureviewercli.model.configfile.CustomConfiguration; 14 | 15 | /** 16 | * Utility class to filter CodeGuru Reviewer recommendations based on the criteria in a 17 | * custom configuration file. 18 | */ 19 | public final class RecommendationsFilter { 20 | 21 | private static final String GLOB_PREFIX = "glob:"; 22 | 23 | private RecommendationsFilter() { 24 | // do not instantiate. 25 | } 26 | 27 | /** 28 | * Filter excluded recommendations. 29 | * 30 | * @param recommendations List of recommendations. 31 | * @param configuration Custom Configuration file that defines filters. 32 | * @return Filtered list. 33 | */ 34 | public static List filterRecommendations( 35 | final Collection recommendations, 36 | final CustomConfiguration configuration) { 37 | 38 | val matchers = new ArrayList(); 39 | if (configuration.getExcludeFiles() != null) { 40 | for (val globString : configuration.getExcludeFiles()) { 41 | val matcher = FileSystems.getDefault().getPathMatcher(GLOB_PREFIX + globString); 42 | matchers.add(matcher); 43 | } 44 | } 45 | 46 | val result = new ArrayList(); 47 | for (val rec : recommendations) { 48 | if (configuration.getExcludeBelowSeverity() != null) { 49 | val threshold = RecommendationPrinter.severityToInt(configuration.getExcludeBelowSeverity()); 50 | if (RecommendationPrinter.severityToInt(rec) > threshold) { 51 | continue; 52 | } 53 | } 54 | if (configuration.getExcludeById() != null && 55 | configuration.getExcludeById() 56 | .stream() 57 | .anyMatch(id -> id.equals(rec.recommendationId()))) { 58 | continue; 59 | } 60 | 61 | if (matchers.stream().anyMatch(m -> m.matches(Paths.get(rec.filePath())))) { 62 | continue; 63 | } 64 | if (rec.ruleMetadata() == null || rec.filePath().equals(".")) { 65 | continue; // Always drop rules without metadata or the stats recomendation 66 | } 67 | val metaData = rec.ruleMetadata(); 68 | if (metaData.ruleTags() != null && configuration.getExcludeTags() != null) { 69 | if (configuration.getExcludeTags().stream().anyMatch(t -> metaData.ruleTags().contains(t))) { 70 | continue; 71 | } 72 | } 73 | 74 | if (excludeRecommendation(rec, configuration)) { 75 | continue; 76 | } 77 | 78 | result.add(rec); 79 | } 80 | return result; 81 | } 82 | 83 | private static boolean excludeRecommendation(final RecommendationSummary recommendationSummary, 84 | final CustomConfiguration configuration) { 85 | val metaData = recommendationSummary.ruleMetadata(); 86 | if (configuration.getExcludeRecommendations() != null) { 87 | return configuration.getExcludeRecommendations().stream().anyMatch(ex -> { 88 | if (metaData.ruleId().equals(ex.getDetectorId())) { 89 | if (ex.getLocations() != null && !ex.getLocations().isEmpty()) { 90 | for (val globString : ex.getLocations()) { 91 | val matcher = FileSystems.getDefault().getPathMatcher(GLOB_PREFIX + globString); 92 | if (matcher.matches(Paths.get(recommendationSummary.filePath()))) { 93 | return true; 94 | } 95 | } 96 | return false; 97 | } else { 98 | return true; 99 | } 100 | } 101 | return false; 102 | }); 103 | } 104 | return false; 105 | } 106 | } 107 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/SarifConverter.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.io.IOException; 4 | import java.net.URI; 5 | import java.util.Arrays; 6 | import java.util.HashMap; 7 | import java.util.HashSet; 8 | import java.util.List; 9 | import java.util.Map; 10 | import java.util.stream.Collectors; 11 | 12 | import com.contrastsecurity.sarif.ArtifactLocation; 13 | import com.contrastsecurity.sarif.Location; 14 | import com.contrastsecurity.sarif.Message; 15 | import com.contrastsecurity.sarif.MultiformatMessageString; 16 | import com.contrastsecurity.sarif.PhysicalLocation; 17 | import com.contrastsecurity.sarif.PropertyBag; 18 | import com.contrastsecurity.sarif.Region; 19 | import com.contrastsecurity.sarif.ReportingConfiguration; 20 | import com.contrastsecurity.sarif.ReportingDescriptor; 21 | import com.contrastsecurity.sarif.Result; 22 | import com.contrastsecurity.sarif.Run; 23 | import com.contrastsecurity.sarif.SarifSchema210; 24 | import com.contrastsecurity.sarif.Tool; 25 | import com.contrastsecurity.sarif.ToolComponent; 26 | import lombok.val; 27 | import software.amazon.awssdk.services.codegurureviewer.model.RecommendationSummary; 28 | 29 | /** 30 | * Utility class to convert CodeGuru Recommendations to SARIF 31 | */ 32 | public final class SarifConverter { 33 | 34 | private SarifConverter() { 35 | // do not instantiate 36 | } 37 | 38 | 39 | /** 40 | * Convert CodeGuru Reviewer recommendations into SARIF format. 41 | * 42 | * @param recommendations CodeGuru Reviewer recommendations. 43 | * @return Sarif report object. 44 | * @throws IOException If conversion fails. 45 | */ 46 | public static SarifSchema210 createSarifReport(final List recommendations) 47 | throws IOException { 48 | val docUrl = "https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/how-codeguru-reviewer-works.html"; 49 | 50 | val rulesMap = createSarifRuleDescriptions(recommendations); 51 | val driver = new ToolComponent().withName("CodeGuru Reviewer Scanner") 52 | .withInformationUri(URI.create(docUrl)) 53 | .withRules(new HashSet<>(rulesMap.values())); 54 | 55 | val results = recommendations.stream().map(SarifConverter::convertToSarif) 56 | .collect(Collectors.toList()); 57 | 58 | val run = new Run().withTool(new Tool().withDriver(driver)).withResults(results); 59 | 60 | return new SarifSchema210() 61 | .withVersion(SarifSchema210.Version._2_1_0) 62 | .with$schema(URI.create("http://json.schemastore.org/sarif-2.1.0-rtm.4")) 63 | .withRuns(Arrays.asList(run)); 64 | 65 | } 66 | 67 | private static Map createSarifRuleDescriptions( 68 | final List recommendations) { 69 | val rulesMap = new HashMap(); 70 | for (val recommendation : recommendations) { 71 | val metaData = recommendation.ruleMetadata(); 72 | if (metaData != null && !rulesMap.containsKey(metaData.ruleId())) { 73 | val properties = new PropertyBag().withTags(new HashSet<>(metaData.ruleTags())); 74 | MultiformatMessageString foo; 75 | val descriptor = new ReportingDescriptor() 76 | .withName(metaData.ruleName()) 77 | .withId(metaData.ruleId()) 78 | .withShortDescription(new MultiformatMessageString().withText(metaData.ruleName())) 79 | .withFullDescription(new MultiformatMessageString().withText(metaData.shortDescription())) 80 | .withHelp(new MultiformatMessageString().withText(metaData.longDescription())) 81 | .withProperties(properties); 82 | if (recommendation.severityAsString() != null) { 83 | val level = ReportingConfiguration.Level.fromValue(getSarifSeverity(recommendation)); 84 | descriptor.setDefaultConfiguration(new ReportingConfiguration().withLevel(level)); 85 | } 86 | rulesMap.put(metaData.ruleId(), descriptor); 87 | } 88 | } 89 | return rulesMap; 90 | } 91 | 92 | private static Result convertToSarif(final RecommendationSummary recommendation) { 93 | List locations = Arrays.asList(getSarifLocation(recommendation)); 94 | return new Result().withRuleId(recommendation.ruleMetadata().ruleId()) 95 | .withLevel(Result.Level.fromValue(getSarifSeverity(recommendation))) 96 | .withMessage(new Message().withMarkdown(recommendation.description())) 97 | .withLocations(locations); 98 | } 99 | 100 | private static Location getSarifLocation(final RecommendationSummary recommendation) { 101 | val loc = new PhysicalLocation() 102 | .withArtifactLocation(new ArtifactLocation().withUri(recommendation.filePath())) 103 | .withRegion(new Region().withStartLine(recommendation.startLine()) 104 | .withEndLine(recommendation.endLine())); 105 | return new Location() 106 | .withPhysicalLocation(loc); 107 | } 108 | 109 | private static String getSarifSeverity(RecommendationSummary recommendation) { 110 | if (recommendation.severity() == null) { 111 | return Result.Level.NONE.value(); // can happen for legacy rules 112 | } 113 | switch (recommendation.severity()) { 114 | case INFO: 115 | case LOW: 116 | return Result.Level.NOTE.value(); 117 | case MEDIUM: 118 | case HIGH: 119 | return Result.Level.WARNING.value(); 120 | case CRITICAL: 121 | return Result.Level.ERROR.value(); 122 | default: 123 | return Result.Level.NONE.value(); 124 | } 125 | } 126 | } 127 | -------------------------------------------------------------------------------- /src/main/java/com/amazonaws/gurureviewercli/util/ZipUtils.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import lombok.extern.log4j.Log4j2; 4 | import lombok.val; 5 | 6 | import java.io.IOException; 7 | import java.nio.file.Files; 8 | import java.nio.file.Path; 9 | import java.nio.file.Paths; 10 | import java.util.ArrayList; 11 | import java.util.Collection; 12 | import java.util.Collections; 13 | import java.util.List; 14 | import java.util.stream.Collectors; 15 | import java.util.zip.ZipEntry; 16 | import java.util.zip.ZipOutputStream; 17 | 18 | /** 19 | * Util class for ZipFile. 20 | */ 21 | @Log4j2 22 | public final class ZipUtils { 23 | 24 | /** 25 | * Zip source directory to destination path. 26 | * 27 | * @param sourceDirPaths source dir paths 28 | * @param zipFilePath destination zip file 29 | * @throws IOException io exception 30 | */ 31 | public static void pack(final List sourceDirPaths, final String zipFilePath) throws IOException { 32 | pack(sourceDirPaths, Collections.emptyList(), zipFilePath); 33 | } 34 | 35 | public static void pack(final List sourceDirPaths, 36 | final List excludeDirs, 37 | final String zipFilePath) throws IOException { 38 | Path p = Files.createFile(Paths.get(zipFilePath).normalize().toAbsolutePath()); 39 | try (ZipOutputStream zs = new ZipOutputStream(Files.newOutputStream(p))) { 40 | for (val sourceDirPath : sourceDirPaths) { 41 | Path pp = sourceDirPath.toRealPath(); 42 | try (val walk = Files.walk(pp)) { 43 | walk.filter(path -> !Files.isDirectory(path)) 44 | .filter(path -> isIncluded(path, excludeDirs)) 45 | .forEach(path -> { 46 | val relativePath = pp.relativize(path.normalize().toAbsolutePath()); 47 | // in case we run on Windows 48 | ZipEntry zipEntry = new ZipEntry(getUnixStylePathName(relativePath)); 49 | try { 50 | zs.putNextEntry(zipEntry); 51 | zs.write(Files.readAllBytes(path)); 52 | zs.closeEntry(); 53 | } catch (Exception e) { 54 | log.error("Skipping file {} because of error: {}", path, e.getMessage()); 55 | } 56 | }); 57 | } 58 | } 59 | } 60 | } 61 | 62 | /** 63 | * Zip source directory to destination path. 64 | * 65 | * @param sourceDirPaths source dir paths 66 | * @param relativeRoot The a shared parent of the sourceDirPaths that should be used for all entries. 67 | * @param zipFilePath destination zip file 68 | * @throws IOException io exception 69 | */ 70 | public static void pack(final List sourceDirPaths, 71 | final Path relativeRoot, 72 | final String zipFilePath) throws IOException { 73 | pack(sourceDirPaths, Collections.emptyList(), relativeRoot, zipFilePath); 74 | } 75 | 76 | public static void pack(final List sourceDirPaths, 77 | final List excludeDirs, 78 | final Path relativeRoot, 79 | final String zipFilePath) throws IOException { 80 | val files = getFilesInDirectories(sourceDirPaths); 81 | val codeGuruConfigFile = relativeRoot.resolve("aws-codeguru-reviewer.yml"); 82 | if (codeGuruConfigFile != null && codeGuruConfigFile.toFile().isFile()) { 83 | files.add(codeGuruConfigFile); 84 | } 85 | packFiles(files, excludeDirs, relativeRoot, Paths.get(zipFilePath)); 86 | } 87 | 88 | /** 89 | * Zip source directory to destination path. 90 | * 91 | * @param files source file paths 92 | * @param relativeRoot The shared parent of the sourceDirPaths that should be used for all entries. 93 | * @param zipFilePath destination zip file 94 | * @throws IOException io exception 95 | */ 96 | public static void packFiles(final Collection files, 97 | final List excludeDirs, 98 | final Path relativeRoot, 99 | final Path zipFilePath) throws IOException { 100 | val normalizedRoot = relativeRoot.toRealPath(); 101 | val normalizedFiles = files.stream() 102 | .map(Path::toAbsolutePath) 103 | .map(Path::normalize) 104 | .filter(p -> isIncluded(p, excludeDirs)) 105 | .collect(Collectors.toList()); 106 | normalizedFiles.forEach(file -> { 107 | if (!file.startsWith(normalizedRoot)) { 108 | val msg = String.format("%s is not a parent directory of %s", normalizedRoot, file); 109 | throw new RuntimeException(msg); 110 | } 111 | }); 112 | Path zipFile = Files.createFile(zipFilePath); 113 | try (ZipOutputStream zs = new ZipOutputStream(Files.newOutputStream(zipFile))) { 114 | for (val file : normalizedFiles) { 115 | val relPath = normalizedRoot.relativize(file); 116 | // replace Windows file separators 117 | ZipEntry zipEntry = new ZipEntry(getUnixStylePathName(relPath)); 118 | try { 119 | zs.putNextEntry(zipEntry); 120 | zs.write(Files.readAllBytes(file)); 121 | zs.closeEntry(); 122 | } catch (Exception e) { 123 | log.error("Skipping file {} because of error: {}", file, e.getMessage()); 124 | } 125 | } 126 | } 127 | } 128 | 129 | /** 130 | * Get files under directory recursively. 131 | * 132 | * @param directories Root directory. 133 | * @return All files under the root directory. 134 | * @throws IOException If reading the file system fails. 135 | */ 136 | public static List getFilesInDirectories(Collection directories) throws IOException { 137 | val files = new ArrayList(); 138 | for (val directory : directories) { 139 | Path pp = directory.toRealPath(); 140 | files.addAll(getFilesInDirectory(pp)); 141 | } 142 | return files; 143 | } 144 | 145 | /** 146 | * Get files under directory recursively. 147 | * 148 | * @param directory Root directory. 149 | * @return All files under the root directory. 150 | * @throws IOException If reading the file system fails. 151 | */ 152 | public static List getFilesInDirectory(final Path directory) throws IOException { 153 | if (directory == null || !directory.toFile().isDirectory()) { 154 | return Collections.emptyList(); 155 | } 156 | try (val walk = Files.walk(directory.toRealPath())) { 157 | return walk.filter(path -> !Files.isDirectory(path)).collect(Collectors.toList()); 158 | } 159 | } 160 | 161 | private static String getUnixStylePathName(final Path path) { 162 | return path.normalize().toString().replace('\\', '/'); 163 | } 164 | 165 | private static boolean isIncluded(final Path p, final Collection excludes) { 166 | if (excludes != null) { 167 | if (excludes.stream().anyMatch(ex -> p.startsWith(ex.toAbsolutePath().normalize()))) { 168 | log.warn("File excluded from source zip because it is part of the build zip already: {}", p); 169 | return false; 170 | } 171 | } 172 | return true; 173 | } 174 | 175 | /** 176 | * private construct. 177 | */ 178 | private ZipUtils() { 179 | } 180 | 181 | } 182 | -------------------------------------------------------------------------------- /src/main/resources/log4j2.properties: -------------------------------------------------------------------------------- 1 | # Log4j 2 properties file, this will be automatically loaded by Log4j when the application starts 2 | # Read more: https://logging.apache.org/log4j/2.x/manual/configuration.html#Configuration_with_Properties 3 | dest = err 4 | status = error 5 | name = PropertiesConfig 6 | 7 | appenders = console 8 | 9 | # Configuration for printing to console 10 | appender.console.type = Console 11 | appender.console.name = STDOUT 12 | appender.console.layout.type = PatternLayout 13 | appender.console.layout.pattern = %d %p - %m%n 14 | 15 | # Root logger 16 | rootLogger.level = info 17 | rootLogger.appenderRefs = stdout 18 | rootLogger.appenderRef.stdout.ref = STDOUT 19 | -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/adapter/GitAdapterTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.adapter; 2 | 3 | import java.nio.file.Path; 4 | import java.nio.file.Paths; 5 | 6 | import lombok.val; 7 | import org.beryx.textio.TextIO; 8 | import org.beryx.textio.mock.MockTextTerminal; 9 | import org.junit.jupiter.api.Assertions; 10 | import org.junit.jupiter.api.Test; 11 | 12 | import com.amazonaws.gurureviewercli.exceptions.GuruCliException; 13 | import com.amazonaws.gurureviewercli.model.Configuration; 14 | import com.amazonaws.gurureviewercli.model.ErrorCodes; 15 | 16 | class GitAdapterTest { 17 | 18 | private static final Path RESOURCE_ROOT = Paths.get("test-data"); 19 | 20 | @Test 21 | public void test_getGitMetaData_notARepo() { 22 | val repo = RESOURCE_ROOT.resolve("fresh-repo-without-remote"); 23 | GuruCliException ret = Assertions.assertThrows(GuruCliException.class, () -> 24 | GitAdapter.tryGetMetaData(configWithoutCommits(repo), repo.resolve("notgit"))); 25 | Assertions.assertEquals(ErrorCodes.GIT_INVALID_DIR, ret.getErrorCode()); 26 | } 27 | 28 | @Test 29 | public void test_getGitMetaData_noRemote() throws Exception { 30 | val repo = RESOURCE_ROOT.resolve("fresh-repo-no-remote"); 31 | val metadata = GitAdapter.tryGetMetaData(configWithoutCommits(repo), repo.resolve("git")); 32 | Assertions.assertNull(metadata.getRemoteUrl()); 33 | Assertions.assertNotNull(metadata.getCurrentBranch()); 34 | Assertions.assertEquals(repo, metadata.getRepoRoot()); 35 | } 36 | 37 | 38 | @Test 39 | public void test_getGitMetaData_oneCommit_packageScan() { 40 | val repo = RESOURCE_ROOT.resolve("one-commit"); 41 | val mockTerminal = new MockTextTerminal(); 42 | mockTerminal.getInputs().add("y"); 43 | val config = Configuration.builder() 44 | .textIO(new TextIO(mockTerminal)) 45 | .interactiveMode(true) 46 | .build(); 47 | val gitMetaData = GitAdapter.tryGetMetaData(config, repo.resolve("git")); 48 | Assertions.assertNotNull(gitMetaData); 49 | Assertions.assertNull(gitMetaData.getBeforeCommit()); 50 | Assertions.assertNull(gitMetaData.getAfterCommit()); 51 | Assertions.assertEquals(1, gitMetaData.getVersionedFiles().size()); 52 | Assertions.assertEquals("master", gitMetaData.getCurrentBranch()); 53 | Assertions.assertEquals("git@amazon.com:username/new_repo", gitMetaData.getRemoteUrl()); 54 | } 55 | 56 | @Test 57 | public void test_getGitMetaData_oneCommit_packageScanAbort() { 58 | val repo = RESOURCE_ROOT.resolve("one-commit"); 59 | val mockTerminal = new MockTextTerminal(); 60 | mockTerminal.getInputs().add("n"); 61 | val config = Configuration.builder() 62 | .textIO(new TextIO(mockTerminal)) 63 | .interactiveMode(true) 64 | .build(); 65 | GuruCliException ret = Assertions.assertThrows(GuruCliException.class, () -> 66 | GitAdapter.tryGetMetaData(config, repo.resolve("git"))); 67 | Assertions.assertEquals(ErrorCodes.USER_ABORT, ret.getErrorCode()); 68 | 69 | } 70 | 71 | @Test 72 | public void test_getGitMetaData_twoCommits_validCommits() { 73 | val repo = RESOURCE_ROOT.resolve("two-commits"); 74 | val config = configWithoutCommits(repo); 75 | config.setBeforeCommit("cdb0fcad7400610b1d1797a326a89414525160fe"); 76 | config.setAfterCommit("8ece465b7ecf8337bf767c9602d21bb92f2fad8a"); 77 | val gitMetaData = GitAdapter.tryGetMetaData(config, repo.resolve("git")); 78 | Assertions.assertNotNull(gitMetaData); 79 | Assertions.assertNotNull(gitMetaData.getBeforeCommit()); 80 | Assertions.assertNotNull(gitMetaData.getAfterCommit()); 81 | Assertions.assertEquals(1, gitMetaData.getVersionedFiles().size()); 82 | Assertions.assertEquals("master", gitMetaData.getCurrentBranch()); 83 | Assertions.assertEquals("git@amazon.com:username/new_repo", gitMetaData.getRemoteUrl()); 84 | } 85 | 86 | @Test 87 | public void test_getGitMetaData_twoCommits_commitShortHand() { 88 | val repo = RESOURCE_ROOT.resolve("two-commits"); 89 | val config = configWithoutCommits(repo); 90 | config.setBeforeCommit("HEAD^"); 91 | config.setAfterCommit("HEAD"); 92 | val gitMetaData = GitAdapter.tryGetMetaData(config, repo.resolve("git")); 93 | Assertions.assertNotNull(gitMetaData); 94 | Assertions.assertNotNull(gitMetaData.getBeforeCommit()); 95 | Assertions.assertNotNull(gitMetaData.getAfterCommit()); 96 | Assertions.assertEquals("master", gitMetaData.getCurrentBranch()); 97 | Assertions.assertEquals("git@amazon.com:username/new_repo", gitMetaData.getRemoteUrl()); 98 | } 99 | 100 | @Test 101 | public void test_getGitMetaData_twoCommits_invalidCommits() { 102 | val repo = RESOURCE_ROOT.resolve("two-commits"); 103 | val config = configWithoutCommits(repo); 104 | config.setBeforeCommit("thisIsNotACommitHash"); 105 | config.setAfterCommit("8ece465b7ecf8337bf767c9602d21bb92f2fad8a"); 106 | 107 | Exception ret = Assertions.assertThrows(Exception.class, () -> 108 | GitAdapter.tryGetMetaData(config, repo.resolve("git"))); 109 | Assertions.assertTrue(ret.getMessage().contains("Not a valid commit id ")); 110 | } 111 | 112 | private Configuration configWithoutCommits(final Path workingDir) { 113 | return Configuration.builder() 114 | .textIO(new TextIO(new MockTextTerminal())) 115 | .interactiveMode(false) 116 | .build(); 117 | } 118 | } -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/adapter/ResultsAdapterTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.adapter; 2 | 3 | import java.nio.file.Files; 4 | import java.nio.file.Paths; 5 | import java.util.Collections; 6 | 7 | import lombok.val; 8 | import org.junit.jupiter.api.Test; 9 | 10 | import com.amazonaws.gurureviewercli.model.ScanMetaData; 11 | import com.amazonaws.gurureviewercli.util.JsonUtil; 12 | 13 | class ResultsAdapterTest { 14 | 15 | @Test 16 | void saveResults() throws Exception { 17 | val recommendations = 18 | JsonUtil.loadRecommendations(Paths.get("test-data/recommendations/recommendations.json")); 19 | val scanMetaData = ScanMetaData.builder() 20 | .repositoryRoot(Paths.get("./").toRealPath()) 21 | .associationArn("123") 22 | .codeReviewArn("456") 23 | .sourceDirectories(Collections.emptyList()) 24 | .build(); 25 | val outDir = Files.createTempDirectory("test-output"); 26 | ResultsAdapter.saveResults(outDir, recommendations, scanMetaData); 27 | } 28 | } -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/adapter/ScanAdapterTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.adapter; 2 | 3 | import java.nio.file.Path; 4 | import java.nio.file.Paths; 5 | import java.util.Arrays; 6 | import java.util.List; 7 | 8 | import lombok.val; 9 | import org.junit.jupiter.api.Assumptions; 10 | import org.junit.jupiter.api.Test; 11 | import org.junit.jupiter.api.extension.ExtendWith; 12 | import org.mockito.Mock; 13 | import org.mockito.junit.jupiter.MockitoExtension; 14 | import software.amazon.awssdk.services.codegurureviewer.CodeGuruReviewerClient; 15 | import software.amazon.awssdk.services.codegurureviewer.model.CodeReview; 16 | import software.amazon.awssdk.services.codegurureviewer.model.CreateCodeReviewRequest; 17 | import software.amazon.awssdk.services.codegurureviewer.model.CreateCodeReviewResponse; 18 | import software.amazon.awssdk.services.codegurureviewer.model.DescribeRepositoryAssociationRequest; 19 | import software.amazon.awssdk.services.codegurureviewer.model.DescribeRepositoryAssociationResponse; 20 | import software.amazon.awssdk.services.codegurureviewer.model.ListRepositoryAssociationsRequest; 21 | import software.amazon.awssdk.services.codegurureviewer.model.ListRepositoryAssociationsResponse; 22 | import software.amazon.awssdk.services.codegurureviewer.model.RepositoryAssociation; 23 | import software.amazon.awssdk.services.codegurureviewer.model.RepositoryAssociationState; 24 | import software.amazon.awssdk.services.codegurureviewer.model.RepositoryAssociationSummary; 25 | import software.amazon.awssdk.services.codegurureviewer.model.S3RepositoryDetails; 26 | import software.amazon.awssdk.services.s3.S3Client; 27 | import static org.mockito.ArgumentMatchers.any; 28 | import static org.mockito.Mockito.when; 29 | 30 | import com.amazonaws.gurureviewercli.model.Configuration; 31 | import com.amazonaws.gurureviewercli.model.GitMetaData; 32 | 33 | @ExtendWith(MockitoExtension.class) 34 | class ScanAdapterTest { 35 | 36 | @Mock 37 | private CodeGuruReviewerClient guruFrontendService; 38 | 39 | @Mock 40 | private S3Client s3client; 41 | 42 | @Test 43 | public void test_startScan_HappyCase() throws Exception { 44 | // skip the test if the test container stripped to the top level .git folder 45 | Assumptions.assumeTrue(Paths.get("./.git").toFile().isDirectory()); 46 | val fakeArn = "123"; 47 | val bucketName = "some-bucket"; 48 | val repoDetails = S3RepositoryDetails.builder().bucketName(bucketName).build(); 49 | val expected = RepositoryAssociation.builder().associationArn(fakeArn) 50 | .s3RepositoryDetails(repoDetails) 51 | .state(RepositoryAssociationState.ASSOCIATED) 52 | .build(); 53 | val summary = RepositoryAssociationSummary.builder() 54 | .associationArn(fakeArn) 55 | .state(RepositoryAssociationState.ASSOCIATED) 56 | .build(); 57 | val response = ListRepositoryAssociationsResponse.builder().repositoryAssociationSummaries(summary).build(); 58 | when(guruFrontendService.listRepositoryAssociations(any(ListRepositoryAssociationsRequest.class))) 59 | .thenReturn(response); 60 | val describeResponse = DescribeRepositoryAssociationResponse.builder().repositoryAssociation(expected).build(); 61 | when(guruFrontendService.describeRepositoryAssociation(any(DescribeRepositoryAssociationRequest.class))) 62 | .thenReturn(describeResponse); 63 | val review = CodeReview.builder().codeReviewArn(fakeArn).build(); 64 | val crResponse = CreateCodeReviewResponse.builder().codeReview(review).build(); 65 | when(guruFrontendService.createCodeReview(any(CreateCodeReviewRequest.class))).thenReturn(crResponse); 66 | 67 | val config = Configuration.builder() 68 | .guruFrontendService(guruFrontendService) 69 | .s3Client(s3client) 70 | .build(); 71 | val gitMetaData = GitMetaData.builder() 72 | .repoRoot(Paths.get("./")) 73 | .build(); 74 | val sourceDirs = Arrays.asList(Paths.get("src")); 75 | List buildDirs = Arrays.asList(); 76 | ScanAdapter.startScan(config, gitMetaData, sourceDirs, buildDirs); 77 | } 78 | } -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/util/CodeInsightExportTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.nio.file.Files; 4 | import java.nio.file.Path; 5 | import java.nio.file.Paths; 6 | import java.util.List; 7 | 8 | import com.fasterxml.jackson.annotation.JsonInclude; 9 | import com.fasterxml.jackson.core.type.TypeReference; 10 | import com.fasterxml.jackson.databind.DeserializationFeature; 11 | import com.fasterxml.jackson.databind.SerializationFeature; 12 | import com.fasterxml.jackson.databind.json.JsonMapper; 13 | import lombok.val; 14 | import org.junit.jupiter.api.Assertions; 15 | import org.junit.jupiter.api.Test; 16 | 17 | import com.amazonaws.gurureviewercli.model.ScanMetaData; 18 | import com.amazonaws.gurureviewercli.model.bitbucket.CodeInsightsAnnotation; 19 | 20 | class CodeInsightExportTest { 21 | private static final Path TEST_DIR = Paths.get("test-data"); 22 | 23 | private static final Path RECOMMENDATIONS_DIR = TEST_DIR.resolve("recommendations"); 24 | 25 | private static final JsonMapper JSON_MAPPER = 26 | JsonMapper.builder() 27 | .serializationInclusion(JsonInclude.Include.NON_ABSENT) 28 | .disable(SerializationFeature.WRITE_DATES_AS_TIMESTAMPS) 29 | .disable(SerializationFeature.WRITE_DURATIONS_AS_TIMESTAMPS) 30 | .disable(DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE) 31 | .enable(DeserializationFeature.READ_UNKNOWN_ENUM_VALUES_USING_DEFAULT_VALUE) 32 | .build(); 33 | 34 | @Test 35 | void test_happyCase() throws Exception { 36 | val recommendations = 37 | JsonUtil.loadRecommendations(RECOMMENDATIONS_DIR.resolve("exclude01.json")); 38 | 39 | val outDir = Files.createTempDirectory("test-output"); 40 | val scanMetaData = ScanMetaData.builder() 41 | .associationArn("asdf") 42 | .region("1234") 43 | .build(); 44 | CodeInsightExport.report(recommendations, scanMetaData, outDir); 45 | 46 | Assertions.assertTrue(outDir.resolve("report.json").toFile().isFile()); 47 | val annotations = JSON_MAPPER.readValue(outDir.resolve("annotations.json").toFile(), 48 | new TypeReference>() {}); 49 | Assertions.assertEquals(recommendations.size(), annotations.size()); 50 | } 51 | } -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/util/RecommendationsFilterTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.nio.file.Path; 4 | import java.nio.file.Paths; 5 | 6 | import lombok.val; 7 | import org.junit.jupiter.api.Assertions; 8 | import org.junit.jupiter.api.Test; 9 | 10 | import com.amazonaws.gurureviewercli.model.configfile.CustomConfiguration; 11 | 12 | class RecommendationsFilterTest { 13 | 14 | private static final Path TEST_DIR = Paths.get("test-data"); 15 | 16 | private static final Path CONFIG_DIR = TEST_DIR.resolve("custom-configs"); 17 | 18 | private static final Path RECOMMENDATIONS_DIR = TEST_DIR.resolve("recommendations"); 19 | 20 | @Test 21 | void test_filterRecommendations_byRecommendation() throws Exception { 22 | val configFile = CustomConfiguration.load(CONFIG_DIR.resolve("exclude-recommendations.yml")); 23 | val recommendations = 24 | JsonUtil.loadRecommendations(RECOMMENDATIONS_DIR.resolve("exclude01.json")); 25 | val output = RecommendationsFilter.filterRecommendations(recommendations, configFile); 26 | 27 | Assertions.assertEquals(1, output.size()); 28 | } 29 | 30 | @Test 31 | void test_filterRecommendations_byTag() throws Exception { 32 | val configFile = CustomConfiguration.load(CONFIG_DIR.resolve("exclude-tag.yml")); 33 | val recommendations = 34 | JsonUtil.loadRecommendations(RECOMMENDATIONS_DIR.resolve("exclude01.json")); 35 | val output = RecommendationsFilter.filterRecommendations(recommendations, configFile); 36 | 37 | Assertions.assertEquals(3, output.size()); 38 | } 39 | 40 | @Test 41 | void test_filterRecommendations_bySeverity() throws Exception { 42 | val configFile = CustomConfiguration.load(CONFIG_DIR.resolve("exclude-severity.yml")); 43 | val recommendations = 44 | JsonUtil.loadRecommendations(RECOMMENDATIONS_DIR.resolve("exclude01.json")); 45 | val output = RecommendationsFilter.filterRecommendations(recommendations, configFile); 46 | 47 | Assertions.assertEquals(2, output.size()); 48 | } 49 | 50 | @Test 51 | void test_filterRecommendations_byId() throws Exception { 52 | val configFile = CustomConfiguration.load(CONFIG_DIR.resolve("exclude-id.yml")); 53 | val recommendations = 54 | JsonUtil.loadRecommendations(RECOMMENDATIONS_DIR.resolve("exclude01.json")); 55 | val output = RecommendationsFilter.filterRecommendations(recommendations, configFile); 56 | 57 | Assertions.assertEquals(0, output.size()); 58 | } 59 | 60 | } -------------------------------------------------------------------------------- /src/test/java/com/amazonaws/gurureviewercli/util/ZipUtilsTest.java: -------------------------------------------------------------------------------- 1 | package com.amazonaws.gurureviewercli.util; 2 | 3 | import java.io.File; 4 | import java.io.IOException; 5 | import java.nio.file.Files; 6 | import java.nio.file.Path; 7 | import java.nio.file.Paths; 8 | import java.util.Arrays; 9 | import java.util.Comparator; 10 | import java.util.Enumeration; 11 | import java.util.HashSet; 12 | import java.util.zip.ZipEntry; 13 | import java.util.zip.ZipFile; 14 | 15 | import lombok.val; 16 | import org.junit.jupiter.api.AfterEach; 17 | import org.junit.jupiter.api.Assertions; 18 | import org.junit.jupiter.api.BeforeEach; 19 | import org.junit.jupiter.api.Test; 20 | 21 | public class ZipUtilsTest { 22 | 23 | private Path workDir; 24 | 25 | @BeforeEach 26 | void beforeEach() throws IOException { 27 | workDir = Files.createTempDirectory("zip-files"); 28 | } 29 | 30 | @AfterEach 31 | void afterEach() throws IOException { 32 | Files.walk(workDir) 33 | .sorted(Comparator.reverseOrder()) 34 | .map(Path::toFile) 35 | .forEach(File::delete); 36 | } 37 | 38 | @Test 39 | void test_packUnpack() throws IOException { 40 | val testDir = Paths.get("test-data/fake-repo"); 41 | val zipName = workDir.resolve("test.zip").toString(); 42 | ZipUtils.pack(Arrays.asList(testDir), testDir, zipName); 43 | try (ZipFile zipFile = new ZipFile(zipName)) { 44 | Enumeration entries = zipFile.entries(); 45 | val expectedFileNames = 46 | new HashSet(Arrays.asList("build-dir/should-not-be-included.txt", 47 | "build-dir/lib/included.txt", 48 | "should-not-be-included.txt")); 49 | while (entries.hasMoreElements()) { 50 | ZipEntry entry = entries.nextElement(); 51 | Assertions.assertFalse(entry.toString().contains("\\"), "Unexpected zip entry " + entry); 52 | Assertions.assertTrue(expectedFileNames.contains(entry.toString())); 53 | expectedFileNames.remove(entry.toString()); 54 | } 55 | Assertions.assertTrue(expectedFileNames.isEmpty()); 56 | } 57 | } 58 | 59 | /* 60 | If a aws-codeguru-reviewer.yml file is present, it has to be included in the zip file even if the root folder 61 | is not mentioned in the list of source directories. 62 | */ 63 | @Test 64 | void test_packUnpackWithConfig() throws IOException { 65 | val testDir = Paths.get("test-data/fake-repo-with-config"); 66 | val zipName = workDir.resolve("test.zip").toString(); 67 | ZipUtils.pack(Arrays.asList(testDir.resolve("src-dir")), testDir, zipName); 68 | try (ZipFile zipFile = new ZipFile(zipName)) { 69 | Enumeration entries = zipFile.entries(); 70 | val expectedFileNames = 71 | new HashSet(Arrays.asList("src-dir/included-src.txt", 72 | "aws-codeguru-reviewer.yml")); 73 | while (entries.hasMoreElements()) { 74 | ZipEntry entry = entries.nextElement(); 75 | Assertions.assertFalse(entry.toString().contains("\\"), "Unexpected zip entry " + entry); 76 | Assertions.assertTrue(expectedFileNames.contains(entry.toString())); 77 | expectedFileNames.remove(entry.toString()); 78 | } 79 | Assertions.assertTrue(expectedFileNames.isEmpty()); 80 | } 81 | } 82 | } 83 | -------------------------------------------------------------------------------- /test-data/custom-configs/exclude-id.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | 3 | excludeById: 4 | - '1' 5 | - '2' 6 | - '3' 7 | - '4' 8 | 9 | excludeFiles: 10 | - tst/** 11 | 12 | -------------------------------------------------------------------------------- /test-data/custom-configs/exclude-recommendations.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | excludeRecommendations: 3 | - detectorId: 'rule01' # globally suppress rule 4 | - detectorId: 'rule02' 5 | Locations: 6 | - 'src/main/java/com/folder01/File02.java' # exclude for specific file/folders 7 | 8 | excludeFiles: 9 | - tst/** 10 | 11 | -------------------------------------------------------------------------------- /test-data/custom-configs/exclude-severity.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | 3 | ExcludeBelowSeverity: 'HIGH' # casing doesn't matter 4 | 5 | excludeFiles: 6 | - tst/** 7 | 8 | -------------------------------------------------------------------------------- /test-data/custom-configs/exclude-tag.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | 3 | excludeTags: 4 | - 'ignore-me' 5 | 6 | excludeFiles: 7 | - tst/** 8 | 9 | -------------------------------------------------------------------------------- /test-data/fake-repo-with-config/aws-codeguru-reviewer.yml: -------------------------------------------------------------------------------- 1 | version: 1.0 2 | # See https://docs.aws.amazon.com/codeguru/latest/reviewer-ug/recommendation-suppression.html 3 | excludeFiles: 4 | - "tst/**" -------------------------------------------------------------------------------- /test-data/fake-repo-with-config/other-dir/should-not-be-included.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /test-data/fake-repo-with-config/should-not-be-included.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /test-data/fake-repo-with-config/src-dir/included-src.txt: -------------------------------------------------------------------------------- 1 | asdf -------------------------------------------------------------------------------- /test-data/fake-repo/build-dir/lib/included.txt: -------------------------------------------------------------------------------- 1 | asdf -------------------------------------------------------------------------------- /test-data/fake-repo/build-dir/should-not-be-included.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /test-data/fake-repo/should-not-be-included.txt: -------------------------------------------------------------------------------- 1 | 2 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/HEAD: -------------------------------------------------------------------------------- 1 | ref: refs/heads/master 2 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/config: -------------------------------------------------------------------------------- 1 | [core] 2 | repositoryformatversion = 0 3 | filemode = true 4 | bare = false 5 | logallrefupdates = true 6 | ignorecase = true 7 | precomposeunicode = true 8 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/description: -------------------------------------------------------------------------------- 1 | Unnamed repository; edit this file 'description' to name the repository. 