From 49819750bffc1d606b705a1fa9d5b3ecae77c990 Mon Sep 17 00:00:00 2001 From: Sourabh Sarvotham Parkala Date: Tue, 6 Sep 2022 11:31:38 +0200 Subject: [PATCH] Implement the score for pylint, mypy Part of #730 --- .../model/feature/oss/OssFeatures.java | 2 +- .../fosstars/model/score/oss/MyPyScore.java | 88 +++++ .../fosstars/model/score/oss/PylintScore.java | 88 +++++ .../model/score/oss/StaticAnalysisScore.java | 7 +- .../fosstars/tool/format/CommonFormatter.java | 10 + .../fosstars/util/Deserialization.java | 6 +- .../sap/oss/phosphor/fosstars/TestUtils.java | 12 + .../model/score/oss/MyPyScoreTest.java | 67 ++++ .../model/score/oss/OssSecurityScoreTest.java | 8 + .../model/score/oss/PylintScoreTest.java | 67 ++++ .../score/oss/StaticAnalysisScoreTest.java | 243 ++++++++++++- ...ssSecurityRatingMarkdownFormatterTest.java | 8 + .../tool/format/PrettyPrinterTest.java | 8 + .../OssArtifactSecurityRatingTestVectors.yml | 20 + .../oss/OssSecurityRatingTestVectors.yml | 20 + .../model/score/oss/MyPyScoreTestVectors.yml | 180 +++++++++ ...ProjectSecurityTestingScoreTestVectors.yml | 342 +++++++++++++++++- .../score/oss/PylintScoreTestVectors.yml | 180 +++++++++ .../oss/StaticAnalysisScoreTestVectors.yml | 312 ++++++++++++++++ ...veryAndSecurityTestingScoreTestVectors.yml | 32 ++ src/test/shell/tool/github/lib.sh | 16 +- 21 files changed, 1689 insertions(+), 27 deletions(-) create mode 100644 src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScore.java create mode 100644 src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScore.java create mode 100644 src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTest.java create mode 100644 src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTest.java create mode 100644 src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTestVectors.yml create mode 100644 src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTestVectors.yml diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/model/feature/oss/OssFeatures.java b/src/main/java/com/sap/oss/phosphor/fosstars/model/feature/oss/OssFeatures.java index 9b5a1a180..2fc82970e 100755 --- a/src/main/java/com/sap/oss/phosphor/fosstars/model/feature/oss/OssFeatures.java +++ b/src/main/java/com/sap/oss/phosphor/fosstars/model/feature/oss/OssFeatures.java @@ -285,7 +285,7 @@ private OssFeatures() { public static final Feature USES_GOSEC_WITH_RULES = new BooleanFeature("If a project runs GoSec scans with rules"); - /* + /** * Shows if an open-source project runs Pylint scans. * * @see Trigger diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScore.java b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScore.java new file mode 100644 index 000000000..5356b6c43 --- /dev/null +++ b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScore.java @@ -0,0 +1,88 @@ +package com.sap.oss.phosphor.fosstars.model.score.oss; + +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.LANGUAGES; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.other.Utils.findValue; +import static com.sap.oss.phosphor.fosstars.model.value.Language.PYTHON; + +import com.sap.oss.phosphor.fosstars.model.Value; +import com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures; +import com.sap.oss.phosphor.fosstars.model.score.FeatureBasedScore; +import com.sap.oss.phosphor.fosstars.model.value.Languages; +import com.sap.oss.phosphor.fosstars.model.value.ScoreValue; + +/** + *

The score shows if and how a project uses static analysis with MyPy. + * The score is based on the following features.

+ *
    + *
  • {@link OssFeatures#USES_MYPY_SCAN_CHECKS}
    • + *
  • {@link OssFeatures#RUNS_MYPY_SCANS}
    • + *
  • {@link OssFeatures#LANGUAGES}
    • + *
+ */ +public class MyPyScore extends FeatureBasedScore { + + /** + * Programming languages supported by MyPy. + * + * @see MyPy + * overview + */ + private static final Languages SUPPORTED_LANGUAGES = Languages.of(PYTHON); + + /** + * Defines how the score value is increased if a project runs MyPy scans. + */ + private static final double MYPY_SCANS_POINTS = 6.0; + + /** + * Defines how the score value is increased if a project runs MyPy checks for commits. + */ + private static final double MYPY_CHECKS_POINTS = 7.0; + + /** + * Initializes a new {@link MyPyScore}. + */ + MyPyScore() { + super("How a project uses MyPy", USES_MYPY_SCAN_CHECKS, RUNS_MYPY_SCANS, LANGUAGES); + } + + @Override + public ScoreValue calculate(Value... values) { + Value usesMyPyChecks = findValue(values, USES_MYPY_SCAN_CHECKS, + "Hey! You have to tell me if the project uses MyPy checks!"); + Value runsMyPyScans = findValue(values, RUNS_MYPY_SCANS, + "Hey! You have to tell me if the project runs MyPy scans!"); + Value languages = findValue(values, LANGUAGES, + "Hey! You have to tell me which languages the project uses!"); + + ScoreValue scoreValue = scoreValue(MIN, + usesMyPyChecks, runsMyPyScans, languages); + + if (allUnknown(usesMyPyChecks, runsMyPyScans, languages)) { + return scoreValue.makeUnknown().explain( + "The score value is unknown because all required features are unknown."); + } + + if (languages.isUnknown()) { + return scoreValue.makeNotApplicable().explain( + "The score is N/A because the project does not confirm which languages are used."); + } + + if (!languages.isUnknown() && !SUPPORTED_LANGUAGES.containsAnyOf(languages.get())) { + return scoreValue.makeNotApplicable().explain( + "The score is N/A because the project uses languages that are not supported by MyPy."); + } + + if (usesMyPyChecks.orElse(false)) { + scoreValue.increase(MYPY_CHECKS_POINTS); + } + + if (runsMyPyScans.orElse(false)) { + scoreValue.increase(MYPY_SCANS_POINTS); + } + + return scoreValue; + } +} \ No newline at end of file diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScore.java b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScore.java new file mode 100644 index 000000000..40900798a --- /dev/null +++ b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScore.java @@ -0,0 +1,88 @@ +package com.sap.oss.phosphor.fosstars.model.score.oss; + +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.LANGUAGES; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.other.Utils.findValue; +import static com.sap.oss.phosphor.fosstars.model.value.Language.PYTHON; + +import com.sap.oss.phosphor.fosstars.model.Value; +import com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures; +import com.sap.oss.phosphor.fosstars.model.score.FeatureBasedScore; +import com.sap.oss.phosphor.fosstars.model.value.Languages; +import com.sap.oss.phosphor.fosstars.model.value.ScoreValue; + +/** + *

The score shows if and how a project uses static analysis with Pylint. + * The score is based on the following features.

