alitheg commented on code in PR #1411:
URL:
https://github.com/apache/tooling-trusted-releases/pull/1411#discussion_r3588240411
##########
atr/tasks/__init__.py:
##########
@@ -714,45 +771,42 @@ async def _draft_file_checks(
if task:
task.revision_number = str(revision_number)
await _add_task(data, task)
- if util.archive_format_stem(path.as_path().name) is not None:
- archive_comparison_task = await queued(
- asf_uid,
- sql.TaskType.ARCHIVE_COMPARISON,
- release,
- revision_number,
- path_str,
- check_cache_key=await checks.resolve_cache_key(
- resolve(sql.TaskType.ARCHIVE_COMPARISON),
- parity.CHECK_VERSION,
- parity.INPUT_POLICY_KEYS,
- release,
- revision_number,
- await checks.resolve_extra_args(parity.INPUT_EXTRA_ARGS,
release, path_str),
- file=path_str,
- ),
- )
- if archive_comparison_task:
- await _add_task(data, archive_comparison_task)
- # TODO: Should we check .json files for their content?
- # Ideally we would not have to do that
- if analysis.is_cyclonedx_json(path.as_path().name):
- cdx_task = await queued(
- asf_uid,
- sql.TaskType.SBOM_TOOL_SCORE,
+ # Each path may qualify for a handful of standalone checks - archive
parity, an
+ # SBOM presence check, and CycloneDX scoring. The helpers guard their own
+ # applicability and hand back a task only when one is warranted.
+ for maybe_task in (
+ await _archive_comparison_task(asf_uid, release, revision_number,
path),
+ await _has_sbom_task(asf_uid, release, revision_number, path),
+ await _cyclonedx_score_task(
+ asf_uid, release, revision_number, path, project_key,
release_version, previous_version
+ ),
+ ):
+ if maybe_task:
+ await _add_task(data, maybe_task)
+
+
+async def _has_sbom_task(
+ asf_uid: str, release: sql.Release, revision_number: safe.RevisionNumber,
path: safe.RelPath
+) -> sql.Task | None:
+ if not analysis.is_artifact(path.as_path()):
+ return None
+ path_str = str(path)
+ return await queued(
+ asf_uid,
+ sql.TaskType.HAS_SBOM,
+ release,
+ revision_number,
+ path_str,
+ check_cache_key=await checks.resolve_cache_key(
Review Comment:
I've created a resolver for file+suffixes. So we can cache on existence of
any set of suffixes of any base file
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