2 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/applypatch-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message taken by 4 | # applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. The hook is 8 | # allowed to edit the commit message file. 9 | # 10 | # To enable this hook, rename this file to "applypatch-msg". 11 | 12 | . git-sh-setup 13 | commitmsg="$(git rev-parse --git-path hooks/commit-msg)" 14 | test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} 15 | : 16 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message. 4 | # Called by "git commit" with one argument, the name of the file 5 | # that has the commit message. The hook should exit with non-zero 6 | # status after issuing an appropriate message if it wants to stop the 7 | # commit. The hook is allowed to edit the commit message file. 8 | # 9 | # To enable this hook, rename this file to "commit-msg". 10 | 11 | # Uncomment the below to add a Signed-off-by line to the message. 12 | # Doing this in a hook is a bad idea in general, but the prepare-commit-msg 13 | # hook is more suited to it. 14 | # 15 | # SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 16 | # grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" 17 | 18 | # This example catches duplicate Signed-off-by lines. 19 | 20 | test "" = "$(grep '^Signed-off-by: ' "$1" | 21 | sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { 22 | echo >&2 Duplicate Signed-off-by lines. 23 | exit 1 24 | } 25 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/fsmonitor-watchman.sample: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use strict; 4 | use warnings; 5 | use IPC::Open2; 6 | 7 | # An example hook script to integrate Watchman 8 | # (https://facebook.github.io/watchman/) with git to speed up detecting 9 | # new and modified files. 10 | # 11 | # The hook is passed a version (currently 1) and a time in nanoseconds 12 | # formatted as a string and outputs to stdout all files that have been 13 | # modified since the given time. Paths must be relative to the root of 14 | # the working tree and separated by a single NUL. 15 | # 16 | # To enable this hook, rename this file to "query-watchman" and set 17 | # 'git config core.fsmonitor .git/hooks/query-watchman' 18 | # 19 | my ($version, $time) = @ARGV; 20 | 21 | # Check the hook interface version 22 | 23 | if ($version == 1) { 24 | # convert nanoseconds to seconds 25 | $time = int $time / 1000000000; 26 | } else { 27 | die "Unsupported query-fsmonitor hook version '$version'.\n" . 28 | "Falling back to scanning...\n"; 29 | } 30 | 31 | my $git_work_tree; 32 | if ($^O =~ 'msys' || $^O =~ 'cygwin') { 33 | $git_work_tree = Win32::GetCwd(); 34 | $git_work_tree =~ tr/\\/\//; 35 | } else { 36 | require Cwd; 37 | $git_work_tree = Cwd::cwd(); 38 | } 39 | 40 | my $retry = 1; 41 | 42 | launch_watchman(); 43 | 44 | sub launch_watchman { 45 | 46 | my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty') 47 | or die "open2() failed: $!\n" . 48 | "Falling back to scanning...\n"; 49 | 50 | # In the query expression below we're asking for names of files that 51 | # changed since $time but were not transient (ie created after 52 | # $time but no longer exist). 53 | # 54 | # To accomplish this, we're using the "since" generator to use the 55 | # recency index to select candidate nodes and "fields" to limit the 56 | # output to file names only. Then we're using the "expression" term to 57 | # further constrain the results. 58 | # 59 | # The category of transient files that we want to ignore will have a 60 | # creation clock (cclock) newer than $time_t value and will also not 61 | # currently exist. 62 | 63 | my $query = <<" END"; 64 | ["query", "$git_work_tree", { 65 | "since": $time, 66 | "fields": ["name"], 67 | "expression": ["not", ["allof", ["since", $time, "cclock"], ["not", "exists"]]] 68 | }] 69 | END 70 | 71 | print CHLD_IN $query; 72 | close CHLD_IN; 73 | my $response = do {local $/; }; 74 | 75 | die "Watchman: command returned no output.\n" . 76 | "Falling back to scanning...\n" if $response eq ""; 77 | die "Watchman: command returned invalid output: $response\n" . 78 | "Falling back to scanning...\n" unless $response =~ /^\{/; 79 | 80 | my $json_pkg; 81 | eval { 82 | require JSON::XS; 83 | $json_pkg = "JSON::XS"; 84 | 1; 85 | } or do { 86 | require JSON::PP; 87 | $json_pkg = "JSON::PP"; 88 | }; 89 | 90 | my $o = $json_pkg->new->utf8->decode($response); 91 | 92 | if ($retry > 0 and $o->{error} and $o->{error} =~ m/unable to resolve root .* directory (.*) is not watched/) { 93 | print STDERR "Adding '$git_work_tree' to watchman's watch list.\n"; 94 | $retry--; 95 | qx/watchman watch "$git_work_tree"/; 96 | die "Failed to make watchman watch '$git_work_tree'.\n" . 97 | "Falling back to scanning...\n" if $? != 0; 98 | 99 | # Watchman will always return all files on the first query so 100 | # return the fast "everything is dirty" flag to git and do the 101 | # Watchman query just to get it over with now so we won't pay 102 | # the cost in git to look up each individual file. 103 | print "/\0"; 104 | eval { launch_watchman() }; 105 | exit 0; 106 | } 107 | 108 | die "Watchman: $o->{error}.\n" . 109 | "Falling back to scanning...\n" if $o->{error}; 110 | 111 | binmode STDOUT, ":utf8"; 112 | local $, = "\0"; 113 | print @{$o->{files}}; 114 | } 115 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/post-update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare a packed repository for use over 4 | # dumb transports. 5 | # 6 | # To enable this hook, rename this file to "post-update". 7 | 8 | exec git update-server-info 9 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-applypatch.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed 4 | # by applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. 8 | # 9 | # To enable this hook, rename this file to "pre-applypatch". 10 | 11 | . git-sh-setup 12 | precommit="$(git rev-parse --git-path hooks/pre-commit)" 13 | test -x "$precommit" && exec "$precommit" ${1+"$@"} 14 | : 15 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git commit" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message if 6 | # it wants to stop the commit. 7 | # 8 | # To enable this hook, rename this file to "pre-commit". 9 | 10 | if git rev-parse --verify HEAD >/dev/null 2>&1 11 | then 12 | against=HEAD 13 | else 14 | # Initial commit: diff against an empty tree object 15 | against=$(git hash-object -t tree /dev/null) 16 | fi 17 | 18 | # If you want to allow non-ASCII filenames set this variable to true. 19 | allownonascii=$(git config --bool hooks.allownonascii) 20 | 21 | # Redirect output to stderr. 22 | exec 1>&2 23 | 24 | # Cross platform projects tend to avoid non-ASCII filenames; prevent 25 | # them from being added to the repository. We exploit the fact that the 26 | # printable range starts at the space character and ends with tilde. 27 | if [ "$allownonascii" != "true" ] && 28 | # Note that the use of brackets around a tr range is ok here, (it's 29 | # even required, for portability to Solaris 10's /usr/bin/tr), since 30 | # the square bracket bytes happen to fall in the designated range. 31 | test $(git diff --cached --name-only --diff-filter=A -z $against | 32 | LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 33 | then 34 | cat <<\EOF 35 | Error: Attempt to add a non-ASCII file name. 36 | 37 | This can cause problems if you want to work with people on other platforms. 38 | 39 | To be portable it is advisable to rename the file. 40 | 41 | If you know what you are doing you can disable this check using: 42 | 43 | git config hooks.allownonascii true 44 | EOF 45 | exit 1 46 | fi 47 | 48 | # If there are whitespace errors, print the offending file names and fail. 49 | exec git diff-index --check --cached $against -- 50 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-merge-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git merge" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message to 6 | # stderr if it wants to stop the merge commit. 7 | # 8 | # To enable this hook, rename this file to "pre-merge-commit". 9 | 10 | . git-sh-setup 11 | test -x "$GIT_DIR/hooks/pre-commit" && 12 | exec "$GIT_DIR/hooks/pre-commit" 13 | : 14 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-push.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # An example hook script to verify what is about to be pushed. Called by "git 4 | # push" after it has checked the remote status, but before anything has been 5 | # pushed. If this script exits with a non-zero status nothing will be pushed. 6 | # 7 | # This hook is called with the following parameters: 8 | # 9 | # $1 -- Name of the remote to which the push is being done 10 | # $2 -- URL to which the push is being done 11 | # 12 | # If pushing without using a named remote those arguments will be equal. 13 | # 14 | # Information about the commits which are being pushed is supplied as lines to 15 | # the standard input in the form: 16 | # 17 | # 18 | # 19 | # This sample shows how to prevent push of commits where the log message starts 20 | # with "WIP" (work in progress). 21 | 22 | remote="$1" 23 | url="$2" 24 | 25 | z40=0000000000000000000000000000000000000000 26 | 27 | while read local_ref local_sha remote_ref remote_sha 28 | do 29 | if [ "$local_sha" = $z40 ] 30 | then 31 | # Handle delete 32 | : 33 | else 34 | if [ "$remote_sha" = $z40 ] 35 | then 36 | # New branch, examine all commits 37 | range="$local_sha" 38 | else 39 | # Update to existing branch, examine new commits 40 | range="$remote_sha..$local_sha" 41 | fi 42 | 43 | # Check for WIP commit 44 | commit=`git rev-list -n 1 --grep '^WIP' "$range"` 45 | if [ -n "$commit" ] 46 | then 47 | echo >&2 "Found WIP commit in $local_ref, not pushing" 48 | exit 1 49 | fi 50 | fi 51 | done 52 | 53 | exit 0 54 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-rebase.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (c) 2006, 2008 Junio C Hamano 4 | # 5 | # The "pre-rebase" hook is run just before "git rebase" starts doing 6 | # its job, and can prevent the command from running by exiting with 7 | # non-zero status. 8 | # 9 | # The hook is called with the following parameters: 10 | # 11 | # $1 -- the upstream the series was forked from. 12 | # $2 -- the branch being rebased (or empty when rebasing the current branch). 13 | # 14 | # This sample shows how to prevent topic branches that are already 15 | # merged to 'next' branch from getting rebased, because allowing it 16 | # would result in rebasing already published history. 17 | 18 | publish=next 19 | basebranch="$1" 20 | if test "$#" = 2 21 | then 22 | topic="refs/heads/$2" 23 | else 24 | topic=`git symbolic-ref HEAD` || 25 | exit 0 ;# we do not interrupt rebasing detached HEAD 26 | fi 27 | 28 | case "$topic" in 29 | refs/heads/??/*) 30 | ;; 31 | *) 32 | exit 0 ;# we do not interrupt others. 33 | ;; 34 | esac 35 | 36 | # Now we are dealing with a topic branch being rebased 37 | # on top of master. Is it OK to rebase it? 38 | 39 | # Does the topic really exist? 40 | git show-ref -q "$topic" || { 41 | echo >&2 "No such branch $topic" 42 | exit 1 43 | } 44 | 45 | # Is topic fully merged to master? 46 | not_in_master=`git rev-list --pretty=oneline ^master "$topic"` 47 | if test -z "$not_in_master" 48 | then 49 | echo >&2 "$topic is fully merged to master; better remove it." 50 | exit 1 ;# we could allow it, but there is no point. 51 | fi 52 | 53 | # Is topic ever merged to next? If so you should not be rebasing it. 54 | only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` 55 | only_next_2=`git rev-list ^master ${publish} | sort` 56 | if test "$only_next_1" = "$only_next_2" 57 | then 58 | not_in_topic=`git rev-list "^$topic" master` 59 | if test -z "$not_in_topic" 60 | then 61 | echo >&2 "$topic is already up to date with master" 62 | exit 1 ;# we could allow it, but there is no point. 63 | else 64 | exit 0 65 | fi 66 | else 67 | not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` 68 | /usr/bin/perl -e ' 69 | my $topic = $ARGV[0]; 70 | my $msg = "* $topic has commits already merged to public branch:\n"; 71 | my (%not_in_next) = map { 72 | /^([0-9a-f]+) /; 73 | ($1 => 1); 74 | } split(/\n/, $ARGV[1]); 75 | for my $elem (map { 76 | /^([0-9a-f]+) (.*)$/; 77 | [$1 => $2]; 78 | } split(/\n/, $ARGV[2])) { 79 | if (!exists $not_in_next{$elem->[0]}) { 80 | if ($msg) { 81 | print STDERR $msg; 82 | undef $msg; 83 | } 84 | print STDERR " $elem->[1]\n"; 85 | } 86 | } 87 | ' "$topic" "$not_in_next" "$not_in_master" 88 | exit 1 89 | fi 90 | 91 | <<\DOC_END 92 | 93 | This sample hook safeguards topic branches that have been 94 | published from being rewound. 95 | 96 | The workflow assumed here is: 97 | 98 | * Once a topic branch forks from "master", "master" is never 99 | merged into it again (either directly or indirectly). 100 | 101 | * Once a topic branch is fully cooked and merged into "master", 102 | it is deleted. If you need to build on top of it to correct 103 | earlier mistakes, a new topic branch is created by forking at 104 | the tip of the "master". This is not strictly necessary, but 105 | it makes it easier to keep your history simple. 106 | 107 | * Whenever you need to test or publish your changes to topic 108 | branches, merge them into "next" branch. 109 | 110 | The script, being an example, hardcodes the publish branch name 111 | to be "next", but it is trivial to make it configurable via 112 | $GIT_DIR/config mechanism. 113 | 114 | With this workflow, you would want to know: 115 | 116 | (1) ... if a topic branch has ever been merged to "next". Young 117 | topic branches can have stupid mistakes you would rather 118 | clean up before publishing, and things that have not been 119 | merged into other branches can be easily rebased without 120 | affecting other people. But once it is published, you would 121 | not want to rewind it. 122 | 123 | (2) ... if a topic branch has been fully merged to "master". 124 | Then you can delete it. More importantly, you should not 125 | build on top of it -- other people may already want to 126 | change things related to the topic as patches against your 127 | "master", so if you need further changes, it is better to 128 | fork the topic (perhaps with the same name) afresh from the 129 | tip of "master". 130 | 131 | Let's look at this example: 132 | 133 | o---o---o---o---o---o---o---o---o---o "next" 134 | / / / / 135 | / a---a---b A / / 136 | / / / / 137 | / / c---c---c---c B / 138 | / / / \ / 139 | / / / b---b C \ / 140 | / / / / \ / 141 | ---o---o---o---o---o---o---o---o---o---o---o "master" 142 | 143 | 144 | A, B and C are topic branches. 145 | 146 | * A has one fix since it was merged up to "next". 147 | 148 | * B has finished. It has been fully merged up to "master" and "next", 149 | and is ready to be deleted. 150 | 151 | * C has not merged to "next" at all. 152 | 153 | We would want to allow C to be rebased, refuse A, and encourage 154 | B to be deleted. 155 | 156 | To compute (1): 157 | 158 | git rev-list ^master ^topic next 159 | git rev-list ^master next 160 | 161 | if these match, topic has not merged in next at all. 162 | 163 | To compute (2): 164 | 165 | git rev-list master..topic 166 | 167 | if this is empty, it is fully merged to "master". 168 | 169 | DOC_END 170 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/pre-receive.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to make use of push options. 4 | # The example simply echoes all push options that start with 'echoback=' 5 | # and rejects all pushes when the "reject" push option is used. 6 | # 7 | # To enable this hook, rename this file to "pre-receive". 8 | 9 | if test -n "$GIT_PUSH_OPTION_COUNT" 10 | then 11 | i=0 12 | while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" 13 | do 14 | eval "value=\$GIT_PUSH_OPTION_$i" 15 | case "$value" in 16 | echoback=*) 17 | echo "echo from the pre-receive-hook: ${value#*=}" >&2 18 | ;; 19 | reject) 20 | exit 1 21 | esac 22 | i=$((i + 1)) 23 | done 24 | fi 25 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/prepare-commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare the commit log message. 4 | # Called by "git commit" with the name of the file that has the 5 | # commit message, followed by the description of the commit 6 | # message's source. The hook's purpose is to edit the commit 7 | # message file. If the hook fails with a non-zero status, 8 | # the commit is aborted. 9 | # 10 | # To enable this hook, rename this file to "prepare-commit-msg". 11 | 12 | # This hook includes three examples. The first one removes the 13 | # "# Please enter the commit message..." help message. 14 | # 15 | # The second includes the output of "git diff --name-status -r" 16 | # into the message, just before the "git status" output. It is 17 | # commented because it doesn't cope with --amend or with squashed 18 | # commits. 19 | # 20 | # The third example adds a Signed-off-by line to the message, that can 21 | # still be edited. This is rarely a good idea. 22 | 23 | COMMIT_MSG_FILE=$1 24 | COMMIT_SOURCE=$2 25 | SHA1=$3 26 | 27 | /usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" 28 | 29 | # case "$COMMIT_SOURCE,$SHA1" in 30 | # ,|template,) 31 | # /usr/bin/perl -i.bak -pe ' 32 | # print "\n" . `git diff --cached --name-status -r` 33 | # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; 34 | # *) ;; 35 | # esac 36 | 37 | # SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 38 | # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" 39 | # if test -z "$COMMIT_SOURCE" 40 | # then 41 | # /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" 42 | # fi 43 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/hooks/update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to block unannotated tags from entering. 4 | # Called by "git receive-pack" with arguments: refname sha1-old sha1-new 5 | # 6 | # To enable this hook, rename this file to "update". 