From 43759dd33c0119468ffdfeb1d2c7df5feed950fd Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:29:53 +1300 Subject: [PATCH 01/10] ci: run `osv-linter` --- .github/workflows/ci.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b7c64af9..661f3c22 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -36,6 +36,23 @@ jobs: persist-credentials: false - run: docker run -v $PWD:/src ghcr.io/google/osv-scanner:latest scan -r src + lint: + permissions: + contents: read # to fetch code (actions/checkout) + runs-on: ubuntu-latest + timeout-minutes: 15 + steps: + - name: Set up Go + uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 + with: + go-version: stable + check-latest: true + - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema + - run: go install ./cmd/osv + working-directory: /tmp/osv-schema/tools/osv-linter + + - run: osv-linter + ruff: permissions: contents: read # to fetch code (actions/checkout) From 09d9443a17f2c9b355523c1ce9f769df0ac2618c Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:43:22 +1300 Subject: [PATCH 02/10] ci: cache go dependencies --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 661f3c22..6657db4f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,12 +42,13 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: + - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: + cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema - run: go install ./cmd/osv working-directory: /tmp/osv-schema/tools/osv-linter From 7a878103a21b93ed6ca971963375678b5c7b59e6 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:45:04 +1300 Subject: [PATCH 03/10] ci: rework --- .github/workflows/ci.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6657db4f..e5284ce0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,10 +49,9 @@ jobs: cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - - run: go install ./cmd/osv + - run: go build -o osv-linter ./cmd/osv working-directory: /tmp/osv-schema/tools/osv-linter - - - run: osv-linter + - run: /tmp/osv-schema/tools/osv-linter/osv-linter ruff: permissions: From fc54f4b13ef6e050a9f2f050e795e317f2b8a31c Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:49:49 +1300 Subject: [PATCH 04/10] ci: be within workspace --- .github/workflows/ci.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e5284ce0..8517d1b0 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,16 +42,17 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: - - run: git clone https://github.com/ossf/osv-schema /tmp/osv-schema + - run: git clone https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: - cache-dependency-path: '/tmp/osv-schema/tools/osv-linter/go.sum' + cache-dependency-path: 'osv-schema/tools/osv-linter/go.sum' go-version: stable check-latest: true - run: go build -o osv-linter ./cmd/osv - working-directory: /tmp/osv-schema/tools/osv-linter - - run: /tmp/osv-schema/tools/osv-linter/osv-linter + working-directory: osv-schema/tools/osv-linter + + - run: osv-schema/tools/osv-linter/osv-linter ruff: permissions: From 91fe01eb1ae5526ac489b44885282bda1dd80dee Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:50:07 +1300 Subject: [PATCH 05/10] ci: clone the repository --- .github/workflows/ci.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8517d1b0..de359dec 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -54,6 +54,11 @@ jobs: - run: osv-schema/tools/osv-linter/osv-linter + - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 + with: + persist-credentials: false + - run: ls -aoh + ruff: permissions: contents: read # to fetch code (actions/checkout) From 23edbf66017f42c8ab9a76681a3492b9f571b1bd Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:55:46 +1300 Subject: [PATCH 06/10] ci: checkout repo within existing workspace --- .github/workflows/ci.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index de359dec..66d439ce 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -56,6 +56,7 @@ jobs: - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: + path: drupal-advisory-database persist-credentials: false - run: ls -aoh From 181fd164a60f2578c02a7c75c8635552943968dc Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 08:56:34 +1300 Subject: [PATCH 07/10] ci: run the linter --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 66d439ce..5dbef79f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -58,7 +58,9 @@ jobs: with: path: drupal-advisory-database persist-credentials: false - - run: ls -aoh + - run: | + osv-schema/tools/osv-linter/osv-linter record lint --parallel 2 \ + drupal-advisory-database/advisories/ ruff: permissions: From b1b4fd2d74631e0f746e489404e48c2103f84f94 Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 09:08:28 +1300 Subject: [PATCH 08/10] ci: add some comments --- .github/workflows/ci.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5dbef79f..38cf8249 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -42,6 +42,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 steps: + # build the osv-linter from source - run: git clone https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 @@ -54,6 +55,7 @@ jobs: - run: osv-schema/tools/osv-linter/osv-linter + # run the linter against our advisories - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0 with: path: drupal-advisory-database From 77af255a4c4ed9cbb481cd6486698528f3f6b16e Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 4 Dec 2025 10:12:25 +1300 Subject: [PATCH 09/10] ci: only clone the first commit --- .github/workflows/ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 38cf8249..799e4618 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -43,7 +43,7 @@ jobs: timeout-minutes: 15 steps: # build the osv-linter from source - - run: git clone https://github.com/ossf/osv-schema + - run: git clone --depth 1 https://github.com/ossf/osv-schema - name: Set up Go uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2 with: From d60b0ef482acb7f798b8a499e038c4bf63bcaeef Mon Sep 17 00:00:00 2001 From: Gareth Jones Date: Thu, 17 Sep 2026 09:20:30 +1200 Subject: [PATCH 10/10] docs: document how to run the linter --- CONTRIBUTING.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a75135f5..d4a11c03 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -32,6 +32,21 @@ poetry run ruff check poetry run ruff check --fix ``` +We also run the +[OSV Record Linter](https://github.com/ossf/osv-schema/tree/main/tools/osv-linter) +in CI to check advisories for common issues. + +This generally should not need to be something you run locally since advisories +are not manually authored, but can be done with: + +``` +go run github.com/ossf/osv-schema/tools/osv-linter/cmd/osv@latest record lint advisories +``` + +> [!NOTE] +> +> You need to have Go installed to run the linter locally + # Formatting We use `ruff` to format Python files, which can be run with: