Add license-is-osi-or-fsf-approved rule type.
#261
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
blkt
force-pushed
the
feat/add-license-is-osi-or-fsf-approved
branch
from
86cc91a to
c9cf8ec
Compare
This rule type checks that the license detected by GitHub is approved by either OSI or FSF. It uses two data sources, one to call GitHub API to get the SPDX identifier of the license, and another one to get the updated list of licenses approved by from SPDX repository. This rule can be used to implement `OSPS-LE-02`.
blkt
force-pushed
the
feat/add-license-is-osi-or-fsf-approved
branch
from
c9cf8ec to
5280188
Compare
JAORMX
reviewed
Jan 9, 2025
| in_entity: repository | ||
| rule_schema: {} | ||
| ingest: | ||
| type: git |
There was a problem hiding this comment.
Is this needed? Why not use the REST ingest directly?
There was a problem hiding this comment.
While addressing your comments I found out that mindev ruletype test does not execute ingest phase, which is a bit of a limitation that we should address somehow since it makes it harder to locally test rules.
JAORMX
reviewed
Jan 9, 2025
| eval: | ||
| type: rego | ||
| data_sources: | ||
| - name: ghapi |
There was a problem hiding this comment.
The usage of this data source seems unnecessary, you could simply use the REST ingest.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This rule type checks that the license detected by GitHub is approved by either OSI or FSF. It uses two data sources, one to call GitHub API to get the SPDX identifier of the license, and another one to get the updated list of licenses approved by from SPDX repository.
This rule can be used to implement
OSPS-LE-02.P.S.: the name is ugly, please advise. 😅