7 | # 8 | # Config 9 | # ------ 10 | # hooks.allowunannotated 11 | # This boolean sets whether unannotated tags will be allowed into the 12 | # repository. By default they won't be. 13 | # hooks.allowdeletetag 14 | # This boolean sets whether deleting tags will be allowed in the 15 | # repository. By default they won't be. 16 | # hooks.allowmodifytag 17 | # This boolean sets whether a tag may be modified after creation. By default 18 | # it won't be. 19 | # hooks.allowdeletebranch 20 | # This boolean sets whether deleting branches will be allowed in the 21 | # repository. By default they won't be. 22 | # hooks.denycreatebranch 23 | # This boolean sets whether remotely creating branches will be denied 24 | # in the repository. By default this is allowed. 25 | # 26 | 27 | # --- Command line 28 | refname="$1" 29 | oldrev="$2" 30 | newrev="$3" 31 | 32 | # --- Safety check 33 | if [ -z "$GIT_DIR" ]; then 34 | echo "Don't run this script from the command line." >&2 35 | echo " (if you want, you could supply GIT_DIR then run" >&2 36 | echo " $0 )" >&2 37 | exit 1 38 | fi 39 | 40 | if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then 41 | echo "usage: $0 " >&2 42 | exit 1 43 | fi 44 | 45 | # --- Config 46 | allowunannotated=$(git config --bool hooks.allowunannotated) 47 | allowdeletebranch=$(git config --bool hooks.allowdeletebranch) 48 | denycreatebranch=$(git config --bool hooks.denycreatebranch) 49 | allowdeletetag=$(git config --bool hooks.allowdeletetag) 50 | allowmodifytag=$(git config --bool hooks.allowmodifytag) 51 | 52 | # check for no description 53 | projectdesc=$(sed -e '1q' "$GIT_DIR/description") 54 | case "$projectdesc" in 55 | "Unnamed repository"* | "") 56 | echo "*** Project description file hasn't been set" >&2 57 | exit 1 58 | ;; 59 | esac 60 | 61 | # --- Check types 62 | # if $newrev is 0000...0000, it's a commit to delete a ref. 63 | zero="0000000000000000000000000000000000000000" 64 | if [ "$newrev" = "$zero" ]; then 65 | newrev_type=delete 66 | else 67 | newrev_type=$(git cat-file -t $newrev) 68 | fi 69 | 70 | case "$refname","$newrev_type" in 71 | refs/tags/*,commit) 72 | # un-annotated tag 73 | short_refname=${refname##refs/tags/} 74 | if [ "$allowunannotated" != "true" ]; then 75 | echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 76 | echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 77 | exit 1 78 | fi 79 | ;; 80 | refs/tags/*,delete) 81 | # delete tag 82 | if [ "$allowdeletetag" != "true" ]; then 83 | echo "*** Deleting a tag is not allowed in this repository" >&2 84 | exit 1 85 | fi 86 | ;; 87 | refs/tags/*,tag) 88 | # annotated tag 89 | if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 90 | then 91 | echo "*** Tag '$refname' already exists." >&2 92 | echo "*** Modifying a tag is not allowed in this repository." >&2 93 | exit 1 94 | fi 95 | ;; 96 | refs/heads/*,commit) 97 | # branch 98 | if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then 99 | echo "*** Creating a branch is not allowed in this repository" >&2 100 | exit 1 101 | fi 102 | ;; 103 | refs/heads/*,delete) 104 | # delete branch 105 | if [ "$allowdeletebranch" != "true" ]; then 106 | echo "*** Deleting a branch is not allowed in this repository" >&2 107 | exit 1 108 | fi 109 | ;; 110 | refs/remotes/*,commit) 111 | # tracking branch 112 | ;; 113 | refs/remotes/*,delete) 114 | # delete tracking branch 115 | if [ "$allowdeletebranch" != "true" ]; then 116 | echo "*** Deleting a tracking branch is not allowed in this repository" >&2 117 | exit 1 118 | fi 119 | ;; 120 | *) 121 | # Anything else (is there anything else?) 122 | echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 123 | exit 1 124 | ;; 125 | esac 126 | 127 | # --- Finished 128 | exit 0 129 | -------------------------------------------------------------------------------- /test-data/fresh-repo-no-remote/git/info/exclude: -------------------------------------------------------------------------------- 1 | # git ls-files --others --exclude-from=.git/info/exclude 2 | # Lines that start with '#' are comments. 3 | # For a project mostly in C, the following would be a good set of 4 | # exclude patterns (uncomment them if you want to use them): 5 | # *.[oa] 6 | # *~ 7 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/HEAD: -------------------------------------------------------------------------------- 1 | ref: refs/heads/master 2 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/config: -------------------------------------------------------------------------------- 1 | [core] 2 | repositoryformatversion = 0 3 | filemode = true 4 | bare = false 5 | logallrefupdates = true 6 | ignorecase = true 7 | precomposeunicode = true 8 | [remote "origin"] 9 | url = git@amazon.com:username/new_repo 10 | fetch = +refs/heads/*:refs/remotes/origin/* 11 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/description: -------------------------------------------------------------------------------- 1 | Unnamed repository; edit this file 'description' to name the repository. 2 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/applypatch-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message taken by 4 | # applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. The hook is 8 | # allowed to edit the commit message file. 9 | # 10 | # To enable this hook, rename this file to "applypatch-msg". 11 | 12 | . git-sh-setup 13 | commitmsg="$(git rev-parse --git-path hooks/commit-msg)" 14 | test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} 15 | : 16 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message. 4 | # Called by "git commit" with one argument, the name of the file 5 | # that has the commit message. The hook should exit with non-zero 6 | # status after issuing an appropriate message if it wants to stop the 7 | # commit. The hook is allowed to edit the commit message file. 8 | # 9 | # To enable this hook, rename this file to "commit-msg". 10 | 11 | # Uncomment the below to add a Signed-off-by line to the message. 12 | # Doing this in a hook is a bad idea in general, but the prepare-commit-msg 13 | # hook is more suited to it. 14 | # 15 | # SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 16 | # grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" 17 | 18 | # This example catches duplicate Signed-off-by lines. 19 | 20 | test "" = "$(grep '^Signed-off-by: ' "$1" | 21 | sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { 22 | echo >&2 Duplicate Signed-off-by lines. 23 | exit 1 24 | } 25 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/fsmonitor-watchman.sample: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use strict; 4 | use warnings; 5 | use IPC::Open2; 6 | 7 | # An example hook script to integrate Watchman 8 | # (https://facebook.github.io/watchman/) with git to speed up detecting 9 | # new and modified files. 10 | # 11 | # The hook is passed a version (currently 1) and a time in nanoseconds 12 | # formatted as a string and outputs to stdout all files that have been 13 | # modified since the given time. Paths must be relative to the root of 14 | # the working tree and separated by a single NUL. 15 | # 16 | # To enable this hook, rename this file to "query-watchman" and set 17 | # 'git config core.fsmonitor .git/hooks/query-watchman' 18 | # 19 | my ($version, $time) = @ARGV; 20 | 21 | # Check the hook interface version 22 | 23 | if ($version == 1) { 24 | # convert nanoseconds to seconds 25 | $time = int $time / 1000000000; 26 | } else { 27 | die "Unsupported query-fsmonitor hook version '$version'.\n" . 28 | "Falling back to scanning...\n"; 29 | } 30 | 31 | my $git_work_tree; 32 | if ($^O =~ 'msys' || $^O =~ 'cygwin') { 33 | $git_work_tree = Win32::GetCwd(); 34 | $git_work_tree =~ tr/\\/\//; 35 | } else { 36 | require Cwd; 37 | $git_work_tree = Cwd::cwd(); 38 | } 39 | 40 | my $retry = 1; 41 | 42 | launch_watchman(); 43 | 44 | sub launch_watchman { 45 | 46 | my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty') 47 | or die "open2() failed: $!\n" . 48 | "Falling back to scanning...\n"; 49 | 50 | # In the query expression below we're asking for names of files that 51 | # changed since $time but were not transient (ie created after 52 | # $time but no longer exist). 53 | # 54 | # To accomplish this, we're using the "since" generator to use the 55 | # recency index to select candidate nodes and "fields" to limit the 56 | # output to file names only. Then we're using the "expression" term to 57 | # further constrain the results. 58 | # 59 | # The category of transient files that we want to ignore will have a 60 | # creation clock (cclock) newer than $time_t value and will also not 61 | # currently exist. 62 | 63 | my $query = <<" END"; 64 | ["query", "$git_work_tree", { 65 | "since": $time, 66 | "fields": ["name"], 67 | "expression": ["not", ["allof", ["since", $time, "cclock"], ["not", "exists"]]] 68 | }] 69 | END 70 | 71 | print CHLD_IN $query; 72 | close CHLD_IN; 73 | my $response = do {local $/; }; 74 | 75 | die "Watchman: command returned no output.\n" . 76 | "Falling back to scanning...\n" if $response eq ""; 77 | die "Watchman: command returned invalid output: $response\n" . 78 | "Falling back to scanning...\n" unless $response =~ /^\{/; 79 | 80 | my $json_pkg; 81 | eval { 82 | require JSON::XS; 83 | $json_pkg = "JSON::XS"; 84 | 1; 85 | } or do { 86 | require JSON::PP; 87 | $json_pkg = "JSON::PP"; 88 | }; 89 | 90 | my $o = $json_pkg->new->utf8->decode($response); 91 | 92 | if ($retry > 0 and $o->{error} and $o->{error} =~ m/unable to resolve root .* directory (.*) is not watched/) { 93 | print STDERR "Adding '$git_work_tree' to watchman's watch list.\n"; 94 | $retry--; 95 | qx/watchman watch "$git_work_tree"/; 96 | die "Failed to make watchman watch '$git_work_tree'.\n" . 97 | "Falling back to scanning...\n" if $? != 0; 98 | 99 | # Watchman will always return all files on the first query so 100 | # return the fast "everything is dirty" flag to git and do the 101 | # Watchman query just to get it over with now so we won't pay 102 | # the cost in git to look up each individual file. 103 | print "/\0"; 104 | eval { launch_watchman() }; 105 | exit 0; 106 | } 107 | 108 | die "Watchman: $o->{error}.\n" . 109 | "Falling back to scanning...\n" if $o->{error}; 110 | 111 | binmode STDOUT, ":utf8"; 112 | local $, = "\0"; 113 | print @{$o->{files}}; 114 | } 115 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/post-update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare a packed repository for use over 4 | # dumb transports. 5 | # 6 | # To enable this hook, rename this file to "post-update". 7 | 8 | exec git update-server-info 9 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-applypatch.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed 4 | # by applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. 8 | # 9 | # To enable this hook, rename this file to "pre-applypatch". 10 | 11 | . git-sh-setup 12 | precommit="$(git rev-parse --git-path hooks/pre-commit)" 13 | test -x "$precommit" && exec "$precommit" ${1+"$@"} 14 | : 15 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git commit" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message if 6 | # it wants to stop the commit. 7 | # 8 | # To enable this hook, rename this file to "pre-commit". 9 | 10 | if git rev-parse --verify HEAD >/dev/null 2>&1 11 | then 12 | against=HEAD 13 | else 14 | # Initial commit: diff against an empty tree object 15 | against=$(git hash-object -t tree /dev/null) 16 | fi 17 | 18 | # If you want to allow non-ASCII filenames set this variable to true. 19 | allownonascii=$(git config --bool hooks.allownonascii) 20 | 21 | # Redirect output to stderr. 22 | exec 1>&2 23 | 24 | # Cross platform projects tend to avoid non-ASCII filenames; prevent 25 | # them from being added to the repository. We exploit the fact that the 26 | # printable range starts at the space character and ends with tilde. 27 | if [ "$allownonascii" != "true" ] && 28 | # Note that the use of brackets around a tr range is ok here, (it's 29 | # even required, for portability to Solaris 10's /usr/bin/tr), since 30 | # the square bracket bytes happen to fall in the designated range. 31 | test $(git diff --cached --name-only --diff-filter=A -z $against | 32 | LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 33 | then 34 | cat <<\EOF 35 | Error: Attempt to add a non-ASCII file name. 36 | 37 | This can cause problems if you want to work with people on other platforms. 38 | 39 | To be portable it is advisable to rename the file. 40 | 41 | If you know what you are doing you can disable this check using: 42 | 43 | git config hooks.allownonascii true 44 | EOF 45 | exit 1 46 | fi 47 | 48 | # If there are whitespace errors, print the offending file names and fail. 49 | exec git diff-index --check --cached $against -- 50 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-merge-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git merge" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message to 6 | # stderr if it wants to stop the merge commit. 7 | # 8 | # To enable this hook, rename this file to "pre-merge-commit". 9 | 10 | . git-sh-setup 11 | test -x "$GIT_DIR/hooks/pre-commit" && 12 | exec "$GIT_DIR/hooks/pre-commit" 13 | : 14 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-push.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # An example hook script to verify what is about to be pushed. Called by "git 4 | # push" after it has checked the remote status, but before anything has been 5 | # pushed. If this script exits with a non-zero status nothing will be pushed. 6 | # 7 | # This hook is called with the following parameters: 8 | # 9 | # $1 -- Name of the remote to which the push is being done 10 | # $2 -- URL to which the push is being done 11 | # 12 | # If pushing without using a named remote those arguments will be equal. 13 | # 14 | # Information about the commits which are being pushed is supplied as lines to 15 | # the standard input in the form: 16 | # 17 | # 18 | # 19 | # This sample shows how to prevent push of commits where the log message starts 20 | # with "WIP" (work in progress). 21 | 22 | remote="$1" 23 | url="$2" 24 | 25 | z40=0000000000000000000000000000000000000000 26 | 27 | while read local_ref local_sha remote_ref remote_sha 28 | do 29 | if [ "$local_sha" = $z40 ] 30 | then 31 | # Handle delete 32 | : 33 | else 34 | if [ "$remote_sha" = $z40 ] 35 | then 36 | # New branch, examine all commits 37 | range="$local_sha" 38 | else 39 | # Update to existing branch, examine new commits 40 | range="$remote_sha..$local_sha" 41 | fi 42 | 43 | # Check for WIP commit 44 | commit=`git rev-list -n 1 --grep '^WIP' "$range"` 45 | if [ -n "$commit" ] 46 | then 47 | echo >&2 "Found WIP commit in $local_ref, not pushing" 48 | exit 1 49 | fi 50 | fi 51 | done 52 | 53 | exit 0 54 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-rebase.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (c) 2006, 2008 Junio C Hamano 4 | # 5 | # The "pre-rebase" hook is run just before "git rebase" starts doing 6 | # its job, and can prevent the command from running by exiting with 7 | # non-zero status. 8 | # 9 | # The hook is called with the following parameters: 10 | # 11 | # $1 -- the upstream the series was forked from. 12 | # $2 -- the branch being rebased (or empty when rebasing the current branch). 13 | # 14 | # This sample shows how to prevent topic branches that are already 15 | # merged to 'next' branch from getting rebased, because allowing it 16 | # would result in rebasing already published history. 17 | 18 | publish=next 19 | basebranch="$1" 20 | if test "$#" = 2 21 | then 22 | topic="refs/heads/$2" 23 | else 24 | topic=`git symbolic-ref HEAD` || 25 | exit 0 ;# we do not interrupt rebasing detached HEAD 26 | fi 27 | 28 | case "$topic" in 29 | refs/heads/??/*) 30 | ;; 31 | *) 32 | exit 0 ;# we do not interrupt others. 33 | ;; 34 | esac 35 | 36 | # Now we are dealing with a topic branch being rebased 37 | # on top of master. Is it OK to rebase it? 38 | 39 | # Does the topic really exist? 40 | git show-ref -q "$topic" || { 41 | echo >&2 "No such branch $topic" 42 | exit 1 43 | } 44 | 45 | # Is topic fully merged to master? 46 | not_in_master=`git rev-list --pretty=oneline ^master "$topic"` 47 | if test -z "$not_in_master" 48 | then 49 | echo >&2 "$topic is fully merged to master; better remove it." 50 | exit 1 ;# we could allow it, but there is no point. 51 | fi 52 | 53 | # Is topic ever merged to next? If so you should not be rebasing it. 54 | only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` 55 | only_next_2=`git rev-list ^master ${publish} | sort` 56 | if test "$only_next_1" = "$only_next_2" 57 | then 58 | not_in_topic=`git rev-list "^$topic" master` 59 | if test -z "$not_in_topic" 60 | then 61 | echo >&2 "$topic is already up to date with master" 62 | exit 1 ;# we could allow it, but there is no point. 63 | else 64 | exit 0 65 | fi 66 | else 67 | not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` 68 | /usr/bin/perl -e ' 69 | my $topic = $ARGV[0]; 70 | my $msg = "* $topic has commits already merged to public branch:\n"; 71 | my (%not_in_next) = map { 72 | /^([0-9a-f]+) /; 73 | ($1 => 1); 74 | } split(/\n/, $ARGV[1]); 75 | for my $elem (map { 76 | /^([0-9a-f]+) (.*)$/; 77 | [$1 => $2]; 78 | } split(/\n/, $ARGV[2])) { 79 | if (!exists $not_in_next{$elem->[0]}) { 80 | if ($msg) { 81 | print STDERR $msg; 82 | undef $msg; 83 | } 84 | print STDERR " $elem->[1]\n"; 85 | } 86 | } 87 | ' "$topic" "$not_in_next" "$not_in_master" 88 | exit 1 89 | fi 90 | 91 | <<\DOC_END 92 | 93 | This sample hook safeguards topic branches that have been 94 | published from being rewound. 95 | 96 | The workflow assumed here is: 97 | 98 | * Once a topic branch forks from "master", "master" is never 99 | merged into it again (either directly or indirectly). 100 | 101 | * Once a topic branch is fully cooked and merged into "master", 102 | it is deleted. If you need to build on top of it to correct 103 | earlier mistakes, a new topic branch is created by forking at 104 | the tip of the "master". This is not strictly necessary, but 105 | it makes it easier to keep your history simple. 106 | 107 | * Whenever you need to test or publish your changes to topic 108 | branches, merge them into "next" branch. 109 | 110 | The script, being an example, hardcodes the publish branch name 111 | to be "next", but it is trivial to make it configurable via 112 | $GIT_DIR/config mechanism. 113 | 114 | With this workflow, you would want to know: 115 | 116 | (1) ... if a topic branch has ever been merged to "next". Young 117 | topic branches can have stupid mistakes you would rather 118 | clean up before publishing, and things that have not been 119 | merged into other branches can be easily rebased without 120 | affecting other people. But once it is published, you would 121 | not want to rewind it. 122 | 123 | (2) ... if a topic branch has been fully merged to "master". 124 | Then you can delete it. More importantly, you should not 125 | build on top of it -- other people may already want to 126 | change things related to the topic as patches against your 127 | "master", so if you need further changes, it is better to 128 | fork the topic (perhaps with the same name) afresh from the 129 | tip of "master". 130 | 131 | Let's look at this example: 132 | 133 | o---o---o---o---o---o---o---o---o---o "next" 134 | / / / / 135 | / a---a---b A / / 136 | / / / / 137 | / / c---c---c---c B / 138 | / / / \ / 139 | / / / b---b C \ / 140 | / / / / \ / 141 | ---o---o---o---o---o---o---o---o---o---o---o "master" 142 | 143 | 144 | A, B and C are topic branches. 145 | 146 | * A has one fix since it was merged up to "next". 147 | 148 | * B has finished. It has been fully merged up to "master" and "next", 149 | and is ready to be deleted. 150 | 151 | * C has not merged to "next" at all. 152 | 153 | We would want to allow C to be rebased, refuse A, and encourage 154 | B to be deleted. 155 | 156 | To compute (1): 157 | 158 | git rev-list ^master ^topic next 159 | git rev-list ^master next 160 | 161 | if these match, topic has not merged in next at all. 162 | 163 | To compute (2): 164 | 165 | git rev-list master..topic 166 | 167 | if this is empty, it is fully merged to "master". 168 | 169 | DOC_END 170 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/pre-receive.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to make use of push options. 4 | # The example simply echoes all push options that start with 'echoback=' 5 | # and rejects all pushes when the "reject" push option is used. 6 | # 7 | # To enable this hook, rename this file to "pre-receive". 8 | 9 | if test -n "$GIT_PUSH_OPTION_COUNT" 10 | then 11 | i=0 12 | while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" 13 | do 14 | eval "value=\$GIT_PUSH_OPTION_$i" 15 | case "$value" in 16 | echoback=*) 17 | echo "echo from the pre-receive-hook: ${value#*=}" >&2 18 | ;; 19 | reject) 20 | exit 1 21 | esac 22 | i=$((i + 1)) 23 | done 24 | fi 25 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/prepare-commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare the commit log message. 4 | # Called by "git commit" with the name of the file that has the 5 | # commit message, followed by the description of the commit 6 | # message's source. The hook's purpose is to edit the commit 7 | # message file. If the hook fails with a non-zero status, 8 | # the commit is aborted. 9 | # 10 | # To enable this hook, rename this file to "prepare-commit-msg". 11 | 12 | # This hook includes three examples. The first one removes the 13 | # "# Please enter the commit message..." help message. 14 | # 15 | # The second includes the output of "git diff --name-status -r" 16 | # into the message, just before the "git status" output. It is 17 | # commented because it doesn't cope with --amend or with squashed 18 | # commits. 19 | # 20 | # The third example adds a Signed-off-by line to the message, that can 21 | # still be edited. This is rarely a good idea. 22 | 23 | COMMIT_MSG_FILE=$1 24 | COMMIT_SOURCE=$2 25 | SHA1=$3 26 | 27 | /usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" 28 | 29 | # case "$COMMIT_SOURCE,$SHA1" in 30 | # ,|template,) 31 | # /usr/bin/perl -i.bak -pe ' 32 | # print "\n" . `git diff --cached --name-status -r` 33 | # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; 34 | # *) ;; 35 | # esac 36 | 37 | # SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 38 | # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" 39 | # if test -z "$COMMIT_SOURCE" 40 | # then 41 | # /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" 42 | # fi 43 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/hooks/update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to block unannotated tags from entering. 4 | # Called by "git receive-pack" with arguments: refname sha1-old sha1-new 5 | # 6 | # To enable this hook, rename this file to "update". 7 | # 8 | # Config 9 | # ------ 10 | # hooks.allowunannotated 11 | # This boolean sets whether unannotated tags will be allowed into the 12 | # repository. By default they won't be. 13 | # hooks.allowdeletetag 14 | # This boolean sets whether deleting tags will be allowed in the 15 | # repository. By default they won't be. 16 | # hooks.allowmodifytag 17 | # This boolean sets whether a tag may be modified after creation. By default 18 | # it won't be. 19 | # hooks.allowdeletebranch 20 | # This boolean sets whether deleting branches will be allowed in the 21 | # repository. By default they won't be. 22 | # hooks.denycreatebranch 23 | # This boolean sets whether remotely creating branches will be denied 24 | # in the repository. By default this is allowed. 25 | # 26 | 27 | # --- Command line 28 | refname="$1" 29 | oldrev="$2" 30 | newrev="$3" 31 | 32 | # --- Safety check 33 | if [ -z "$GIT_DIR" ]; then 34 | echo "Don't run this script from the command line." >&2 35 | echo " (if you want, you could supply GIT_DIR then run" >&2 36 | echo " $0 )" >&2 37 | exit 1 38 | fi 39 | 40 | if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then 41 | echo "usage: $0 " >&2 42 | exit 1 43 | fi 44 | 45 | # --- Config 46 | allowunannotated=$(git config --bool hooks.allowunannotated) 47 | allowdeletebranch=$(git config --bool hooks.allowdeletebranch) 48 | denycreatebranch=$(git config --bool hooks.denycreatebranch) 49 | allowdeletetag=$(git config --bool hooks.allowdeletetag) 50 | allowmodifytag=$(git config --bool hooks.allowmodifytag) 51 | 52 | # check for no description 53 | projectdesc=$(sed -e '1q' "$GIT_DIR/description") 54 | case "$projectdesc" in 55 | "Unnamed repository"* | "") 56 | echo "*** Project description file hasn't been set" >&2 57 | exit 1 58 | ;; 59 | esac 60 | 61 | # --- Check types 62 | # if $newrev is 0000...0000, it's a commit to delete a ref. 63 | zero="0000000000000000000000000000000000000000" 64 | if [ "$newrev" = "$zero" ]; then 65 | newrev_type=delete 66 | else 67 | newrev_type=$(git cat-file -t $newrev) 68 | fi 69 | 70 | case "$refname","$newrev_type" in 71 | refs/tags/*,commit) 72 | # un-annotated tag 73 | short_refname=${refname##refs/tags/} 74 | if [ "$allowunannotated" != "true" ]; then 75 | echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 76 | echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 77 | exit 1 78 | fi 79 | ;; 80 | refs/tags/*,delete) 81 | # delete tag 82 | if [ "$allowdeletetag" != "true" ]; then 83 | echo "*** Deleting a tag is not allowed in this repository" >&2 84 | exit 1 85 | fi 86 | ;; 87 | refs/tags/*,tag) 88 | # annotated tag 89 | if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 90 | then 91 | echo "*** Tag '$refname' already exists." >&2 92 | echo "*** Modifying a tag is not allowed in this repository." >&2 93 | exit 1 94 | fi 95 | ;; 96 | refs/heads/*,commit) 97 | # branch 98 | if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then 99 | echo "*** Creating a branch is not allowed in this repository" >&2 100 | exit 1 101 | fi 102 | ;; 103 | refs/heads/*,delete) 104 | # delete branch 105 | if [ "$allowdeletebranch" != "true" ]; then 106 | echo "*** Deleting a branch is not allowed in this repository" >&2 107 | exit 1 108 | fi 109 | ;; 110 | refs/remotes/*,commit) 111 | # tracking branch 112 | ;; 113 | refs/remotes/*,delete) 114 | # delete tracking branch 115 | if [ "$allowdeletebranch" != "true" ]; then 116 | echo "*** Deleting a tracking branch is not allowed in this repository" >&2 117 | exit 1 118 | fi 119 | ;; 120 | *) 121 | # Anything else (is there anything else?) 122 | echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 123 | exit 1 124 | ;; 125 | esac 126 | 127 | # --- Finished 128 | exit 0 129 | -------------------------------------------------------------------------------- /test-data/fresh-repo-with-remote/git/info/exclude: -------------------------------------------------------------------------------- 1 | # git ls-files --others --exclude-from=.git/info/exclude 2 | # Lines that start with '#' are comments. 3 | # For a project mostly in C, the following would be a good set of 4 | # exclude patterns (uncomment them if you want to use them): 5 | # *.[oa] 6 | # *~ 7 | -------------------------------------------------------------------------------- /test-data/one-commit/git/COMMIT_EDITMSG: -------------------------------------------------------------------------------- 1 | hello hello 2 | -------------------------------------------------------------------------------- /test-data/one-commit/git/HEAD: -------------------------------------------------------------------------------- 1 | ref: refs/heads/master 2 | -------------------------------------------------------------------------------- /test-data/one-commit/git/config: -------------------------------------------------------------------------------- 1 | [core] 2 | repositoryformatversion = 0 3 | filemode = true 4 | bare = false 5 | logallrefupdates = true 6 | ignorecase = true 7 | precomposeunicode = true 8 | [remote "origin"] 9 | url = git@amazon.com:username/new_repo 10 | fetch = +refs/heads/*:refs/remotes/origin/* 11 | -------------------------------------------------------------------------------- /test-data/one-commit/git/description: -------------------------------------------------------------------------------- 1 | Unnamed repository; edit this file 'description' to name the repository. 2 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/applypatch-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message taken by 4 | # applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. The hook is 8 | # allowed to edit the commit message file. 9 | # 10 | # To enable this hook, rename this file to "applypatch-msg". 11 | 12 | . git-sh-setup 13 | commitmsg="$(git rev-parse --git-path hooks/commit-msg)" 14 | test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} 15 | : 16 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message. 4 | # Called by "git commit" with one argument, the name of the file 5 | # that has the commit message. The hook should exit with non-zero 6 | # status after issuing an appropriate message if it wants to stop the 7 | # commit. The hook is allowed to edit the commit message file. 8 | # 9 | # To enable this hook, rename this file to "commit-msg". 10 | 11 | # Uncomment the below to add a Signed-off-by line to the message. 12 | # Doing this in a hook is a bad idea in general, but the prepare-commit-msg 13 | # hook is more suited to it. 14 | # 15 | # SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 16 | # grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" 17 | 18 | # This example catches duplicate Signed-off-by lines. 19 | 20 | test "" = "$(grep '^Signed-off-by: ' "$1" | 21 | sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { 22 | echo >&2 Duplicate Signed-off-by lines. 23 | exit 1 24 | } 25 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/fsmonitor-watchman.sample: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use strict; 4 | use warnings; 5 | use IPC::Open2; 6 | 7 | # An example hook script to integrate Watchman 8 | # (https://facebook.github.io/watchman/) with git to speed up detecting 9 | # new and modified files. 10 | # 11 | # The hook is passed a version (currently 1) and a time in nanoseconds 12 | # formatted as a string and outputs to stdout all files that have been 13 | # modified since the given time. Paths must be relative to the root of 14 | # the working tree and separated by a single NUL. 15 | # 16 | # To enable this hook, rename this file to "query-watchman" and set 17 | # 'git config core.fsmonitor .git/hooks/query-watchman' 18 | # 19 | my ($version, $time) = @ARGV; 20 | 21 | # Check the hook interface version 22 | 23 | if ($version == 1) { 24 | # convert nanoseconds to seconds 25 | $time = int $time / 1000000000; 26 | } else { 27 | die "Unsupported query-fsmonitor hook version '$version'.\n" . 28 | "Falling back to scanning...\n"; 29 | } 30 | 31 | my $git_work_tree; 32 | if ($^O =~ 'msys' || $^O =~ 'cygwin') { 33 | $git_work_tree = Win32::GetCwd(); 34 | $git_work_tree =~ tr/\\/\//; 35 | } else { 36 | require Cwd; 37 | $git_work_tree = Cwd::cwd(); 38 | } 39 | 40 | my $retry = 1; 41 | 42 | launch_watchman(); 43 | 44 | sub launch_watchman { 45 | 46 | my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty') 47 | or die "open2() failed: $!\n" . 48 | "Falling back to scanning...\n"; 49 | 50 | # In the query expression below we're asking for names of files that 51 | # changed since $time but were not transient (ie created after 52 | # $time but no longer exist). 53 | # 54 | # To accomplish this, we're using the "since" generator to use the 55 | # recency index to select candidate nodes and "fields" to limit the 56 | # output to file names only. Then we're using the "expression" term to 57 | # further constrain the results. 58 | # 59 | # The category of transient files that we want to ignore will have a 60 | # creation clock (cclock) newer than $time_t value and will also not 61 | # currently exist. 62 | 63 | my $query = <<" END"; 64 | ["query", "$git_work_tree", { 65 | "since": $time, 66 | "fields": ["name"], 67 | "expression": ["not", ["allof", ["since", $time, "cclock"], ["not", "exists"]]] 68 | }] 69 | END 70 | 71 | print CHLD_IN $query; 72 | close CHLD_IN; 73 | my $response = do {local $/; }; 74 | 75 | die "Watchman: command returned no output.\n" . 76 | "Falling back to scanning...\n" if $response eq ""; 77 | die "Watchman: command returned invalid output: $response\n" . 78 | "Falling back to scanning...\n" unless $response =~ /^\{/; 79 | 80 | my $json_pkg; 81 | eval { 82 | require JSON::XS; 83 | $json_pkg = "JSON::XS"; 84 | 1; 85 | } or do { 86 | require JSON::PP; 87 | $json_pkg = "JSON::PP"; 88 | }; 89 | 90 | my $o = $json_pkg->new->utf8->decode($response); 91 | 92 | if ($retry > 0 and $o->{error} and $o->{error} =~ m/unable to resolve root .* directory (.*) is not watched/) { 93 | print STDERR "Adding '$git_work_tree' to watchman's watch list.\n"; 94 | $retry--; 95 | qx/watchman watch "$git_work_tree"/; 96 | die "Failed to make watchman watch '$git_work_tree'.\n" . 97 | "Falling back to scanning...\n" if $? != 0; 98 | 99 | # Watchman will always return all files on the first query so 100 | # return the fast "everything is dirty" flag to git and do the 101 | # Watchman query just to get it over with now so we won't pay 102 | # the cost in git to look up each individual file. 103 | print "/\0"; 104 | eval { launch_watchman() }; 105 | exit 0; 106 | } 107 | 108 | die "Watchman: $o->{error}.\n" . 109 | "Falling back to scanning...\n" if $o->{error}; 110 | 111 | binmode STDOUT, ":utf8"; 112 | local $, = "\0"; 113 | print @{$o->{files}}; 114 | } 115 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/post-update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare a packed repository for use over 4 | # dumb transports. 5 | # 6 | # To enable this hook, rename this file to "post-update". 7 | 8 | exec git update-server-info 9 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-applypatch.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed 4 | # by applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. 8 | # 9 | # To enable this hook, rename this file to "pre-applypatch". 10 | 11 | . git-sh-setup 12 | precommit="$(git rev-parse --git-path hooks/pre-commit)" 13 | test -x "$precommit" && exec "$precommit" ${1+"$@"} 14 | : 15 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git commit" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message if 6 | # it wants to stop the commit. 7 | # 8 | # To enable this hook, rename this file to "pre-commit". 9 | 10 | if git rev-parse --verify HEAD >/dev/null 2>&1 11 | then 12 | against=HEAD 13 | else 14 | # Initial commit: diff against an empty tree object 15 | against=$(git hash-object -t tree /dev/null) 16 | fi 17 | 18 | # If you want to allow non-ASCII filenames set this variable to true. 19 | allownonascii=$(git config --bool hooks.allownonascii) 20 | 21 | # Redirect output to stderr. 22 | exec 1>&2 23 | 24 | # Cross platform projects tend to avoid non-ASCII filenames; prevent 25 | # them from being added to the repository. We exploit the fact that the 26 | # printable range starts at the space character and ends with tilde. 27 | if [ "$allownonascii" != "true" ] && 28 | # Note that the use of brackets around a tr range is ok here, (it's 29 | # even required, for portability to Solaris 10's /usr/bin/tr), since 30 | # the square bracket bytes happen to fall in the designated range. 31 | test $(git diff --cached --name-only --diff-filter=A -z $against | 32 | LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 33 | then 34 | cat <<\EOF 35 | Error: Attempt to add a non-ASCII file name. 36 | 37 | This can cause problems if you want to work with people on other platforms. 38 | 39 | To be portable it is advisable to rename the file. 40 | 41 | If you know what you are doing you can disable this check using: 42 | 43 | git config hooks.allownonascii true 44 | EOF 45 | exit 1 46 | fi 47 | 48 | # If there are whitespace errors, print the offending file names and fail. 49 | exec git diff-index --check --cached $against -- 50 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-merge-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git merge" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message to 6 | # stderr if it wants to stop the merge commit. 7 | # 8 | # To enable this hook, rename this file to "pre-merge-commit". 9 | 10 | . git-sh-setup 11 | test -x "$GIT_DIR/hooks/pre-commit" && 12 | exec "$GIT_DIR/hooks/pre-commit" 13 | : 14 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-push.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # An example hook script to verify what is about to be pushed. Called by "git 4 | # push" after it has checked the remote status, but before anything has been 5 | # pushed. If this script exits with a non-zero status nothing will be pushed. 