+ *
    + *
  • {@link OssFeatures#USES_PYLINT_SCAN_CHECKS}
    • + *
  • {@link OssFeatures#RUNS_PYLINT_SCANS}
    • + *
  • {@link OssFeatures#LANGUAGES}
    • + *
+ */ +public class PylintScore extends FeatureBasedScore { + + /** + * Programming languages supported by Pylint. + * + * @see Pylint + * overview + */ + private static final Languages SUPPORTED_LANGUAGES = Languages.of(PYTHON); + + /** + * Defines how the score value is increased if a project runs Pylint scans. + */ + private static final double PYLINT_SCANS_POINTS = 6.0; + + /** + * Defines how the score value is increased if a project runs Pylint checks for commits. + */ + private static final double PYLINT_CHECKS_POINTS = 7.0; + + /** + * Initializes a new {@link PylintScore}. + */ + PylintScore() { + super("How a project uses Pylint", USES_PYLINT_SCAN_CHECKS, RUNS_PYLINT_SCANS, LANGUAGES); + } + + @Override + public ScoreValue calculate(Value... values) { + Value usesPylintChecks = findValue(values, USES_PYLINT_SCAN_CHECKS, + "Hey! You have to tell me if the project uses Pylint checks!"); + Value runsPylintScans = findValue(values, RUNS_PYLINT_SCANS, + "Hey! You have to tell me if the project runs Pylint scans!"); + Value languages = findValue(values, LANGUAGES, + "Hey! You have to tell me which languages the project uses!"); + + ScoreValue scoreValue = scoreValue(MIN, + usesPylintChecks, runsPylintScans, languages); + + if (allUnknown(usesPylintChecks, runsPylintScans, languages)) { + return scoreValue.makeUnknown().explain( + "The score value is unknown because all required features are unknown."); + } + + if (languages.isUnknown()) { + return scoreValue.makeNotApplicable().explain( + "The score is N/A because the project does not confirm which languages are used."); + } + + if (!languages.isUnknown() && !SUPPORTED_LANGUAGES.containsAnyOf(languages.get())) { + return scoreValue.makeNotApplicable().explain( + "The score is N/A because the project uses languages that are not supported by Pylint."); + } + + if (usesPylintChecks.orElse(false)) { + scoreValue.increase(PYLINT_CHECKS_POINTS); + } + + if (runsPylintScans.orElse(false)) { + scoreValue.increase(PYLINT_SCANS_POINTS); + } + + return scoreValue; + } +} \ No newline at end of file diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScore.java b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScore.java index 0efa5c203..f83954f66 100644 --- a/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScore.java +++ b/src/main/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScore.java @@ -14,6 +14,8 @@ *
  • {@link LgtmScore}
    • *
  • {@link FindSecBugsScore}
    • *
  • {@link BanditScore}
    • + *
  • {@link PylintScore}
    • + *
  • {@link MyPyScore}
    • *
  • {@link GoSecScore}
    • * *

    The above sub-scores may not apply to all projects. The score considers only the sub-scores @@ -32,6 +34,8 @@ private static ScoreWeights initWeights() { .set(LgtmScore.class, new ImmutableWeight(1.0)) .set(FindSecBugsScore.class, new ImmutableWeight(0.5)) .set(BanditScore.class, new ImmutableWeight(0.5)) + .set(PylintScore.class, new ImmutableWeight(0.4)) + .set(MyPyScore.class, new ImmutableWeight(0.3)) .set(GoSecScore.class, new ImmutableWeight(0.5)); } @@ -41,6 +45,7 @@ private static ScoreWeights initWeights() { public StaticAnalysisScore() { super("How a project uses static analysis for security testing", setOf(new CodeqlScore(), new LgtmScore(), new FindSecBugsScore(), new BanditScore(), - new GoSecScore()), initWeights()); + new PylintScore(), new MyPyScore(), new GoSecScore()), + initWeights()); } } diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/tool/format/CommonFormatter.java b/src/main/java/com/sap/oss/phosphor/fosstars/tool/format/CommonFormatter.java index 9d13b99b4..5f4994e64 100755 --- a/src/main/java/com/sap/oss/phosphor/fosstars/tool/format/CommonFormatter.java +++ b/src/main/java/com/sap/oss/phosphor/fosstars/tool/format/CommonFormatter.java @@ -35,6 +35,8 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.REGISTERED_IN_REUSE; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SCANS_FOR_VULNERABLE_DEPENDENCIES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SECURITY_REVIEWS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SIGNS_ARTIFACTS; @@ -48,10 +50,12 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MEMORY_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_NOHTTP; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_ESAPI; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_ENCODER; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_HTML_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_REUSE; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SIGNED_COMMITS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SNYK; @@ -72,6 +76,7 @@ import com.sap.oss.phosphor.fosstars.model.Confidence; import com.sap.oss.phosphor.fosstars.model.Feature; import com.sap.oss.phosphor.fosstars.model.Value; +import com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore; import com.sap.oss.phosphor.fosstars.model.score.oss.CommunityCommitmentScore; import com.sap.oss.phosphor.fosstars.model.score.oss.DependabotScore; import com.sap.oss.phosphor.fosstars.model.score.oss.DependencyScanScore; @@ -136,6 +141,7 @@ public abstract class CommonFormatter implements Formatter { add(FuzzingScore.class, "Fuzzing"); add(StaticAnalysisScore.class, "Static analysis"); add(NoHttpToolScore.class, "nohttp tool"); + add(BanditScore.class, "Bandit score"); add(LgtmScore.class, "LGTM score"); add(GoSecScore.class, "GoSec score"); add(FindSecBugsScore.class, "FindSecBugs score"); @@ -240,6 +246,10 @@ private static void add(Class> clazz, String caption) { add(AVAILABILITY_IMPACT, "What is potential availability impact in case of a security problem?"); add(HAS_EXECUTABLE_BINARIES, "Does it have executable binaries?"); + add(RUNS_PYLINT_SCANS, "Does it run Pylint scans?"); + add(USES_PYLINT_SCAN_CHECKS, "Does it run Pylint scans on all commits?"); + add(RUNS_MYPY_SCANS, "Does it run MyPy scans?"); + add(USES_MYPY_SCAN_CHECKS, "Does it run MyPy scans on all commits?"); } /** diff --git a/src/main/java/com/sap/oss/phosphor/fosstars/util/Deserialization.java b/src/main/java/com/sap/oss/phosphor/fosstars/util/Deserialization.java index be12dbf7e..6ac91c2ee 100644 --- a/src/main/java/com/sap/oss/phosphor/fosstars/util/Deserialization.java +++ b/src/main/java/com/sap/oss/phosphor/fosstars/util/Deserialization.java @@ -59,6 +59,7 @@ import com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore; import com.sap.oss.phosphor.fosstars.model.score.oss.LgtmScore; import com.sap.oss.phosphor.fosstars.model.score.oss.MemorySafetyTestingScore; +import com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore; import com.sap.oss.phosphor.fosstars.model.score.oss.NoHttpToolScore; import com.sap.oss.phosphor.fosstars.model.score.oss.OssArtifactSecurityScore; import com.sap.oss.phosphor.fosstars.model.score.oss.OssRulesOfPlayScore; @@ -68,6 +69,7 @@ import com.sap.oss.phosphor.fosstars.model.score.oss.ProjectPopularityScore; import com.sap.oss.phosphor.fosstars.model.score.oss.ProjectSecurityAwarenessScore; import com.sap.oss.phosphor.fosstars.model.score.oss.ProjectSecurityTestingScore; +import com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore; import