Multiple Feature Release (#10)

* Refactor workq to support callbacks

* Use workq callbacks in scan

* Add callbacks in scan for progress reporting

* Add a progress tracker based UI

* Add minimal markdown report

* Add container image releaser action

Fix typo in dockerfile

* Release container on tags

Author: abhisek

.github/workflows/container.yml

@@ -0,0 +1,46 @@
+name: Container Image Releaser
+
+on:
+  push:
+    tags:
+      - "*"
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build:
+    if: "!contains(github.event.commits[0].message, '[noci]')"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        submodules: true
+        fetch-depth: 0
+
+    - name: Registry Login
+      uses: docker/login-action@v1
+      with:
+        registry: ${{ env.REGISTRY }}
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Setup QEMU
+      uses: docker/setup-qemu-action@v2
+
+    - name: Setup Docker Buildx
+      uses: docker/setup-buildx-action@v2
+
+    - name: Build and Push Container Image
+      run: |
+        docker buildx build --push --platform linux/amd64 \
+        -t $REGISTRY/$IMAGE_NAME:latest \
+        .
+
+

Dockerfile

@@ -0,0 +1,27 @@
+FROM --platform=$BUILDPLATFORM golang:1.19-buster AS build
+
+WORKDIR /build
+
+COPY go.mod go.sum ./
+
+RUN go mod download
+
+COPY . .
+
+ENV CGO_ENABLED=0
+
+RUN go build -o vet
+
+FROM gcr.io/distroless/base-debian11
+
+ARG TARGETPLATFORM
+
+LABEL org.opencontainers.image.source=https://github.com/safedep/vet
+LABEL org.opencontainers.image.description="Open source software supply chain security tool"
+LABEL org.opencontainers.image.licenses=Apache-2.0
+
+COPY --from=build /build/vet /usr/local/bin/vet
+
+USER nonroot:nonroot
+
+ENTRYPOINT ["vet"]

README.md

@@ -100,6 +100,22 @@ Look at `api/insights-v1.yml`. It contains the contract expected for Insights
 API. You can perhaps consider rolling out your own to avoid dependency with our
 backend.
 
+### Something is wrong! How do I debug this thing?
+
+Run without the eye candy UI and enable log to file or to `stdout`.
+
+Log to `stdout`:
+
+```bash
+vet scan -D /path/to/repo -s -l- -v
+```
+
+Log to file:
+
+```bash
+vet scan -D /path/to/repo -l /tmp/vet.log -v
+```
+
 ## References
 
 * https://github.com/google/osv-scanner

internal/ui/ui.go

@@ -0,0 +1,97 @@
+package ui
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/jedib0t/go-pretty/v6/progress"
+)
+
+var progressWriter progress.Writer
+var spinnerChan chan bool
+
+func StartSpinner(msg string) {
+	style := `⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏`
+	frames := []rune(style)
+	length := len(frames)
+
+	spinnerChan = make(chan bool)
+
+	ticker := time.NewTicker(100 * time.Millisecond)
+	go func() {
+		pos := 0
+
+		for {
+			select {
+			case <-spinnerChan:
+				ticker.Stop()
+				return
+			case <-ticker.C:
+				fmt.Printf("\r%s ... %s", msg, string(frames[pos%length]))
+				pos += 1
+			}
+		}
+	}()
+}
+
+func StopSpinner() {
+	spinnerChan <- true
+
+	fmt.Printf("\r")
+	fmt.Println()
+}
+
+func StartProgressWriter() {
+	pw := progress.NewWriter()
+
+	pw.SetTrackerLength(25)
+	pw.SetMessageWidth(20)
+	pw.SetSortBy(progress.SortByPercentDsc)
+	pw.SetStyle(progress.StyleDefault)
+	pw.SetTrackerPosition(progress.PositionRight)
+	pw.SetUpdateFrequency(time.Millisecond * 100)
+	pw.Style().Colors = progress.StyleColorsExample
+	pw.Style().Options.PercentFormat = "%4.1f%%"
+	pw.Style().Visibility.Pinned = true
+	pw.Style().Visibility.ETA = true
+	pw.Style().Visibility.Value = true
+
+	progressWriter = pw
+	go progressWriter.Render()
+}
+
+func StopProgressWriter() {
+	if progressWriter != nil {
+		progressWriter.Stop()
+		time.Sleep(1 * time.Second)
+	}
+}
+
+func TrackProgress(message string, total int) any {
+	tracker := progress.Tracker{Message: message, Total: int64(total),
+		Units: progress.UnitsDefault}
+
+	if progressWriter != nil {
+		progressWriter.AppendTracker(&tracker)
+	}
+
+	return &tracker
+}
+
+func MarkTrackerAsDone(i any) {
+	if tracker, ok := i.(*progress.Tracker); ok {
+		tracker.MarkAsDone()
+	}
+}
+
+func IncrementTrackerTotal(i any, count int) {
+	if tracker, ok := i.(*progress.Tracker); ok {
+		tracker.UpdateTotal(tracker.Total + int64(count))
+	}
+}
+
+func IncrementProgress(i any, count int) {
+	if tracker, ok := i.(*progress.Tracker); ok {
+		tracker.Increment(int64(count))
+	}
+}