6 | # 7 | # This hook is called with the following parameters: 8 | # 9 | # $1 -- Name of the remote to which the push is being done 10 | # $2 -- URL to which the push is being done 11 | # 12 | # If pushing without using a named remote those arguments will be equal. 13 | # 14 | # Information about the commits which are being pushed is supplied as lines to 15 | # the standard input in the form: 16 | # 17 | # 18 | # 19 | # This sample shows how to prevent push of commits where the log message starts 20 | # with "WIP" (work in progress). 21 | 22 | remote="$1" 23 | url="$2" 24 | 25 | z40=0000000000000000000000000000000000000000 26 | 27 | while read local_ref local_sha remote_ref remote_sha 28 | do 29 | if [ "$local_sha" = $z40 ] 30 | then 31 | # Handle delete 32 | : 33 | else 34 | if [ "$remote_sha" = $z40 ] 35 | then 36 | # New branch, examine all commits 37 | range="$local_sha" 38 | else 39 | # Update to existing branch, examine new commits 40 | range="$remote_sha..$local_sha" 41 | fi 42 | 43 | # Check for WIP commit 44 | commit=`git rev-list -n 1 --grep '^WIP' "$range"` 45 | if [ -n "$commit" ] 46 | then 47 | echo >&2 "Found WIP commit in $local_ref, not pushing" 48 | exit 1 49 | fi 50 | fi 51 | done 52 | 53 | exit 0 54 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-rebase.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (c) 2006, 2008 Junio C Hamano 4 | # 5 | # The "pre-rebase" hook is run just before "git rebase" starts doing 6 | # its job, and can prevent the command from running by exiting with 7 | # non-zero status. 8 | # 9 | # The hook is called with the following parameters: 10 | # 11 | # $1 -- the upstream the series was forked from. 12 | # $2 -- the branch being rebased (or empty when rebasing the current branch). 13 | # 14 | # This sample shows how to prevent topic branches that are already 15 | # merged to 'next' branch from getting rebased, because allowing it 16 | # would result in rebasing already published history. 17 | 18 | publish=next 19 | basebranch="$1" 20 | if test "$#" = 2 21 | then 22 | topic="refs/heads/$2" 23 | else 24 | topic=`git symbolic-ref HEAD` || 25 | exit 0 ;# we do not interrupt rebasing detached HEAD 26 | fi 27 | 28 | case "$topic" in 29 | refs/heads/??/*) 30 | ;; 31 | *) 32 | exit 0 ;# we do not interrupt others. 33 | ;; 34 | esac 35 | 36 | # Now we are dealing with a topic branch being rebased 37 | # on top of master. Is it OK to rebase it? 38 | 39 | # Does the topic really exist? 40 | git show-ref -q "$topic" || { 41 | echo >&2 "No such branch $topic" 42 | exit 1 43 | } 44 | 45 | # Is topic fully merged to master? 46 | not_in_master=`git rev-list --pretty=oneline ^master "$topic"` 47 | if test -z "$not_in_master" 48 | then 49 | echo >&2 "$topic is fully merged to master; better remove it." 50 | exit 1 ;# we could allow it, but there is no point. 51 | fi 52 | 53 | # Is topic ever merged to next? If so you should not be rebasing it. 54 | only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` 55 | only_next_2=`git rev-list ^master ${publish} | sort` 56 | if test "$only_next_1" = "$only_next_2" 57 | then 58 | not_in_topic=`git rev-list "^$topic" master` 59 | if test -z "$not_in_topic" 60 | then 61 | echo >&2 "$topic is already up to date with master" 62 | exit 1 ;# we could allow it, but there is no point. 63 | else 64 | exit 0 65 | fi 66 | else 67 | not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` 68 | /usr/bin/perl -e ' 69 | my $topic = $ARGV[0]; 70 | my $msg = "* $topic has commits already merged to public branch:\n"; 71 | my (%not_in_next) = map { 72 | /^([0-9a-f]+) /; 73 | ($1 => 1); 74 | } split(/\n/, $ARGV[1]); 75 | for my $elem (map { 76 | /^([0-9a-f]+) (.*)$/; 77 | [$1 => $2]; 78 | } split(/\n/, $ARGV[2])) { 79 | if (!exists $not_in_next{$elem->[0]}) { 80 | if ($msg) { 81 | print STDERR $msg; 82 | undef $msg; 83 | } 84 | print STDERR " $elem->[1]\n"; 85 | } 86 | } 87 | ' "$topic" "$not_in_next" "$not_in_master" 88 | exit 1 89 | fi 90 | 91 | <<\DOC_END 92 | 93 | This sample hook safeguards topic branches that have been 94 | published from being rewound. 95 | 96 | The workflow assumed here is: 97 | 98 | * Once a topic branch forks from "master", "master" is never 99 | merged into it again (either directly or indirectly). 100 | 101 | * Once a topic branch is fully cooked and merged into "master", 102 | it is deleted. If you need to build on top of it to correct 103 | earlier mistakes, a new topic branch is created by forking at 104 | the tip of the "master". This is not strictly necessary, but 105 | it makes it easier to keep your history simple. 106 | 107 | * Whenever you need to test or publish your changes to topic 108 | branches, merge them into "next" branch. 109 | 110 | The script, being an example, hardcodes the publish branch name 111 | to be "next", but it is trivial to make it configurable via 112 | $GIT_DIR/config mechanism. 113 | 114 | With this workflow, you would want to know: 115 | 116 | (1) ... if a topic branch has ever been merged to "next". Young 117 | topic branches can have stupid mistakes you would rather 118 | clean up before publishing, and things that have not been 119 | merged into other branches can be easily rebased without 120 | affecting other people. But once it is published, you would 121 | not want to rewind it. 122 | 123 | (2) ... if a topic branch has been fully merged to "master". 124 | Then you can delete it. More importantly, you should not 125 | build on top of it -- other people may already want to 126 | change things related to the topic as patches against your 127 | "master", so if you need further changes, it is better to 128 | fork the topic (perhaps with the same name) afresh from the 129 | tip of "master". 130 | 131 | Let's look at this example: 132 | 133 | o---o---o---o---o---o---o---o---o---o "next" 134 | / / / / 135 | / a---a---b A / / 136 | / / / / 137 | / / c---c---c---c B / 138 | / / / \ / 139 | / / / b---b C \ / 140 | / / / / \ / 141 | ---o---o---o---o---o---o---o---o---o---o---o "master" 142 | 143 | 144 | A, B and C are topic branches. 145 | 146 | * A has one fix since it was merged up to "next". 147 | 148 | * B has finished. It has been fully merged up to "master" and "next", 149 | and is ready to be deleted. 150 | 151 | * C has not merged to "next" at all. 152 | 153 | We would want to allow C to be rebased, refuse A, and encourage 154 | B to be deleted. 155 | 156 | To compute (1): 157 | 158 | git rev-list ^master ^topic next 159 | git rev-list ^master next 160 | 161 | if these match, topic has not merged in next at all. 162 | 163 | To compute (2): 164 | 165 | git rev-list master..topic 166 | 167 | if this is empty, it is fully merged to "master". 168 | 169 | DOC_END 170 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/pre-receive.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to make use of push options. 4 | # The example simply echoes all push options that start with 'echoback=' 5 | # and rejects all pushes when the "reject" push option is used. 6 | # 7 | # To enable this hook, rename this file to "pre-receive". 8 | 9 | if test -n "$GIT_PUSH_OPTION_COUNT" 10 | then 11 | i=0 12 | while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" 13 | do 14 | eval "value=\$GIT_PUSH_OPTION_$i" 15 | case "$value" in 16 | echoback=*) 17 | echo "echo from the pre-receive-hook: ${value#*=}" >&2 18 | ;; 19 | reject) 20 | exit 1 21 | esac 22 | i=$((i + 1)) 23 | done 24 | fi 25 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/prepare-commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare the commit log message. 4 | # Called by "git commit" with the name of the file that has the 5 | # commit message, followed by the description of the commit 6 | # message's source. The hook's purpose is to edit the commit 7 | # message file. If the hook fails with a non-zero status, 8 | # the commit is aborted. 9 | # 10 | # To enable this hook, rename this file to "prepare-commit-msg". 11 | 12 | # This hook includes three examples. The first one removes the 13 | # "# Please enter the commit message..." help message. 14 | # 15 | # The second includes the output of "git diff --name-status -r" 16 | # into the message, just before the "git status" output. It is 17 | # commented because it doesn't cope with --amend or with squashed 18 | # commits. 19 | # 20 | # The third example adds a Signed-off-by line to the message, that can 21 | # still be edited. This is rarely a good idea. 22 | 23 | COMMIT_MSG_FILE=$1 24 | COMMIT_SOURCE=$2 25 | SHA1=$3 26 | 27 | /usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" 28 | 29 | # case "$COMMIT_SOURCE,$SHA1" in 30 | # ,|template,) 31 | # /usr/bin/perl -i.bak -pe ' 32 | # print "\n" . `git diff --cached --name-status -r` 33 | # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; 34 | # *) ;; 35 | # esac 36 | 37 | # SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 38 | # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" 39 | # if test -z "$COMMIT_SOURCE" 40 | # then 41 | # /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" 42 | # fi 43 | -------------------------------------------------------------------------------- /test-data/one-commit/git/hooks/update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to block unannotated tags from entering. 4 | # Called by "git receive-pack" with arguments: refname sha1-old sha1-new 5 | # 6 | # To enable this hook, rename this file to "update". 7 | # 8 | # Config 9 | # ------ 10 | # hooks.allowunannotated 11 | # This boolean sets whether unannotated tags will be allowed into the 12 | # repository. By default they won't be. 13 | # hooks.allowdeletetag 14 | # This boolean sets whether deleting tags will be allowed in the 15 | # repository. By default they won't be. 16 | # hooks.allowmodifytag 17 | # This boolean sets whether a tag may be modified after creation. By default 18 | # it won't be. 19 | # hooks.allowdeletebranch 20 | # This boolean sets whether deleting branches will be allowed in the 21 | # repository. By default they won't be. 22 | # hooks.denycreatebranch 23 | # This boolean sets whether remotely creating branches will be denied 24 | # in the repository. By default this is allowed. 25 | # 26 | 27 | # --- Command line 28 | refname="$1" 29 | oldrev="$2" 30 | newrev="$3" 31 | 32 | # --- Safety check 33 | if [ -z "$GIT_DIR" ]; then 34 | echo "Don't run this script from the command line." >&2 35 | echo " (if you want, you could supply GIT_DIR then run" >&2 36 | echo " $0 )" >&2 37 | exit 1 38 | fi 39 | 40 | if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then 41 | echo "usage: $0 " >&2 42 | exit 1 43 | fi 44 | 45 | # --- Config 46 | allowunannotated=$(git config --bool hooks.allowunannotated) 47 | allowdeletebranch=$(git config --bool hooks.allowdeletebranch) 48 | denycreatebranch=$(git config --bool hooks.denycreatebranch) 49 | allowdeletetag=$(git config --bool hooks.allowdeletetag) 50 | allowmodifytag=$(git config --bool hooks.allowmodifytag) 51 | 52 | # check for no description 53 | projectdesc=$(sed -e '1q' "$GIT_DIR/description") 54 | case "$projectdesc" in 55 | "Unnamed repository"* | "") 56 | echo "*** Project description file hasn't been set" >&2 57 | exit 1 58 | ;; 59 | esac 60 | 61 | # --- Check types 62 | # if $newrev is 0000...0000, it's a commit to delete a ref. 63 | zero="0000000000000000000000000000000000000000" 64 | if [ "$newrev" = "$zero" ]; then 65 | newrev_type=delete 66 | else 67 | newrev_type=$(git cat-file -t $newrev) 68 | fi 69 | 70 | case "$refname","$newrev_type" in 71 | refs/tags/*,commit) 72 | # un-annotated tag 73 | short_refname=${refname##refs/tags/} 74 | if [ "$allowunannotated" != "true" ]; then 75 | echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 76 | echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 77 | exit 1 78 | fi 79 | ;; 80 | refs/tags/*,delete) 81 | # delete tag 82 | if [ "$allowdeletetag" != "true" ]; then 83 | echo "*** Deleting a tag is not allowed in this repository" >&2 84 | exit 1 85 | fi 86 | ;; 87 | refs/tags/*,tag) 88 | # annotated tag 89 | if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 90 | then 91 | echo "*** Tag '$refname' already exists." >&2 92 | echo "*** Modifying a tag is not allowed in this repository." >&2 93 | exit 1 94 | fi 95 | ;; 96 | refs/heads/*,commit) 97 | # branch 98 | if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then 99 | echo "*** Creating a branch is not allowed in this repository" >&2 100 | exit 1 101 | fi 102 | ;; 103 | refs/heads/*,delete) 104 | # delete branch 105 | if [ "$allowdeletebranch" != "true" ]; then 106 | echo "*** Deleting a branch is not allowed in this repository" >&2 107 | exit 1 108 | fi 109 | ;; 110 | refs/remotes/*,commit) 111 | # tracking branch 112 | ;; 113 | refs/remotes/*,delete) 114 | # delete tracking branch 115 | if [ "$allowdeletebranch" != "true" ]; then 116 | echo "*** Deleting a tracking branch is not allowed in this repository" >&2 117 | exit 1 118 | fi 119 | ;; 120 | *) 121 | # Anything else (is there anything else?) 122 | echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 123 | exit 1 124 | ;; 125 | esac 126 | 127 | # --- Finished 128 | exit 0 129 | -------------------------------------------------------------------------------- /test-data/one-commit/git/index: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/one-commit/git/index -------------------------------------------------------------------------------- /test-data/one-commit/git/info/exclude: -------------------------------------------------------------------------------- 1 | # git ls-files --others --exclude-from=.git/info/exclude 2 | # Lines that start with '#' are comments. 3 | # For a project mostly in C, the following would be a good set of 4 | # exclude patterns (uncomment them if you want to use them): 5 | # *.[oa] 6 | # *~ 7 | -------------------------------------------------------------------------------- /test-data/one-commit/git/logs/HEAD: -------------------------------------------------------------------------------- 1 | 0000000000000000000000000000000000000000 cdb0fcad7400610b1d1797a326a89414525160fe Martin Schaef 1639514623 -0500 commit (initial): hello hello 2 | -------------------------------------------------------------------------------- /test-data/one-commit/git/logs/refs/heads/master: -------------------------------------------------------------------------------- 1 | 0000000000000000000000000000000000000000 cdb0fcad7400610b1d1797a326a89414525160fe Martin Schaef 1639514623 -0500 commit (initial): hello hello 2 | -------------------------------------------------------------------------------- /test-data/one-commit/git/objects/69/e978a2558e8b47b25058af8e10482831feded6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/one-commit/git/objects/69/e978a2558e8b47b25058af8e10482831feded6 -------------------------------------------------------------------------------- /test-data/one-commit/git/objects/9a/71f81a4b4754b686fd37cbb3c72d0250d344aa: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/one-commit/git/objects/9a/71f81a4b4754b686fd37cbb3c72d0250d344aa -------------------------------------------------------------------------------- /test-data/one-commit/git/objects/cd/b0fcad7400610b1d1797a326a89414525160fe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/one-commit/git/objects/cd/b0fcad7400610b1d1797a326a89414525160fe -------------------------------------------------------------------------------- /test-data/one-commit/git/refs/heads/master: -------------------------------------------------------------------------------- 1 | cdb0fcad7400610b1d1797a326a89414525160fe 2 | -------------------------------------------------------------------------------- /test-data/one-commit/test.txt: -------------------------------------------------------------------------------- 1 | hello world 2 | 3 | -------------------------------------------------------------------------------- /test-data/recommendations/exclude01.json: -------------------------------------------------------------------------------- 1 | [ { 2 | "filePath" : "src/main/java/com/folder01/File01.java", 3 | "recommendationId" : "1", 4 | "startLine" : 100, 5 | "endLine" : 100, 6 | "description" : "", 7 | "recommendationCategory" : "AWSBestPractices", 8 | "ruleMetadata" : { 9 | "ruleId" : "rule01", 10 | "ruleName" : "", 11 | "shortDescription" : "", 12 | "longDescription" : "", 13 | "ruleTags" : [ "java", "ignore-me" ] 14 | }, 15 | "severity" : "High" 16 | }, { 17 | "filePath" : "src/main/java/com/folder01/File01.java", 18 | "recommendationId" : "2", 19 | "startLine" : 200, 20 | "endLine" : 200, 21 | "description" : "", 22 | "recommendationCategory" : "AWSBestPractices", 23 | "ruleMetadata" : { 24 | "ruleId" : "rule02", 25 | "ruleName" : "", 26 | "shortDescription" : "", 27 | "longDescription" : "", 28 | "ruleTags" : [ "java" ] 29 | }, 30 | "severity" : "Medium" 31 | }, { 32 | "filePath" : "src/main/java/com/folder01/File02.java", 33 | "recommendationId" : "3", 34 | "startLine" : 100, 35 | "endLine" : 100, 36 | "description" : "", 37 | "recommendationCategory" : "AWSBestPractices", 38 | "ruleMetadata" : { 39 | "ruleId" : "rule01", 40 | "ruleName" : "", 41 | "shortDescription" : "", 42 | "longDescription" : "", 43 | "ruleTags" : [ "java" ] 44 | }, 45 | "severity" : "High" 46 | }, { 47 | "filePath" : "src/main/java/com/folder01/File02.java", 48 | "recommendationId" : "4", 49 | "startLine" : 200, 50 | "endLine" : 200, 51 | "description" : "", 52 | "recommendationCategory" : "AWSBestPractices", 53 | "ruleMetadata" : { 54 | "ruleId" : "rule02", 55 | "ruleName" : "", 56 | "shortDescription" : "", 57 | "longDescription" : "", 58 | "ruleTags" : [ "java" ] 59 | }, 60 | "severity" : "Medium" 61 | } 62 | ] 63 | 64 | -------------------------------------------------------------------------------- /test-data/recommendations/recommendations.json: -------------------------------------------------------------------------------- 1 | [ { 2 | "FilePath" : "src/main/java/com/amazonaws/gurureviewercli/Main.java", 3 | "RecommendationId" : "1509b96226f77f1d3bad3f53c42f56c09ce16ac1f3713d7007c3a6871ea71d5d", 4 | "StartLine" : 161, 5 | "EndLine" : 161, 6 | "Description" : "**Problem**: While wrapping the caught exception into a custom one, information about the caught exception is being lost, including information about the stack trace of the exception.\n\n**Fix**: If the caught exception object does not contain sensitive information, consider passing it as the \"rootCause\" or inner exception parameter to the constructor of the new exception before throwing the new exception. (Note that not all exception constructors support inner exceptions. Use a wrapper exception that supports inner exceptions.) \n[Learn more](https://www.ibm.com/support/pages/best-practice-catching-and-re-throwing-java-exceptions)\nSimilar issue at line numbers 166.", 7 | "RecommendationCategory" : "JavaBestPractices", 8 | "RuleMetadata" : { 9 | "RuleId" : "java/throw-exception-with-trace@v1.0", 10 | "RuleName" : "Stack trace not included in re-thrown exception", 11 | "ShortDescription" : "When re-throwing an exception, make sure to include the stack trace.", 12 | "LongDescription" : "When re-throwing an exception, make sure to include the stack trace. Otherwise pertinent debug information is lost.", 13 | "RuleTags" : [ "cwe-755", "java" ] 14 | }, 15 | "Severity" : "Medium" 16 | }, { 17 | "FilePath" : "src/main/java/com/amazonaws/gurureviewercli/Main.java", 18 | "RecommendationId" : "4d2c43618a2dac129818bef77093730e84a4e139eef3f0166334657503ecd88d", 19 | "StartLine" : 154, 20 | "EndLine" : 154, 21 | "Description" : "AWS Region is set using a `String`. To explicitly set a publicly available region, we recommend that you use the [Regions](https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/index.html?com/amazonaws/regions/Regions.html) enum.\n\n[Learn more](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-region-selection.html#region-selection-choose-region)", 22 | "RecommendationCategory" : "AWSBestPractices", 23 | "RuleMetadata" : { 24 | "RuleId" : "java/aws-region-enumeration@v1.0", 25 | "RuleName" : "Use an enum to specify an AWS Region", 26 | "ShortDescription" : "To minimize the risk of error, use an enum instead of a string to specify an AWS Region.", 27 | "LongDescription" : "Use a `Regions` enum instead of a string to specify an AWS Region. This can minimize the risk of error.", 28 | "RuleTags" : [ "aws", "java" ] 29 | }, 30 | "Severity" : "Medium" 31 | }, { 32 | "FilePath" : "src/main/java/com/amazonaws/gurureviewercli/Main.java", 33 | "RecommendationId" : "5ea0fef84e3623ae3c98ee10e25ab39899f1bfbe1a99e7ec374c31ae58d21cfe", 34 | "StartLine" : 194, 35 | "EndLine" : 194, 36 | "Description" : "AWS Region is set using a `String`. To explicitly set a publicly available region, we recommend that you use the [Regions](https://docs.aws.amazon.com/AWSJavaSDK/latest/javadoc/index.html?com/amazonaws/regions/Regions.html) enum.\n\n[Learn more](https://docs.aws.amazon.com/sdk-for-java/v1/developer-guide/java-dg-region-selection.html#region-selection-choose-region)", 37 | "RecommendationCategory" : "AWSBestPractices", 38 | "RuleMetadata" : { 39 | "RuleId" : "java/aws-region-enumeration@v1.0", 40 | "RuleName" : "Use an enum to specify an AWS Region", 41 | "ShortDescription" : "To minimize the risk of error, use an enum instead of a string to specify an AWS Region.", 42 | "LongDescription" : "Use a `Regions` enum instead of a string to specify an AWS Region. This can minimize the risk of error.", 43 | "RuleTags" : [ "aws", "java" ] 44 | }, 45 | "Severity" : "Medium" 46 | }, { 47 | "FilePath" : "src/main/java/com/amazonaws/gurureviewercli/adapter/ScanAdapter.java", 48 | "RecommendationId" : "ce6d28872c691f82a95099dd2e04eff0da58f23d13162c8b0421a0c46e03d163", 49 | "StartLine" : 86, 50 | "EndLine" : 86, 51 | "Description" : "**Problem**: InterruptedException is ignored. This can delay thread shutdown and clear the thread’s interrupt status. Only code that implements a thread’s interruption policy can swallow an interruption request.\n\n**Fix**: Rethrow the InterruptedException or reinterrupt the current thread using *Thread.currentThread().interrupt()* so that higher-level interrupt handlers can function correctly.\n If you are wrapping the InterruptedException inside a RuntimeException, call *Thread.currentThread().interrupt()* before throwing the RuntimeException.\n\nLearn more about [interrupts](https://docs.oracle.com/javase/tutorial/essential/concurrency/interrupt.html) and [dealing with InterruptedException](https://www.ibm.com/developerworks/java/library/j-jtp05236/index.html?ca=drs-#N10187)\n", 52 | "RecommendationCategory" : "JavaBestPractices", 53 | "RuleMetadata" : { } 54 | }, { 55 | "FilePath" : ".", 56 | "RecommendationId" : "security-1f1a4dd101b245a24f50b51d8f45862b8db66e1fee0aef4a2d0be46", 57 | "StartLine" : 1, 58 | "EndLine" : 1, 59 | "Description" : "New security detectors are periodically added, so consider regular security-analysis to keep your code secure.\nThe build artifacts for some of your source code are missing. Only source code that was uploaded with its accompanying build artifact files was analyzed for security recommendations. All of your source code was analyzed for source code quality recommendations because code quality analysis doesn’t require build artifacts.", 60 | "RecommendationCategory" : "CodeMaintenanceIssues", 61 | "RuleMetadata" : { } 62 | } ] -------------------------------------------------------------------------------- /test-data/source-and-class/src/org/owasp/benchmark/testcode/BenchmarkTest00001.java: -------------------------------------------------------------------------------- 1 | //{fact rule=path-traversal@v1.0 defects=1} 2 | 3 | /** 4 | * OWASP Benchmark v1.2 5 | * 6 | *

This file is part of the Open Web Application Security Project (OWASP) Benchmark Project. For 7 | * details, please see https://owasp.org/www-project-benchmark/. 9 | * 10 | *

The OWASP Benchmark is free software: you can redistribute it and/or modify it under the terms 11 | * of the GNU General Public License as published by the Free Software Foundation, version 2. 12 | * 13 | *

The OWASP Benchmark is distributed in the hope that it will be useful, but WITHOUT ANY 14 | * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR 15 | * PURPOSE. See the GNU General Public License for more details. 16 | * 17 | * @author Dave Wichers 18 | * @created 2015 19 | */ 20 | package org.owasp.benchmark.testcode; 21 | 22 | import java.io.IOException; 23 | import javax.servlet.ServletException; 24 | import javax.servlet.annotation.WebServlet; 25 | import javax.servlet.http.HttpServlet; 26 | import javax.servlet.http.HttpServletRequest; 27 | import javax.servlet.http.HttpServletResponse; 28 | 29 | @WebServlet(value = "/pathtraver-00/BenchmarkTest00001") 30 | public class BenchmarkTest00001 extends HttpServlet { 31 | 32 | private static final long serialVersionUID = 1L; 33 | 34 | @Override 35 | public void doGet(HttpServletRequest request, HttpServletResponse response) 36 | throws ServletException, IOException { 37 | response.setContentType("text/html;charset=UTF-8"); 38 | javax.servlet.http.Cookie userCookie = 39 | new javax.servlet.http.Cookie("BenchmarkTest00001", "FileName"); 40 | userCookie.setMaxAge(60 * 3); // Store cookie for 3 minutes 41 | userCookie.setSecure(true); 42 | userCookie.setPath(request.getRequestURI()); 43 | userCookie.setDomain(new java.net.URL(request.getRequestURL().toString()).getHost()); 44 | response.addCookie(userCookie); 45 | javax.servlet.RequestDispatcher rd = 46 | request.getRequestDispatcher("/pathtraver-00/BenchmarkTest00001.html"); 47 | rd.include(request, response); 48 | } 49 | 50 | @Override 51 | public void doPost(HttpServletRequest request, HttpServletResponse response) 52 | throws ServletException, IOException { 53 | // some code 54 | response.setContentType("text/html;charset=UTF-8"); 55 | 56 | javax.servlet.http.Cookie[] theCookies = request.getCookies(); 57 | 58 | String param = "noCookieValueSupplied"; 59 | if (theCookies != null) { 60 | for (javax.servlet.http.Cookie theCookie : theCookies) { 61 | if (theCookie.getName().equals("BenchmarkTest00001")) { 62 | param = java.net.URLDecoder.decode(theCookie.getValue(), "UTF-8"); 63 | break; 64 | } 65 | } 66 | } 67 | 68 | String fileName = null; 69 | java.io.FileInputStream fis = null; 70 | 71 | try { 72 | fileName = org.owasp.benchmark.helpers.Utils.TESTFILES_DIR + param; 73 | fis = new java.io.FileInputStream(new java.io.File(fileName)); 74 | byte[] b = new byte[1000]; 75 | int size = fis.read(b); 76 | response.getWriter() 77 | .println( 78 | "The beginning of file: '" 79 | + org.owasp.esapi.ESAPI.encoder().encodeForHTML(fileName) 80 | + "' is:\n\n" 81 | + org.owasp 82 | .esapi 83 | .ESAPI 84 | .encoder() 85 | .encodeForHTML(new String(b, 0, size))); 86 | } catch (Exception e) { 87 | System.out.println("Couldn't open FileInputStream on file: '" + fileName + "'"); 88 | response.getWriter() 89 | .println( 90 | "Problem getting FileInputStream: " 91 | + org.owasp 92 | .esapi 93 | .ESAPI 94 | .encoder() 95 | .encodeForHTML(e.getMessage())); 96 | } finally { 97 | if (fis != null) { 98 | try { 99 | fis.close(); 100 | fis = null; 101 | } catch (Exception e) { 102 | // we tried... 103 | } 104 | } 105 | } 106 | } 107 | } 108 | 109 | //{/fact} 110 | -------------------------------------------------------------------------------- /test-data/source-and-class/target/org/owasp/benchmark/testcode/BenchmarkTest00001.class: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/source-and-class/target/org/owasp/benchmark/testcode/BenchmarkTest00001.class -------------------------------------------------------------------------------- /test-data/source-and-class/unrelated/some.txt: -------------------------------------------------------------------------------- 1 | This is an unrelated text file. -------------------------------------------------------------------------------- /test-data/two-commits/git/COMMIT_EDITMSG: -------------------------------------------------------------------------------- 1 | one more commit 2 | -------------------------------------------------------------------------------- /test-data/two-commits/git/HEAD: -------------------------------------------------------------------------------- 1 | ref: refs/heads/master 2 | -------------------------------------------------------------------------------- /test-data/two-commits/git/config: -------------------------------------------------------------------------------- 1 | [core] 2 | repositoryformatversion = 0 3 | filemode = true 4 | bare = false 5 | logallrefupdates = true 6 | ignorecase = true 7 | precomposeunicode = true 8 | [remote "origin"] 9 | url = git@amazon.com:username/new_repo 10 | fetch = +refs/heads/*:refs/remotes/origin/* 11 | -------------------------------------------------------------------------------- /test-data/two-commits/git/description: -------------------------------------------------------------------------------- 1 | Unnamed repository; edit this file 'description' to name the repository. 2 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/applypatch-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message taken by 4 | # applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. The hook is 8 | # allowed to edit the commit message file. 9 | # 10 | # To enable this hook, rename this file to "applypatch-msg". 11 | 12 | . git-sh-setup 13 | commitmsg="$(git rev-parse --git-path hooks/commit-msg)" 14 | test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} 15 | : 16 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to check the commit log message. 4 | # Called by "git commit" with one argument, the name of the file 5 | # that has the commit message. The hook should exit with non-zero 6 | # status after issuing an appropriate message if it wants to stop the 7 | # commit. The hook is allowed to edit the commit message file. 8 | # 9 | # To enable this hook, rename this file to "commit-msg". 10 | 11 | # Uncomment the below to add a Signed-off-by line to the message. 12 | # Doing this in a hook is a bad idea in general, but the prepare-commit-msg 13 | # hook is more suited to it. 14 | # 15 | # SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 16 | # grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" 17 | 18 | # This example catches duplicate Signed-off-by lines. 19 | 20 | test "" = "$(grep '^Signed-off-by: ' "$1" | 21 | sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { 22 | echo >&2 Duplicate Signed-off-by lines. 23 | exit 1 24 | } 25 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/fsmonitor-watchman.sample: -------------------------------------------------------------------------------- 1 | #!/usr/bin/perl 2 | 3 | use strict; 4 | use warnings; 5 | use IPC::Open2; 6 | 7 | # An example hook script to integrate Watchman 8 | # (https://facebook.github.io/watchman/) with git to speed up detecting 9 | # new and modified files. 10 | # 11 | # The hook is passed a version (currently 1) and a time in nanoseconds 12 | # formatted as a string and outputs to stdout all files that have been 13 | # modified since the given time. Paths must be relative to the root of 14 | # the working tree and separated by a single NUL. 15 | # 16 | # To enable this hook, rename this file to "query-watchman" and set 17 | # 'git config core.fsmonitor .git/hooks/query-watchman' 18 | # 19 | my ($version, $time) = @ARGV; 20 | 21 | # Check the hook interface version 22 | 23 | if ($version == 1) { 24 | # convert nanoseconds to seconds 25 | $time = int $time / 1000000000; 26 | } else { 27 | die "Unsupported query-fsmonitor hook version '$version'.\n" . 28 | "Falling back to scanning...\n"; 29 | } 30 | 31 | my $git_work_tree; 32 | if ($^O =~ 'msys' || $^O =~ 'cygwin') { 33 | $git_work_tree = Win32::GetCwd(); 34 | $git_work_tree =~ tr/\\/\//; 35 | } else { 36 | require Cwd; 37 | $git_work_tree = Cwd::cwd(); 38 | } 39 | 40 | my $retry = 1; 41 | 42 | launch_watchman(); 43 | 44 | sub launch_watchman { 45 | 46 | my $pid = open2(\*CHLD_OUT, \*CHLD_IN, 'watchman -j --no-pretty') 47 | or die "open2() failed: $!\n" . 48 | "Falling back to scanning...\n"; 49 | 50 | # In the query expression below we're asking for names of files that 51 | # changed since $time but were not transient (ie created after 52 | # $time but no longer exist). 53 | # 54 | # To accomplish this, we're using the "since" generator to use the 55 | # recency index to select candidate nodes and "fields" to limit the 56 | # output to file names only. Then we're using the "expression" term to 57 | # further constrain the results. 58 | # 59 | # The category of transient files that we want to ignore will have a 60 | # creation clock (cclock) newer than $time_t value and will also not 61 | # currently exist. 62 | 63 | my $query = <<" END"; 64 | ["query", "$git_work_tree", { 65 | "since": $time, 66 | "fields": ["name"], 67 | "expression": ["not", ["allof", ["since", $time, "cclock"], ["not", "exists"]]] 68 | }] 69 | END 70 | 71 | print CHLD_IN $query; 72 | close CHLD_IN; 73 | my $response = do {local $/; }; 74 | 75 | die "Watchman: command returned no output.\n" . 76 | "Falling back to scanning...\n" if $response eq ""; 77 | die "Watchman: command returned invalid output: $response\n" . 78 | "Falling back to scanning...\n" unless $response =~ /^\{/; 79 | 80 | my $json_pkg; 81 | eval { 82 | require JSON::XS; 83 | $json_pkg = "JSON::XS"; 84 | 1; 85 | } or do { 86 | require JSON::PP; 87 | $json_pkg = "JSON::PP"; 88 | }; 89 | 90 | my $o = $json_pkg->new->utf8->decode($response); 91 | 92 | if ($retry > 0 and $o->{error} and $o->{error} =~ m/unable to resolve root .* directory (.*) is not watched/) { 93 | print STDERR "Adding '$git_work_tree' to watchman's watch list.\n"; 94 | $retry--; 95 | qx/watchman watch "$git_work_tree"/; 96 | die "Failed to make watchman watch '$git_work_tree'.\n" . 97 | "Falling back to scanning...\n" if $? != 0; 98 | 99 | # Watchman will always return all files on the first query so 100 | # return the fast "everything is dirty" flag to git and do the 101 | # Watchman query just to get it over with now so we won't pay 102 | # the cost in git to look up each individual file. 103 | print "/\0"; 104 | eval { launch_watchman() }; 105 | exit 0; 106 | } 107 | 108 | die "Watchman: $o->{error}.\n" . 109 | "Falling back to scanning...\n" if $o->{error}; 110 | 111 | binmode STDOUT, ":utf8"; 112 | local $, = "\0"; 113 | print @{$o->{files}}; 114 | } 115 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/post-update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare a packed repository for use over 4 | # dumb transports. 5 | # 6 | # To enable this hook, rename this file to "post-update". 7 | 8 | exec git update-server-info 9 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-applypatch.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed 4 | # by applypatch from an e-mail message. 5 | # 6 | # The hook should exit with non-zero status after issuing an 7 | # appropriate message if it wants to stop the commit. 8 | # 9 | # To enable this hook, rename this file to "pre-applypatch". 10 | 11 | . git-sh-setup 12 | precommit="$(git rev-parse --git-path hooks/pre-commit)" 13 | test -x "$precommit" && exec "$precommit" ${1+"$@"} 14 | : 15 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git commit" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message if 6 | # it wants to stop the commit. 7 | # 8 | # To enable this hook, rename this file to "pre-commit". 9 | 10 | if git rev-parse --verify HEAD >/dev/null 2>&1 11 | then 12 | against=HEAD 13 | else 14 | # Initial commit: diff against an empty tree object 15 | against=$(git hash-object -t tree /dev/null) 16 | fi 17 | 18 | # If you want to allow non-ASCII filenames set this variable to true. 19 | allownonascii=$(git config --bool hooks.allownonascii) 20 | 21 | # Redirect output to stderr. 22 | exec 1>&2 23 | 24 | # Cross platform projects tend to avoid non-ASCII filenames; prevent 25 | # them from being added to the repository. We exploit the fact that the 26 | # printable range starts at the space character and ends with tilde. 27 | if [ "$allownonascii" != "true" ] && 28 | # Note that the use of brackets around a tr range is ok here, (it's 29 | # even required, for portability to Solaris 10's /usr/bin/tr), since 30 | # the square bracket bytes happen to fall in the designated range. 31 | test $(git diff --cached --name-only --diff-filter=A -z $against | 32 | LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 33 | then 34 | cat <<\EOF 35 | Error: Attempt to add a non-ASCII file name. 36 | 37 | This can cause problems if you want to work with people on other platforms. 38 | 39 | To be portable it is advisable to rename the file. 40 | 41 | If you know what you are doing you can disable this check using: 42 | 43 | git config hooks.allownonascii true 44 | EOF 45 | exit 1 46 | fi 47 | 48 | # If there are whitespace errors, print the offending file names and fail. 49 | exec git diff-index --check --cached $against -- 50 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-merge-commit.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to verify what is about to be committed. 4 | # Called by "git merge" with no arguments. The hook should 5 | # exit with non-zero status after issuing an appropriate message to 6 | # stderr if it wants to stop the merge commit. 7 | # 8 | # To enable this hook, rename this file to "pre-merge-commit". 9 | 10 | . git-sh-setup 11 | test -x "$GIT_DIR/hooks/pre-commit" && 12 | exec "$GIT_DIR/hooks/pre-commit" 13 | : 14 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-push.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | # An example hook script to verify what is about to be pushed. Called by "git 4 | # push" after it has checked the remote status, but before anything has been 5 | # pushed. If this script exits with a non-zero status nothing will be pushed. 6 | # 7 | # This hook is called with the following parameters: 8 | # 9 | # $1 -- Name of the remote to which the push is being done 10 | # $2 -- URL to which the push is being done 11 | # 12 | # If pushing without using a named remote those arguments will be equal. 13 | # 14 | # Information about the commits which are being pushed is supplied as lines to 15 | # the standard input in the form: 16 | # 17 | # 18 | # 19 | # This sample shows how to prevent push of commits where the log message starts 20 | # with "WIP" (work in progress). 21 | 22 | remote="$1" 23 | url="$2" 24 | 25 | z40=0000000000000000000000000000000000000000 26 | 27 | while read local_ref local_sha remote_ref remote_sha 28 | do 29 | if [ "$local_sha" = $z40 ] 30 | then 31 | # Handle delete 32 | : 33 | else 34 | if [ "$remote_sha" = $z40 ] 35 | then 36 | # New branch, examine all commits 37 | range="$local_sha" 38 | else 39 | # Update to existing branch, examine new commits 40 | range="$remote_sha..$local_sha" 41 | fi 42 | 43 | # Check for WIP commit 44 | commit=`git rev-list -n 1 --grep '^WIP' "$range"` 45 | if [ -n "$commit" ] 46 | then 47 | echo >&2 "Found WIP commit in $local_ref, not pushing" 48 | exit 1 49 | fi 50 | fi 51 | done 52 | 53 | exit 0 54 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-rebase.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # Copyright (c) 2006, 2008 Junio C Hamano 4 | # 5 | # The "pre-rebase" hook is run just before "git rebase" starts doing 6 | # its job, and can prevent the command from running by exiting with 7 | # non-zero status. 8 | # 9 | # The hook is called with the following parameters: 10 | # 11 | # $1 -- the upstream the series was forked from. 12 | # $2 -- the branch being rebased (or empty when rebasing the current branch). 13 | # 14 | # This sample shows how to prevent topic branches that are already 15 | # merged to 'next' branch from getting rebased, because allowing it 16 | # would result in rebasing already published history. 17 | 18 | publish=next 19 | basebranch="$1" 20 | if test "$#" = 2 21 | then 22 | topic="refs/heads/$2" 23 | else 24 | topic=`git symbolic-ref HEAD` || 25 | exit 0 ;# we do not interrupt rebasing detached HEAD 26 | fi 27 | 28 | case "$topic" in 29 | refs/heads/??/*) 30 | ;; 31 | *) 32 | exit 0 ;# we do not interrupt others. 33 | ;; 34 | esac 35 | 36 | # Now we are dealing with a topic branch being rebased 37 | # on top of master. Is it OK to rebase it? 38 | 39 | # Does the topic really exist? 40 | git show-ref -q "$topic" || { 41 | echo >&2 "No such branch $topic" 42 | exit 1 43 | } 44 | 45 | # Is topic fully merged to master? 46 | not_in_master=`git rev-list --pretty=oneline ^master "$topic"` 47 | if test -z "$not_in_master" 48 | then 49 | echo >&2 "$topic is fully merged to master; better remove it." 50 | exit 1 ;# we could allow it, but there is no point. 51 | fi 52 | 53 | # Is topic ever merged to next? If so you should not be rebasing it. 54 | only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` 55 | only_next_2=`git rev-list ^master ${publish} | sort` 56 | if test "$only_next_1" = "$only_next_2" 57 | then 58 | not_in_topic=`git rev-list "^$topic" master` 59 | if test -z "$not_in_topic" 60 | then 61 | echo >&2 "$topic is already up to date with master" 62 | exit 1 ;# we could allow it, but there is no point. 63 | else 64 | exit 0 65 | fi 66 | else 67 | not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` 68 | /usr/bin/perl -e ' 69 | my $topic = $ARGV[0]; 70 | my $msg = "* $topic has commits already merged to public branch:\n"; 71 | my (%not_in_next) = map { 72 | /^([0-9a-f]+) /; 73 | ($1 => 1); 74 | } split(/\n/, $ARGV[1]); 75 | for my $elem (map { 76 | /^([0-9a-f]+) (.*)$/; 77 | [$1 => $2]; 78 | } split(/\n/, $ARGV[2])) { 79 | if (!exists $not_in_next{$elem->[0]}) { 80 | if ($msg) { 81 | print STDERR $msg; 82 | undef $msg; 83 | } 84 | print STDERR " $elem->[1]\n"; 85 | } 86 | } 87 | ' "$topic" "$not_in_next" "$not_in_master" 88 | exit 1 89 | fi 90 | 91 | <<\DOC_END 92 | 93 | This sample hook safeguards topic branches that have been 94 | published from being rewound. 95 | 96 | The workflow assumed here is: 97 | 98 | * Once a topic branch forks from "master", "master" is never 99 | merged into it again (either directly or indirectly). 100 | 101 | * Once a topic branch is fully cooked and merged into "master", 102 | it is deleted. If you need to build on top of it to correct 103 | earlier mistakes, a new topic branch is created by forking at 104 | the tip of the "master". This is not strictly necessary, but 105 | it makes it easier to keep your history simple. 106 | 107 | * Whenever you need to test or publish your changes to topic 108 | branches, merge them into "next" branch. 109 | 110 | The script, being an example, hardcodes the publish branch name 111 | to be "next", but it is trivial to make it configurable via 112 | $GIT_DIR/config mechanism. 113 | 114 | With this workflow, you would want to know: 115 | 116 | (1) ... if a topic branch has ever been merged to "next". Young 117 | topic branches can have stupid mistakes you would rather 118 | clean up before publishing, and things that have not been 119 | merged into other branches can be easily rebased without 120 | affecting other people. But once it is published, you would 121 | not want to rewind it. 122 | 123 | (2) ... if a topic branch has been fully merged to "master". 124 | Then you can delete it. More importantly, you should not 125 | build on top of it -- other people may already want to 126 | change things related to the topic as patches against your 127 | "master", so if you need further changes, it is better to 128 | fork the topic (perhaps with the same name) afresh from the 129 | tip of "master". 130 | 131 | Let's look at this example: 132 | 133 | o---o---o---o---o---o---o---o---o---o "next" 134 | / / / / 135 | / a---a---b A / / 136 | / / / / 137 | / / c---c---c---c B / 138 | / / / \ / 139 | / / / b---b C \ / 140 | / / / / \ / 141 | ---o---o---o---o---o---o---o---o---o---o---o "master" 142 | 143 | 144 | A, B and C are topic branches. 145 | 146 | * A has one fix since it was merged up to "next". 147 | 148 | * B has finished. It has been fully merged up to "master" and "next", 149 | and is ready to be deleted. 150 | 151 | * C has not merged to "next" at all. 152 | 153 | We would want to allow C to be rebased, refuse A, and encourage 154 | B to be deleted. 155 | 156 | To compute (1): 157 | 158 | git rev-list ^master ^topic next 159 | git rev-list ^master next 160 | 161 | if these match, topic has not merged in next at all. 162 | 163 | To compute (2): 164 | 165 | git rev-list master..topic 166 | 167 | if this is empty, it is fully merged to "master". 168 | 169 | DOC_END 170 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/pre-receive.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to make use of push options. 4 | # The example simply echoes all push options that start with 'echoback=' 5 | # and rejects all pushes when the "reject" push option is used. 6 | # 7 | # To enable this hook, rename this file to "pre-receive". 8 | 9 | if test -n "$GIT_PUSH_OPTION_COUNT" 10 | then 11 | i=0 12 | while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" 13 | do 14 | eval "value=\$GIT_PUSH_OPTION_$i" 15 | case "$value" in 16 | echoback=*) 17 | echo "echo from the pre-receive-hook: ${value#*=}" >&2 18 | ;; 19 | reject) 20 | exit 1 21 | esac 22 | i=$((i + 1)) 23 | done 24 | fi 25 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/prepare-commit-msg.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to prepare the commit log message. 4 | # Called by "git commit" with the name of the file that has the 5 | # commit message, followed by the description of the commit 6 | # message's source. The hook's purpose is to edit the commit 7 | # message file. If the hook fails with a non-zero status, 8 | # the commit is aborted. 9 | # 10 | # To enable this hook, rename this file to "prepare-commit-msg". 11 | 12 | # This hook includes three examples. The first one removes the 13 | # "# Please enter the commit message..." help message. 14 | # 15 | # The second includes the output of "git diff --name-status -r" 16 | # into the message, just before the "git status" output. It is 17 | # commented because it doesn't cope with --amend or with squashed 18 | # commits. 19 | # 20 | # The third example adds a Signed-off-by line to the message, that can 21 | # still be edited. This is rarely a good idea. 22 | 23 | COMMIT_MSG_FILE=$1 24 | COMMIT_SOURCE=$2 25 | SHA1=$3 26 | 27 | /usr/bin/perl -i.bak -ne 'print unless(m/^. Please enter the commit message/..m/^#$/)' "$COMMIT_MSG_FILE" 28 | 29 | # case "$COMMIT_SOURCE,$SHA1" in 30 | # ,|template,) 31 | # /usr/bin/perl -i.bak -pe ' 32 | # print "\n" . `git diff --cached --name-status -r` 33 | # if /^#/ && $first++ == 0' "$COMMIT_MSG_FILE" ;; 34 | # *) ;; 35 | # esac 36 | 37 | # SOB=$(git var GIT_COMMITTER_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') 38 | # git interpret-trailers --in-place --trailer "$SOB" "$COMMIT_MSG_FILE" 39 | # if test -z "$COMMIT_SOURCE" 40 | # then 41 | # /usr/bin/perl -i.bak -pe 'print "\n" if !$first_line++' "$COMMIT_MSG_FILE" 42 | # fi 43 | -------------------------------------------------------------------------------- /test-data/two-commits/git/hooks/update.sample: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # An example hook script to block unannotated tags from entering. 4 | # Called by "git receive-pack" with arguments: refname sha1-old sha1-new 5 | # 6 | # To enable this hook, rename this file to "update". 7 | # 8 | # Config 9 | # ------ 10 | # hooks.allowunannotated 11 | # This boolean sets whether unannotated tags will be allowed into the 12 | # repository. By default they won't be. 13 | # hooks.allowdeletetag 14 | # This boolean sets whether deleting tags will be allowed in the 15 | # repository. By default they won't be. 16 | # hooks.allowmodifytag 17 | # This boolean sets whether a tag may be modified after creation. By default 18 | # it won't be. 19 | # hooks.allowdeletebranch 20 | # This boolean sets whether deleting branches will be allowed in the 21 | # repository. By default they won't be. 22 | # hooks.denycreatebranch 23 | # This boolean sets whether remotely creating branches will be denied 24 | # in the repository. By default this is allowed. 25 | # 26 | 27 | # --- Command line 28 | refname="$1" 29 | oldrev="$2" 30 | newrev="$3" 31 | 32 | # --- Safety check 33 | if [ -z "$GIT_DIR" ]; then 34 | echo "Don't run this script from the command line." >&2 35 | echo " (if you want, you could supply GIT_DIR then run" >&2 36 | echo " $0 )" >&2 37 | exit 1 38 | fi 39 | 40 | if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then 41 | echo "usage: $0 " >&2 42 | exit 1 43 | fi 44 | 45 | # --- Config 46 | allowunannotated=$(git config --bool hooks.allowunannotated) 47 | allowdeletebranch=$(git config --bool hooks.allowdeletebranch) 48 | denycreatebranch=$(git config --bool hooks.denycreatebranch) 49 | allowdeletetag=$(git config --bool hooks.allowdeletetag) 50 | allowmodifytag=$(git config --bool hooks.allowmodifytag) 51 | 52 | # check for no description 53 | projectdesc=$(sed -e '1q' "$GIT_DIR/description") 54 | case "$projectdesc" in 55 | "Unnamed repository"* | "") 56 | echo "*** Project description file hasn't been set" >&2 57 | exit 1 58 | ;; 59 | esac 60 | 61 | # --- Check types 62 | # if $newrev is 0000...0000, it's a commit to delete a ref. 63 | zero="0000000000000000000000000000000000000000" 64 | if [ "$newrev" = "$zero" ]; then 65 | newrev_type=delete 66 | else 67 | newrev_type=$(git cat-file -t $newrev) 68 | fi 69 | 70 | case "$refname","$newrev_type" in 71 | refs/tags/*,commit) 72 | # un-annotated tag 73 | short_refname=${refname##refs/tags/} 74 | if [ "$allowunannotated" != "true" ]; then 75 | echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 76 | echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 77 | exit 1 78 | fi 79 | ;; 80 | refs/tags/*,delete) 81 | # delete tag 82 | if [ "$allowdeletetag" != "true" ]; then 83 | echo "*** Deleting a tag is not allowed in this repository" >&2 84 | exit 1 85 | fi 86 | ;; 87 | refs/tags/*,tag) 88 | # annotated tag 89 | if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 90 | then 91 | echo "*** Tag '$refname' already exists." >&2 92 | echo "*** Modifying a tag is not allowed in this repository." >&2 93 | exit 1 94 | fi 95 | ;; 96 | refs/heads/*,commit) 97 | # branch 98 | if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then 99 | echo "*** Creating a branch is not allowed in this repository" >&2 100 | exit 1 101 | fi 102 | ;; 103 | refs/heads/*,delete) 104 | # delete branch 105 | if [ "$allowdeletebranch" != "true" ]; then 106 | echo "*** Deleting a branch is not allowed in this repository" >&2 107 | exit 1 108 | fi 109 | ;; 110 | refs/remotes/*,commit) 111 | # tracking branch 112 | ;; 113 | refs/remotes/*,delete) 114 | # delete tracking branch 115 | if [ "$allowdeletebranch" != "true" ]; then 116 | echo "*** Deleting a tracking branch is not allowed in this repository" >&2 117 | exit 1 118 | fi 119 | ;; 120 | *) 121 | # Anything else (is there anything else?) 122 | echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 123 | exit 1 124 | ;; 125 | esac 126 | 127 | # --- Finished 128 | exit 0 129 | -------------------------------------------------------------------------------- /test-data/two-commits/git/index: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/index -------------------------------------------------------------------------------- /test-data/two-commits/git/info/exclude: -------------------------------------------------------------------------------- 1 | # git ls-files --others --exclude-from=.git/info/exclude 2 | # Lines that start with '#' are comments. 3 | # For a project mostly in C, the following would be a good set of 4 | # exclude patterns (uncomment them if you want to use them): 5 | # *.[oa] 6 | # *~ 7 | -------------------------------------------------------------------------------- /test-data/two-commits/git/logs/HEAD: -------------------------------------------------------------------------------- 1 | 0000000000000000000000000000000000000000 cdb0fcad7400610b1d1797a326a89414525160fe Martin Schaef 1639514623 -0500 commit (initial): hello hello 2 | cdb0fcad7400610b1d1797a326a89414525160fe 8ece465b7ecf8337bf767c9602d21bb92f2fad8a Martin Schaef 1639514670 -0500 commit: one more commit 3 | -------------------------------------------------------------------------------- /test-data/two-commits/git/logs/refs/heads/master: -------------------------------------------------------------------------------- 1 | 0000000000000000000000000000000000000000 cdb0fcad7400610b1d1797a326a89414525160fe Martin Schaef 1639514623 -0500 commit (initial): hello hello 2 | cdb0fcad7400610b1d1797a326a89414525160fe 8ece465b7ecf8337bf767c9602d21bb92f2fad8a Martin Schaef 1639514670 -0500 commit: one more commit 3 | -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/69/e978a2558e8b47b25058af8e10482831feded6: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/69/e978a2558e8b47b25058af8e10482831feded6 -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/7f/112b196b963ff72675febdbb97da5204f9497e: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/7f/112b196b963ff72675febdbb97da5204f9497e -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/8e/ce465b7ecf8337bf767c9602d21bb92f2fad8a: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/8e/ce465b7ecf8337bf767c9602d21bb92f2fad8a -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/96/f7fe170993c91f42a92e4ce8b1663d18ae7f54: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/96/f7fe170993c91f42a92e4ce8b1663d18ae7f54 -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/9a/71f81a4b4754b686fd37cbb3c72d0250d344aa: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/9a/71f81a4b4754b686fd37cbb3c72d0250d344aa -------------------------------------------------------------------------------- /test-data/two-commits/git/objects/cd/b0fcad7400610b1d1797a326a89414525160fe: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aws/aws-codeguru-cli/2bc43bc8713666061736b429ec0211c6ba80d523/test-data/two-commits/git/objects/cd/b0fcad7400610b1d1797a326a89414525160fe -------------------------------------------------------------------------------- /test-data/two-commits/git/refs/heads/master: -------------------------------------------------------------------------------- 1 | 8ece465b7ecf8337bf767c9602d21bb92f2fad8a 2 | -------------------------------------------------------------------------------- /test-data/two-commits/not-versioned.txt: -------------------------------------------------------------------------------- 1 | random file that's not part of the repo and thus should not be analyzed. 2 | 3 | -------------------------------------------------------------------------------- /test-data/two-commits/test.txt: -------------------------------------------------------------------------------- 1 | hello git 2 | 3 | --------------------------------------------------------------------------------