com.sap.oss.phosphor.fosstars.model.score.oss.SecurityReviewScore; import com.sap.oss.phosphor.fosstars.model.score.oss.SnykDependencyScanScore; import com.sap.oss.phosphor.fosstars.model.score.oss.StaticAnalysisScore; @@ -316,7 +318,9 @@ static ObjectMapper registerSubTypesIn(ObjectMapper mapper) { RiskImpactScore.AvailabilityRiskImpactFactor.class, CalculatedSecurityRiskIntroducedByOss.class, BanditScore.class, - GoSecScore.class + GoSecScore.class, + PylintScore.class, + MyPyScore.class ); // ratings diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/TestUtils.java b/src/test/java/com/sap/oss/phosphor/fosstars/TestUtils.java index e247eee7f..4d0773a0b 100644 --- a/src/test/java/com/sap/oss/phosphor/fosstars/TestUtils.java +++ b/src/test/java/com/sap/oss/phosphor/fosstars/TestUtils.java @@ -22,6 +22,8 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_BANDIT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SECURITY_REVIEWS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SIGNS_ARTIFACTS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SUPPORTED_BY_COMPANY; @@ -35,10 +37,12 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MEMORY_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_NOHTTP; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_ESAPI; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_ENCODER; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_HTML_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SIGNED_COMMITS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SNYK; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_UNDEFINED_BEHAVIOR_SANITIZER; @@ -203,6 +207,10 @@ public static Set> getDefaultValues() { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_WITH_RULES.value(false), USES_GOSEC_SCAN_CHECKS.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), USES_LGTM_CHECKS.value(true), WORST_LGTM_GRADE.value(LgtmGrade.B), USES_NOHTTP.value(true), @@ -282,6 +290,10 @@ public static Set> getBestValues() { RUNS_GOSEC_SCANS.value(true), USES_GOSEC_WITH_RULES.value(true), USES_GOSEC_SCAN_CHECKS.value(true), + RUNS_PYLINT_SCANS.value(true), + USES_PYLINT_SCAN_CHECKS.value(true), + RUNS_MYPY_SCANS.value(true), + USES_MYPY_SCAN_CHECKS.value(true), USES_LGTM_CHECKS.value(true), WORST_LGTM_GRADE.value(LgtmGrade.A_PLUS), USES_NOHTTP.value(true), diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTest.java new file mode 100644 index 000000000..c66b5b9b2 --- /dev/null +++ b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTest.java @@ -0,0 +1,67 @@ +package com.sap.oss.phosphor.fosstars.model.score.oss; + +import static com.sap.oss.phosphor.fosstars.TestUtils.assertScore; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.LANGUAGES; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.other.Utils.setOf; +import static com.sap.oss.phosphor.fosstars.model.value.Language.JAVA; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import com.sap.oss.phosphor.fosstars.model.Score; +import com.sap.oss.phosphor.fosstars.model.other.Utils; +import com.sap.oss.phosphor.fosstars.model.value.Languages; +import com.sap.oss.phosphor.fosstars.model.value.ScoreValue; +import org.junit.Test; + +public class MyPyScoreTest { + + private static final MyPyScore SCORE = new MyPyScore(); + + @Test + public void testBasics() { + assertFalse(SCORE.name().isEmpty()); + assertEquals(3, SCORE.features().size()); + assertTrue(SCORE.features().contains(USES_MYPY_SCAN_CHECKS)); + assertTrue(SCORE.features().contains(RUNS_MYPY_SCANS)); + assertTrue(SCORE.features().contains(LANGUAGES)); + assertTrue(SCORE.subScores().isEmpty()); + } + + @Test + public void testWithAllUnknown() { + ScoreValue scoreValue = SCORE.calculate(Utils.allUnknown(SCORE.allFeatures())); + assertTrue(scoreValue.isUnknown()); + } + + @Test + public void testCalculate() { + assertScore( + Score.INTERVAL, + SCORE, + setOf( + USES_MYPY_SCAN_CHECKS.value(true), + RUNS_MYPY_SCANS.value(true), + LANGUAGES.value(Languages.of(JAVA)))); + } + + @Test(expected = IllegalArgumentException.class) + public void testCalculateWithoutUsesMyPyChecksValue() { + SCORE.calculate(RUNS_MYPY_SCANS.unknown(), LANGUAGES.unknown()); + } + + @Test(expected = IllegalArgumentException.class) + public void testCalculateWithoutRunsMyPyScanChecksValue() { + SCORE.calculate(USES_MYPY_SCAN_CHECKS.unknown(), LANGUAGES.unknown()); + } + + @Test + public void testCalculateWithAllUnknownValues() { + assertTrue(SCORE.calculate( + USES_MYPY_SCAN_CHECKS.unknown(), + RUNS_MYPY_SCANS.unknown(), + LANGUAGES.unknown()).isUnknown()); + } +} \ No newline at end of file diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssSecurityScoreTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssSecurityScoreTest.java index bdba6418c..20f7dfc9b 100644 --- a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssSecurityScoreTest.java +++ b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/OssSecurityScoreTest.java @@ -21,6 +21,8 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_BANDIT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SECURITY_REVIEWS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SIGNS_ARTIFACTS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SUPPORTED_BY_COMPANY; @@ -34,10 +36,12 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MEMORY_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_NOHTTP; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_ESAPI; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_ENCODER; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_HTML_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SIGNED_COMMITS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SNYK; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_UNDEFINED_BEHAVIOR_SANITIZER; @@ -122,6 +126,10 @@ public static Set> defaultValues() { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_WITH_RULES.value(false), USES_GOSEC_SCAN_CHECKS.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), USES_LGTM_CHECKS.value(true), WORST_LGTM_GRADE.value(LgtmGrade.B), USES_NOHTTP.value(true), diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTest.java new file mode 100644 index 000000000..6adef4455 --- /dev/null +++ b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTest.java @@ -0,0 +1,67 @@ +package com.sap.oss.phosphor.fosstars.model.score.oss; + +import static com.sap.oss.phosphor.fosstars.TestUtils.assertScore; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.LANGUAGES; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.other.Utils.setOf; +import static com.sap.oss.phosphor.fosstars.model.value.Language.JAVA; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import com.sap.oss.phosphor.fosstars.model.Score; +import com.sap.oss.phosphor.fosstars.model.other.Utils; +import com.sap.oss.phosphor.fosstars.model.value.Languages; +import com.sap.oss.phosphor.fosstars.model.value.ScoreValue; +import org.junit.Test; + +public class PylintScoreTest { + + private static final PylintScore SCORE = new PylintScore(); + + @Test + public void testBasics() { + assertFalse(SCORE.name().isEmpty()); + assertEquals(3, SCORE.features().size()); + assertTrue(SCORE.features().contains(USES_PYLINT_SCAN_CHECKS)); + assertTrue(SCORE.features().contains(RUNS_PYLINT_SCANS)); + assertTrue(SCORE.features().contains(LANGUAGES)); + assertTrue(SCORE.subScores().isEmpty()); + } + + @Test + public void testWithAllUnknown() { + ScoreValue scoreValue = SCORE.calculate(Utils.allUnknown(SCORE.allFeatures())); + assertTrue(scoreValue.isUnknown()); + } + + @Test + public void testCalculate() { + assertScore( + Score.INTERVAL, + SCORE, + setOf( + USES_PYLINT_SCAN_CHECKS.value(true), + RUNS_PYLINT_SCANS.value(true), + LANGUAGES.value(Languages.of(JAVA)))); + } + + @Test(expected = IllegalArgumentException.class) + public void testCalculateWithoutUsesPylintChecksValue() { + SCORE.calculate(RUNS_PYLINT_SCANS.unknown(), LANGUAGES.unknown()); + } + + @Test(expected = IllegalArgumentException.class) + public void testCalculateWithoutRunsPylintScanChecksValue() { + SCORE.calculate(USES_PYLINT_SCAN_CHECKS.unknown(), LANGUAGES.unknown()); + } + + @Test + public void testCalculateWithAllUnknownValues() { + assertTrue(SCORE.calculate( + USES_PYLINT_SCAN_CHECKS.unknown(), + RUNS_PYLINT_SCANS.unknown(), + LANGUAGES.unknown()).isUnknown()); + } +} \ No newline at end of file diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTest.java index 583e4ae71..c60cef786 100644 --- a/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTest.java +++ b/src/test/java/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTest.java @@ -6,12 +6,16 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_BANDIT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_BANDIT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_CODEQL_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_FIND_SEC_BUGS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.WORST_LGTM_GRADE; import static com.sap.oss.phosphor.fosstars.model.value.Language.JAVA; import static com.sap.oss.phosphor.fosstars.model.value.Language.PYTHON; @@ -45,6 +49,10 @@ public void testCalculateWithFeatureValues() { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_SCAN_CHECKS.value(false), USES_GOSEC_WITH_RULES.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), LANGUAGES.value(Languages.of(JAVA)), USES_FIND_SEC_BUGS.value(false)); @@ -53,7 +61,7 @@ public void testCalculateWithFeatureValues() { assertTrue(Score.INTERVAL.contains(scoreValue.get())); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); } @Test @@ -70,6 +78,10 @@ public void testCalculateWithBanditScanRunValues() { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_SCAN_CHECKS.value(false), USES_GOSEC_WITH_RULES.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), LANGUAGES.value(Languages.of(PYTHON)), USES_FIND_SEC_BUGS.value(false)); @@ -78,7 +90,7 @@ public void testCalculateWithBanditScanRunValues() { assertTrue(Score.INTERVAL.contains(scoreValue.get())); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); } @Test @@ -95,9 +107,39 @@ public void testCalculateWithGoSecScanRunValues() { RUNS_GOSEC_SCANS.value(true), USES_GOSEC_SCAN_CHECKS.value(true), USES_GOSEC_WITH_RULES.value(true), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), + LANGUAGES.value(Languages.of(PYTHON)), + USES_FIND_SEC_BUGS.value(false)); + + assertFalse(scoreValue.isUnknown()); + assertFalse(scoreValue.isNotApplicable()); + assertTrue(Score.INTERVAL.contains(scoreValue.get())); + assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); + assertSame(score, scoreValue.score()); + assertEquals(7, scoreValue.usedValues().size()); + } + + @Test + public void testCalculateWithPylintScanRunValues() { + StaticAnalysisScore score = new StaticAnalysisScore(); + + ScoreValue scoreValue = score.calculate( + WORST_LGTM_GRADE.value(D), + USES_LGTM_CHECKS.value(false), + USES_CODEQL_CHECKS.value(false), + RUNS_CODEQL_SCANS.value(false), + USES_BANDIT_SCAN_CHECKS.value(false), + RUNS_BANDIT_SCANS.value(false), RUNS_GOSEC_SCANS.value(false), USES_GOSEC_SCAN_CHECKS.value(false), USES_GOSEC_WITH_RULES.value(false), + RUNS_PYLINT_SCANS.value(true), + USES_PYLINT_SCAN_CHECKS.value(true), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), LANGUAGES.value(Languages.of(PYTHON)), USES_FIND_SEC_BUGS.value(false)); @@ -106,7 +148,36 @@ public void testCalculateWithGoSecScanRunValues() { assertTrue(Score.INTERVAL.contains(scoreValue.get())); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); + } + + @Test + public void testCalculateWithMyPyScanRunValues() { + StaticAnalysisScore score = new StaticAnalysisScore(); + + ScoreValue scoreValue = score.calculate( + WORST_LGTM_GRADE.value(D), + USES_LGTM_CHECKS.value(false), + USES_CODEQL_CHECKS.value(false), + RUNS_CODEQL_SCANS.value(false), + USES_BANDIT_SCAN_CHECKS.value(false), + RUNS_BANDIT_SCANS.value(false), + RUNS_GOSEC_SCANS.value(false), + USES_GOSEC_SCAN_CHECKS.value(false), + USES_GOSEC_WITH_RULES.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(true), + USES_MYPY_SCAN_CHECKS.value(true), + LANGUAGES.value(Languages.of(PYTHON)), + USES_FIND_SEC_BUGS.value(false)); + + assertFalse(scoreValue.isUnknown()); + assertFalse(scoreValue.isNotApplicable()); + assertTrue(Score.INTERVAL.contains(scoreValue.get())); + assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); + assertSame(score, scoreValue.score()); + assertEquals(7, scoreValue.usedValues().size()); } @Test @@ -123,6 +194,10 @@ public void testCalculateWithAllUnknown() { RUNS_GOSEC_SCANS.unknown(), USES_GOSEC_SCAN_CHECKS.unknown(), USES_GOSEC_WITH_RULES.unknown(), + RUNS_PYLINT_SCANS.unknown(), + USES_PYLINT_SCAN_CHECKS.unknown(), + RUNS_MYPY_SCANS.unknown(), + USES_MYPY_SCAN_CHECKS.unknown(), LANGUAGES.unknown(), USES_FIND_SEC_BUGS.unknown()); @@ -130,7 +205,7 @@ public void testCalculateWithAllUnknown() { assertFalse(scoreValue.isNotApplicable()); assertEquals(Confidence.MIN, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); } @Test @@ -152,20 +227,29 @@ public void testCalculateWithAllNotApplicable() { ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) .makeNotApplicable() .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .makeNotApplicable() + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .makeNotApplicable() + .confidence(Confidence.MAX); ScoreValue scoreValue = score.calculate( codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, - goSecScoreValue); + goSecScoreValue, pylintValue, mypyValue); assertFalse(scoreValue.isUnknown()); assertTrue(scoreValue.isNotApplicable()); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); assertTrue(scoreValue.usedValues().contains(banditScoreValue)); assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); } @Test @@ -187,20 +271,30 @@ public void testCalculateWithSubScoreValues() { ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) .set(MIN) .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .set(MIN) + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .set(MIN) + .confidence(Confidence.MAX); ScoreValue scoreValue = score.calculate( codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, - goSecScoreValue); + goSecScoreValue, pylintValue, mypyValue); assertFalse(scoreValue.isUnknown()); assertFalse(scoreValue.isNotApplicable()); assertEquals(MIN, scoreValue.get(), DELTA); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); assertTrue(scoreValue.usedValues().contains(banditScoreValue)); + assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); } @Test @@ -224,21 +318,30 @@ public void testCalculateWithFindSecBugsNotApplicable() { ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) .set(value) .