pkg/common/utils/workq.go

@@ -12,6 +12,13 @@ type WorkQueueItem interface {
 
 type WorkQueueFn[T WorkQueueItem] func(q *WorkQueue[T], item T) error
 
+type WorkQueueCallbackOnItemFn[T WorkQueueItem] func(q *WorkQueue[T], item T)
+
+type WorkQueueCallbacks[T WorkQueueItem] struct {
+	OnAdd  WorkQueueCallbackOnItemFn[T]
+	OnDone WorkQueueCallbackOnItemFn[T]
+}
+
 type WorkQueue[T WorkQueueItem] struct {
 	done        chan bool
 	m           sync.Mutex
@@ -20,6 +27,7 @@ type WorkQueue[T WorkQueueItem] struct {
 	handler     WorkQueueFn[T]
 	status      sync.Map
 	items       chan T
+	callbacks   WorkQueueCallbacks[T]
 }
 
 func NewWorkQueue[T WorkQueueItem](bufferSize int, concurrency int,
@@ -32,6 +40,10 @@ func NewWorkQueue[T WorkQueueItem](bufferSize int, concurrency int,
 	}
 }
 
+func (q *WorkQueue[T]) WithCallbacks(callbacks WorkQueueCallbacks[T]) {
+	q.callbacks = callbacks
+}
+
 func (q *WorkQueue[T]) Start() {
 	for i := 0; i < q.concurrency; i++ {
 		go func() {
@@ -46,6 +58,7 @@ func (q *WorkQueue[T]) Start() {
 					}
 
 					q.wg.Done()
+					q.dispatchOnDone(item)
 				}
 			}
 		}()
@@ -69,5 +82,19 @@ func (q *WorkQueue[T]) Add(item T) bool {
 	q.wg.Add(1)
 
 	q.items <- item
+	q.dispatchOnAdd(item)
+
 	return true
 }
+
+func (q *WorkQueue[T]) dispatchOnAdd(item T) {
+	if q.callbacks.OnAdd != nil {
+		q.callbacks.OnAdd(q, item)
+	}
+}
+
+func (q *WorkQueue[T]) dispatchOnDone(item T) {
+	if q.callbacks.OnDone != nil {
+		q.callbacks.OnDone(q, item)
+	}
+}

pkg/reporter/markdown.go

@@ -1,6 +1,7 @@
 package reporter
 
 import (
+	"fmt"
 	"os"
 	"sync"
 	"text/template"
@@ -20,26 +21,32 @@ type MarkdownReportingConfig struct {
 	Path string
 }
 
