refactor(rust-crates-advisory): redo tree-lock-file-report in bash
I think migrating the execline scripts over to bash makes sense: 1. Ever since nixpkgs-fmt, execline scripts in depot have become a huge pain to write and edit and I can't think of a satisfying solution to this problem. 2. The scripts here require remembering things across loop cycles (i. e. the status variable) which is not possible in pure execline. As a a workaround we used to read the entire report into memory first and check if it was empty (tying us to the argv limit for the report length). Change-Id: I954b08b982ef947f9014a685676d2b83a2aec4d2 Reviewed-on: https://cl.tvl.fyi/c/depot/+/5259 Reviewed-by: tazjin <tazjin@tvl.su> Tested-by: BuildkiteCI
This commit is contained in:
parent
8ffcf8d7ce
commit
ffec3c70f4
1 changed files with 14 additions and 36 deletions
|
@ -4,7 +4,6 @@ let
|
|||
|
||||
bins =
|
||||
depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
|
||||
// depot.nix.getBins pkgs.coreutils [ "printf" ]
|
||||
// depot.nix.getBins pkgs.lr [ "lr" ]
|
||||
// depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
|
||||
// depot.nix.getBins pkgs.jq [ "jq" ]
|
||||
|
@ -106,41 +105,20 @@ let
|
|||
exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
|
||||
'';
|
||||
|
||||
tree-lock-file-report = depot.nix.writeExecline "tree-lock-file-report"
|
||||
{
|
||||
readNArgs = 1;
|
||||
} [
|
||||
"backtick"
|
||||
"-E"
|
||||
"report"
|
||||
[
|
||||
"pipeline"
|
||||
[ bins.find "$1" "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
|
||||
"forstdin"
|
||||
"-E"
|
||||
"-0"
|
||||
"lockFile"
|
||||
"backtick"
|
||||
"-E"
|
||||
"depotPath"
|
||||
[
|
||||
"pipeline"
|
||||
[ bins.s6-dirname "$lockFile" ]
|
||||
bins.sed
|
||||
"s|^\\.|/|"
|
||||
]
|
||||
lock-file-report
|
||||
"$depotPath"
|
||||
"$lockFile"
|
||||
"false"
|
||||
]
|
||||
"if"
|
||||
[ bins.printf "%s\n" "$report" ]
|
||||
# empty report implies success (no advisories)
|
||||
bins.s6-test
|
||||
"-z"
|
||||
"$report"
|
||||
];
|
||||
tree-lock-file-report = pkgs.writers.writeBash "tree-lock-file-report" ''
|
||||
set -euo pipefail
|
||||
status=0
|
||||
|
||||
root="''${1:-.}"
|
||||
|
||||
# Find prints the found lockfiles as <DEPOT ROOT>\t<LOCKFILE DIR>\t<LOCKFILE PATH>\0
|
||||
while IFS=$'\t' read -r -d $'\0' entryPoint dir lockFile; do
|
||||
label="$(printf '%s' "$dir" | "${bins.sed}" "s|^$entryPoint|/|")"
|
||||
"${lock-file-report}" "$label" "$lockFile" || status=1
|
||||
done < <("${bins.find}" "$root" -type f -name Cargo.lock -printf '%H\t%h\t%p\0' )
|
||||
|
||||
exit $status
|
||||
'';
|
||||
|
||||
check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
|
||||
"backtick"
|
||||
|
|
Loading…
Reference in a new issue