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .set(value) + .confidence(Confidence.MAX); ScoreValue scoreValue = score.calculate( codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, - goSecScoreValue); + goSecScoreValue, pylintValue, mypyValue); assertFalse(scoreValue.isUnknown()); assertFalse(scoreValue.isNotApplicable()); assertEquals(value, scoreValue.get(), DELTA); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); assertTrue(scoreValue.usedValues().contains(banditScoreValue)); assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); } @Test @@ -262,21 +365,30 @@ public void testCalculateWithBanditNotApplicable() { ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) .set(value) .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .set(value) + .confidence(Confidence.MAX); ScoreValue scoreValue = score.calculate( codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, - goSecScoreValue); + goSecScoreValue, pylintValue, mypyValue); assertFalse(scoreValue.isUnknown()); assertFalse(scoreValue.isNotApplicable()); assertEquals(value, scoreValue.get(), DELTA); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); assertTrue(scoreValue.usedValues().contains(banditScoreValue)); assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); } @Test @@ -300,21 +412,124 @@ public void testCalculateWithGoSecNotApplicable() { ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) .makeNotApplicable() .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .set(value) + .confidence(Confidence.MAX); + + ScoreValue scoreValue = score.calculate( + codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, + goSecScoreValue, pylintValue, mypyValue); + + assertFalse(scoreValue.isUnknown()); + assertFalse(scoreValue.isNotApplicable()); + assertEquals(value, scoreValue.get(), DELTA); + assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); + assertSame(score, scoreValue.score()); + assertEquals(7, scoreValue.usedValues().size()); + assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); + assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); + assertTrue(scoreValue.usedValues().contains(banditScoreValue)); + assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); + } + + @Test + public void testCalculateWithPylintNotApplicable() { + StaticAnalysisScore score = new StaticAnalysisScore(); + + final double value = 5.5; + + ScoreValue codeqlScoreValue = new ScoreValue(new CodeqlScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue lgtmScoreValue = new ScoreValue(new LgtmScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue findSecBugsScoreValue = new ScoreValue(new FindSecBugsScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue banditScoreValue = new ScoreValue(new BanditScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .makeNotApplicable() + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .set(value) + .confidence(Confidence.MAX); + + ScoreValue scoreValue = score.calculate( + codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, + goSecScoreValue, pylintValue, mypyValue); + + assertFalse(scoreValue.isUnknown()); + assertFalse(scoreValue.isNotApplicable()); + assertEquals(value, scoreValue.get(), DELTA); + assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); + assertSame(score, scoreValue.score()); + assertEquals(7, scoreValue.usedValues().size()); + assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); + assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); + assertTrue(scoreValue.usedValues().contains(banditScoreValue)); + assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); + } + + @Test + public void testCalculateWithMyPyNotApplicable() { + StaticAnalysisScore score = new StaticAnalysisScore(); + + final double value = 5.5; + + ScoreValue codeqlScoreValue = new ScoreValue(new CodeqlScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue lgtmScoreValue = new ScoreValue(new LgtmScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue findSecBugsScoreValue = new ScoreValue(new FindSecBugsScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue banditScoreValue = new ScoreValue(new BanditScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue goSecScoreValue = new ScoreValue(new GoSecScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue pylintValue = new ScoreValue(new PylintScore()) + .set(value) + .confidence(Confidence.MAX); + ScoreValue mypyValue = new ScoreValue(new MyPyScore()) + .makeNotApplicable() + .confidence(Confidence.MAX); ScoreValue scoreValue = score.calculate( codeqlScoreValue, lgtmScoreValue, findSecBugsScoreValue, banditScoreValue, - goSecScoreValue); + goSecScoreValue, pylintValue, mypyValue); assertFalse(scoreValue.isUnknown()); assertFalse(scoreValue.isNotApplicable()); assertEquals(value, scoreValue.get(), DELTA); assertEquals(Confidence.MAX, scoreValue.confidence(), DELTA); assertSame(score, scoreValue.score()); - assertEquals(5, scoreValue.usedValues().size()); + assertEquals(7, scoreValue.usedValues().size()); assertTrue(scoreValue.usedValues().contains(lgtmScoreValue)); assertTrue(scoreValue.usedValues().contains(findSecBugsScoreValue)); assertTrue(scoreValue.usedValues().contains(banditScoreValue)); assertTrue(scoreValue.usedValues().contains(goSecScoreValue)); + assertTrue(scoreValue.usedValues().contains(codeqlScoreValue)); + assertTrue(scoreValue.usedValues().contains(pylintValue)); + assertTrue(scoreValue.usedValues().contains(mypyValue)); } @Test diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/OssSecurityRatingMarkdownFormatterTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/OssSecurityRatingMarkdownFormatterTest.java index a0b8b86ed..5ad68f043 100755 --- a/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/OssSecurityRatingMarkdownFormatterTest.java +++ b/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/OssSecurityRatingMarkdownFormatterTest.java @@ -21,6 +21,8 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_BANDIT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SECURITY_REVIEWS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SIGNS_ARTIFACTS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SUPPORTED_BY_COMPANY; @@ -34,10 +36,12 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MEMORY_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_NOHTTP; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_ESAPI; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_ENCODER; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_HTML_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SIGNED_COMMITS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SNYK; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_UNDEFINED_BEHAVIOR_SANITIZER; @@ -99,6 +103,10 @@ public class OssSecurityRatingMarkdownFormatterTest { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_WITH_RULES.value(false), USES_GOSEC_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), USES_LGTM_CHECKS.value(true), WORST_LGTM_GRADE.value(LgtmGrade.A), USES_GITHUB_FOR_DEVELOPMENT.value(false), diff --git a/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/PrettyPrinterTest.java b/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/PrettyPrinterTest.java index 56d82dc80..9f97b70cb 100644 --- a/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/PrettyPrinterTest.java +++ b/src/test/java/com/sap/oss/phosphor/fosstars/tool/format/PrettyPrinterTest.java @@ -21,6 +21,8 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_BANDIT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_CODEQL_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_GOSEC_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_MYPY_SCANS; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.RUNS_PYLINT_SCANS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SECURITY_REVIEWS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SIGNS_ARTIFACTS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.SUPPORTED_BY_COMPANY; @@ -34,10 +36,12 @@ import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_GOSEC_WITH_RULES; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_LGTM_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MEMORY_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_MYPY_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_NOHTTP; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_ESAPI; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_ENCODER; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_OWASP_JAVA_HTML_SANITIZER; +import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_PYLINT_SCAN_CHECKS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SIGNED_COMMITS; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_SNYK; import static com.sap.oss.phosphor.fosstars.model.feature.oss.OssFeatures.USES_UNDEFINED_BEHAVIOR_SANITIZER; @@ -101,6 +105,10 @@ public class PrettyPrinterTest { RUNS_GOSEC_SCANS.value(false), USES_GOSEC_WITH_RULES.value(false), USES_GOSEC_SCAN_CHECKS.value(false), + RUNS_PYLINT_SCANS.value(false), + USES_PYLINT_SCAN_CHECKS.value(false), + RUNS_MYPY_SCANS.value(false), + USES_MYPY_SCAN_CHECKS.value(false), USES_LGTM_CHECKS.value(true), WORST_LGTM_GRADE.value(LgtmGrade.A), USES_GITHUB_FOR_DEVELOPMENT.value(false), diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssArtifactSecurityRatingTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssArtifactSecurityRatingTestVectors.yml index 1e9be9f02..06e61bdf3 100644 --- a/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssArtifactSecurityRatingTestVectors.yml +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssArtifactSecurityRatingTestVectors.yml @@ -156,6 +156,26 @@ defaults: type: "BooleanFeature" name: "If a project runs GoSec scan checks for commits" flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: false - type: "BooleanValue" feature: type: "BooleanFeature" diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssSecurityRatingTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssSecurityRatingTestVectors.yml index 54ce75096..d9aa6e8f6 100644 --- a/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssSecurityRatingTestVectors.yml +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/rating/oss/OssSecurityRatingTestVectors.yml @@ -132,6 +132,26 @@ defaults: type: "BooleanFeature" name: "If a project has executable binaries" flag: false +- type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: false +- type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: false +- type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: false +- type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: false - type: "SecurityReviewsValue" feature: type: "SecurityReviewsFeature" diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTestVectors.yml new file mode 100644 index 000000000..eac29f6e4 --- /dev/null +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/MyPyScoreTestVectors.yml @@ -0,0 +1,180 @@ +--- +defaults: + - type: "LanguagesValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + languages: + elements: + - "PYTHON" +elements: + - type: "StandardTestVector" + values: + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + - type: "UnknownValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedUnknownScore: true + alias: "all_unknown" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: false + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_1" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: false + expectedScore: + type: "DoubleInterval" + from: 6.0 + openLeft: false + negativeInfinity: false + to: 8.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_2" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: true + expectedScore: + type: "DoubleInterval" + from: 4.0 + openLeft: false + negativeInfinity: false + to: 6.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_3" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: true + expectedScore: + type: "DoubleInterval" + from: 9.0 + openLeft: false + negativeInfinity: false + to: 10.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_4" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: false + - type: "LanguagesValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + languages: + elements: + - "OTHER" + expectedScore: + type: "DoubleInterval" + from: 9.0 + openLeft: false + negativeInfinity: false + to: 10.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: true + alias: "test_vector_5" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + flag: true + - type: "UnknownValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: true + alias: "test_vector_6" diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/ProjectSecurityTestingScoreTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/ProjectSecurityTestingScoreTestVectors.yml index de8e8da81..4cfdba1fa 100644 --- a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/ProjectSecurityTestingScoreTestVectors.yml +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/ProjectSecurityTestingScoreTestVectors.yml @@ -177,6 +177,24 @@ elements: confidence: 10.0 usedValues: [] explanation: [] + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] expectedScore: type: "DoubleInterval" from: 5.0 @@ -274,6 +292,24 @@ elements: confidence: 10.0 usedValues: [] explanation: [] + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 6.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 6.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] expectedScore: type: "DoubleInterval" from: 5.0 @@ -370,12 +406,30 @@ elements: confidence: 10.0 usedValues: [] explanation: [] + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] expectedScore: type: "DoubleInterval" - from: 5.3 + from: 5.1 openLeft: false negativeInfinity: false - to: 6.5 + to: 6.3 openRight: false positiveInfinity: false expectedLabel: null @@ -467,12 +521,32 @@ elements: usedValues: [] explanation: [] isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" - from: 5.3 + from: 5.1 openLeft: false negativeInfinity: false - to: 6.5 + to: 6.3 openRight: false positiveInfinity: false expectedLabel: null @@ -564,13 +638,267 @@ elements: usedValues: [] explanation: [] isNotApplicable: true + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + expectedScore: + type: "DoubleInterval" + from: 5.1 + openLeft: false + negativeInfinity: false + to: 6.3 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "gosec_not_applicable" + + # PylintScore is N/A + - type: "StandardTestVector" + values: + - type: "ScoreValue" + score: + type: "CodeqlScore" + name: "How a project uses CodeQL" + value: 7.