+type markdownTemplateInputRemediation struct {
+	Pkg                *models.Package
+	PkgRemediationName string
+	Score              int
+}
+
 type markdownTemplateInput struct {
-	Manifests      []*models.PackageManifest
-	AnalyzerEvents []*analyzer.AnalyzerEvent
-	PolicyEvents   []*policy.PolicyEvent
+	Remediations   []markdownTemplateInputRemediation
+	ManifestsCount int
+	PackagesCount  int
 }
 
+// Markdown reporter is built on top of summary reporter to
+// provide extended visibility
 type markdownReportGenerator struct {
-	m             sync.Mutex
-	config        MarkdownReportingConfig
-	templateInput markdownTemplateInput
+	m               sync.Mutex
+	config          MarkdownReportingConfig
+	summaryReporter Reporter
+	templateInput   markdownTemplateInput
 }
 
 func NewMarkdownReportGenerator(config MarkdownReportingConfig) (Reporter, error) {
+	summaryReporter, _ := NewSummaryReporter()
 	return &markdownReportGenerator{
-		config: config,
-		templateInput: markdownTemplateInput{
-			Manifests:      make([]*models.PackageManifest, 0),
-			AnalyzerEvents: make([]*analyzer.AnalyzerEvent, 0),
-			PolicyEvents:   make([]*policy.PolicyEvent, 0),
-		},
+		config:          config,
+		summaryReporter: summaryReporter,
 	}, nil
 }
 
@@ -48,26 +55,34 @@ func (r *markdownReportGenerator) Name() string {
 }
 
 func (r *markdownReportGenerator) AddManifest(manifest *models.PackageManifest) {
-	r.m.Lock()
-	defer r.m.Unlock()
-	r.templateInput.Manifests = append(r.templateInput.Manifests, manifest)
+	r.summaryReporter.AddManifest(manifest)
 }
 
-func (r *markdownReportGenerator) AddAnalyzerEvent(event *analyzer.AnalyzerEvent) {
-	r.m.Lock()
-	defer r.m.Unlock()
-	r.templateInput.AnalyzerEvents = append(r.templateInput.AnalyzerEvents, event)
-}
+func (r *markdownReportGenerator) AddAnalyzerEvent(event *analyzer.AnalyzerEvent) {}
 
-func (r *markdownReportGenerator) AddPolicyEvent(event *policy.PolicyEvent) {
-	r.m.Lock()
-	defer r.m.Unlock()
-	r.templateInput.PolicyEvents = append(r.templateInput.PolicyEvents, event)
-}
+func (r *markdownReportGenerator) AddPolicyEvent(event *policy.PolicyEvent) {}
 
 func (r *markdownReportGenerator) Finish() error {
 	logger.Infof("Generating consolidated markdown report: %s", r.config.Path)
 
+	var sr *summaryReporter
+	var ok bool
+
+	if sr, ok = r.summaryReporter.(*summaryReporter); !ok {
+		return fmt.Errorf("failed to duck type Reporter to summaryReporter")
+	}
+
+	sortedList := sr.sortedRemediations()
+	remediations := []markdownTemplateInputRemediation{}
+
+	for _, s := range sortedList {
+		remediations = append(remediations, markdownTemplateInputRemediation{
+			Pkg:                s.pkg,
+			PkgRemediationName: sr.packageNameForRemediationAdvice(s.pkg),
+			Score:              s.score,
+		})
+	}
+
 	tmpl, err := template.New("markdown").Parse(markdownTemplate)
 	if err != nil {
 		return err
@@ -79,5 +94,9 @@ func (r *markdownReportGenerator) Finish() error {
 	}
 
 	defer file.Close()
-	return tmpl.Execute(file, r.templateInput)
+	return tmpl.Execute(file, markdownTemplateInput{
+		Remediations:   remediations,
+		ManifestsCount: sr.summary.manifests,
+		PackagesCount:  sr.summary.packages,
+	})
 }