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + - type: "ScoreValue" + score: + type: "LgtmScore" + name: "How a project addresses issues reported by LGTM" + value: 7.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "DependencyScanScore" + name: "How a project scans its dependencies for vulnerabilities" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "NoHttpToolScore" + name: "If a project uses nohttp tool" + value: 10.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "MemorySafetyTestingScore" + name: "How a project tests for memory-safety issues" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "FuzzingScore" + name: "How a project uses fuzzing" + value: 8.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "FindSecBugsScore" + name: "How a project uses FindSecBugs" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "BanditScore" + name: "How a project uses Bandit" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "GoSecScore" + name: "How a project uses GoSec" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + expectedScore: + type: "DoubleInterval" + from: 5.1 + openLeft: false + negativeInfinity: false + to: 6.3 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "pylint_not_applicable" + + # MyPyScore is N/A + - type: "StandardTestVector" + values: + - type: "ScoreValue" + score: + type: "CodeqlScore" + name: "How a project uses CodeQL" + value: 7.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + - type: "ScoreValue" + score: + type: "LgtmScore" + name: "How a project addresses issues reported by LGTM" + value: 7.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "DependencyScanScore" + name: "How a project scans its dependencies for vulnerabilities" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "NoHttpToolScore" + name: "If a project uses nohttp tool" + value: 10.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "MemorySafetyTestingScore" + name: "How a project tests for memory-safety issues" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "FuzzingScore" + name: "How a project uses fuzzing" + value: 8.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "FindSecBugsScore" + name: "How a project uses FindSecBugs" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + - type: "ScoreValue" + score: + type: "BanditScore" + name: "How a project uses Bandit" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "GoSecScore" + name: "How a project uses GoSec" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true expectedScore: type: "DoubleInterval" - from: 5.3 + from: 5.1 openLeft: false negativeInfinity: false - to: 6.5 + to: 6.3 openRight: false positiveInfinity: false expectedLabel: null - alias: "gosec_not_applicable" \ No newline at end of file + alias: "mypy_not_applicable" \ No newline at end of file diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTestVectors.yml new file mode 100644 index 000000000..84b95f833 --- /dev/null +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/PylintScoreTestVectors.yml @@ -0,0 +1,180 @@ +--- +defaults: + - type: "LanguagesValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + languages: + elements: + - "PYTHON" +elements: + - type: "StandardTestVector" + values: + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + - type: "UnknownValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedUnknownScore: true + alias: "all_unknown" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: false + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_1" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: false + expectedScore: + type: "DoubleInterval" + from: 6.0 + openLeft: false + negativeInfinity: false + to: 8.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_2" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: true + expectedScore: + type: "DoubleInterval" + from: 4.0 + openLeft: false + negativeInfinity: false + to: 6.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_3" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: true + expectedScore: + type: "DoubleInterval" + from: 9.0 + openLeft: false + negativeInfinity: false + to: 10.0 + openRight: false + positiveInfinity: false + expectedLabel: null + alias: "test_vector_4" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: false + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: false + - type: "LanguagesValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + languages: + elements: + - "OTHER" + expectedScore: + type: "DoubleInterval" + from: 9.0 + openLeft: false + negativeInfinity: false + to: 10.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: true + alias: "test_vector_5" + - type: "StandardTestVector" + values: + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + flag: true + - type: "BooleanValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + flag: true + - type: "UnknownValue" + feature: + type: "LanguagesFeature" + name: "A set of programming languages" + expectedScore: + type: "DoubleInterval" + from: 0.0 + openLeft: false + negativeInfinity: false + to: 1.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: true + alias: "test_vector_6" diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTestVectors.yml index dce3187fb..d602fd9d0 100644 --- a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTestVectors.yml +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/StaticAnalysisScoreTestVectors.yml @@ -8,6 +8,8 @@ elements: com.sap.oss.phosphor.fosstars.model.score.oss.FindSecBugsScore: 0.0 com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore: 0.0 com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore: 0.0 + com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore: 0.0 + com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore: 0.0 expectedScore: type: "DoubleInterval" from: 0.0 @@ -26,6 +28,8 @@ elements: com.sap.oss.phosphor.fosstars.model.score.oss.FindSecBugsScore: 10.0 com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore: 10.0 com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore: 10.0 + com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore: 10.0 + com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore: 10.0 expectedScore: type: "DoubleInterval" from: 10.0 @@ -44,6 +48,8 @@ elements: com.sap.oss.phosphor.fosstars.model.score.oss.FindSecBugsScore: 2.0 com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore: 2.0 com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore: 5.0 + com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore: 5.0 + com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore: 5.0 expectedScore: type: "DoubleInterval" from: 5.0 @@ -62,6 +68,8 @@ elements: com.sap.oss.phosphor.fosstars.model.score.oss.FindSecBugsScore: 3.0 com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore: 4.0 com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore: 4.0 + com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore: 4.0 + com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore: 4.0 expectedScore: type: "DoubleInterval" from: 1.0 @@ -125,6 +133,26 @@ elements: usedValues: [] explanation: [] isNotApplicable: true + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true expectedScore: type: "DoubleInterval" from: 0.0 @@ -143,6 +171,8 @@ elements: com.sap.oss.phosphor.fosstars.model.score.oss.FindSecBugsScore: 3.0 com.sap.oss.phosphor.fosstars.model.score.oss.BanditScore: 2.0 com.sap.oss.phosphor.fosstars.model.score.oss.GoSecScore: 2.0 + com.sap.oss.phosphor.fosstars.model.score.oss.MyPyScore: 2.0 + com.sap.oss.phosphor.fosstars.model.score.oss.PylintScore: 2.0 expectedScore: type: "DoubleInterval" from: 1.0 @@ -206,6 +236,26 @@ elements: usedValues: [] explanation: [] isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" from: 5.0 @@ -269,6 +319,26 @@ elements: usedValues: [] explanation: [] isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" from: 5.0 @@ -332,6 +402,26 @@ elements: usedValues: [ ] explanation: [ ] isNotApplicable: true + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 4.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 4.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" from: 3.0 @@ -395,6 +485,26 @@ elements: usedValues: [ ] explanation: [ ] isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" from: 3.0 @@ -458,6 +568,26 @@ elements: usedValues: [ ] explanation: [ ] isNotApplicable: true + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false expectedScore: type: "DoubleInterval" from: 3.0 @@ -469,6 +599,172 @@ elements: expectedLabel: null expectedNotApplicableScore: false alias: "gosec_not_applicable" + - type: "StandardTestVector" + values: + - type: "ScoreValue" + score: + type: "CodeqlScore" + name: "How a project uses CodeQL" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "LgtmScore" + name: "How a project addresses issues reported by LGTM" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "FindSecBugsScore" + name: "How a project uses FindSecBugs" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + - type: "ScoreValue" + score: + type: "BanditScore" + name: "How a project uses Bandit" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "GoSecScore" + name: "How a project uses GoSec" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + expectedScore: + type: "DoubleInterval" + from: 3.0 + openLeft: false + negativeInfinity: false + to: 3.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: false + alias: "pylint_not_applicable" + - type: "StandardTestVector" + values: + - type: "ScoreValue" + score: + type: "CodeqlScore" + name: "How a project uses CodeQL" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "LgtmScore" + name: "How a project addresses issues reported by LGTM" + value: 0.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "FindSecBugsScore" + name: "How a project uses FindSecBugs" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + - type: "ScoreValue" + score: + type: "BanditScore" + name: "How a project uses Bandit" + value: 5.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "GoSecScore" + name: "How a project uses GoSec" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [ ] + explanation: [ ] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "PylintScore" + name: "How a project uses Pylint" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: false + - type: "ScoreValue" + score: + type: "MyPyScore" + name: "How a project uses MyPy" + value: 3.0 + weight: 1.0 + confidence: 10.0 + usedValues: [] + explanation: [] + isNotApplicable: true + expectedScore: + type: "DoubleInterval" + from: 3.0 + openLeft: false + negativeInfinity: false + to: 3.0 + openRight: false + positiveInfinity: false + expectedLabel: null + expectedNotApplicableScore: false + alias: "mypy_not_applicable" - type: "StandardTestVector" values: - type: "UnknownValue" @@ -515,6 +811,22 @@ elements: feature: type: "BooleanFeature" name: "If a project runs GoSec scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" expectedScore: type: "DoubleInterval" from: 0.0 diff --git a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/VulnerabilityDiscoveryAndSecurityTestingScoreTestVectors.yml b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/VulnerabilityDiscoveryAndSecurityTestingScoreTestVectors.yml index 82011f035..119ae5398 100644 --- a/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/VulnerabilityDiscoveryAndSecurityTestingScoreTestVectors.yml +++ b/src/test/resources/com/sap/oss/phosphor/fosstars/model/score/oss/VulnerabilityDiscoveryAndSecurityTestingScoreTestVectors.yml @@ -96,6 +96,22 @@ elements: feature: type: "BooleanFeature" name: "If a project runs GoSec scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" expectedScore: type: "DoubleInterval" from: 0.0 @@ -218,6 +234,22 @@ elements: feature: type: "BooleanFeature" name: "If a project runs GoSec scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Pylint scan checks for commits" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scans" + - type: "UnknownValue" + feature: + type: "BooleanFeature" + name: "If a project runs Mypy scan checks for commits" expectedScore: type: "DoubleInterval" from: 0.0 diff --git a/src/test/shell/tool/github/lib.sh b/src/test/shell/tool/github/lib.sh index b72597e9a..9a84dcc83 100644 --- a/src/test/shell/tool/github/lib.sh +++ b/src/test/shell/tool/github/lib.sh @@ -29,6 +29,8 @@ declare -a project_security_default_expected_strings=( 'Figuring out if the project uses sanitizers' 'Figuring out if the project uses FindSecBugs' 'Figuring out how the project uses Bandit' + 'Figuring out how the project uses pylint' + 'Figuring out how the project uses mypy' 'Figuring out how the project uses GoSec' 'Figuring out if the project signs jar files' 'Looking for vulnerabilities in the project' @@ -74,8 +76,10 @@ declare -a project_security_default_expected_strings=( 'Sub-score:....Project activity' 'Sub-score:....Project popularity' 'Sub-score:....Security reviews' - 'Sub-score:....How a project uses Bandit' + 'Sub-score:....Bandit score' 'Sub-score:....GoSec score' + 'Sub-score:....How a project uses Pylint' + 'Sub-score:....How a project uses MyPy' ) declare -a artifact_security_default_expected_strings=( @@ -102,7 +106,10 @@ declare -a oss_rop_default_expected_strings=( 'Gathering info about project'"'"'s license' 'Figuring out how the project uses REUSE' 'Figuring out if the project has a security policy' - 'Figuring out if the project has executable binaries' + 'If a project runs Mypy scan checks for commits' + 'If a project runs Mypy scans' + 'If a project runs Pylint scan checks for commits' + 'If a project runs Pylint scans' 'Here is what we know about the project' 'Does the license have disallowed content?' 'Does it have LICENSES directory with licenses?' @@ -112,6 +119,10 @@ declare -a oss_rop_default_expected_strings=( 'Does it have a code of conduct guideline?' 'Does it have executable binaries?' 'Does it have a team with push privileges on GitHub?' + 'Does it run Pylint scans?' + 'Does it run Pylint scans on all commits?' + 'Does it run MyPy scans?' + 'Does it run MyPy scans on all commits?' 'Does it have an admin team on GitHub?' 'Does it have enough admins on GitHub?' 'Does teams have enough members on GitHub?' @@ -127,7 +138,6 @@ declare -a oss_rop_default_expected_strings=( 'Does the contributing guideline have required text?' 'Does the code of conduct guideline have required text?' 'Does it have a security policy?' - 'Does it have executable binaries?' 'Does README mention REUSE?' 'Are vulnerability alerts enabled?' 'Here is how the rating was calculated'