feat: add rubygems and Go support to osv worker [CM-1241]#4333
Conversation
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 4359559. Configure here.
There was a problem hiding this comment.
Pull request overview
Adds RubyGems version comparison and OSV synchronization support.
Changes:
- Implements and routes RubyGems version ordering.
- Allows RubyGems OSV ingestion.
- Adds comparator tests.
The comparator has blocking compatibility errors around prereleases, separators, and large numeric segments. Existing schedules also will not automatically ingest RubyGems.
Metadata: The title should end with (CM-1241), not [CM-1241].
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
osv/versionCompare.ts |
Adds RubyGems comparison logic. |
osv/schedule.ts |
Adds RubyGems to the ecosystem allowlist. |
osv/__tests__/versionCompare.test.ts |
Adds RubyGems comparison tests. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
mbani01
changed the title
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
PR SummaryMedium Risk Overview Version comparison: OSV sync config: Tests cover Go/RubyGems ordering, invalid input, and lowercase-only ecosystem keys. Reviewed by Cursor Bugbot for commit 709685a. Bugbot is set up for automated code reviews on this repo. Configure here. |
| // Mirrors Gem::Version#canonical_segments: drop trailing zero segments, then | ||
| // drop any zero segments that sit directly before the first letter segment. | ||
| function canonicalRubyGemsSegments(segments: (bigint | string)[]): (bigint | string)[] { | ||
| const trimmed = [...segments] | ||
| while (trimmed.length > 1 && trimmed[trimmed.length - 1] === BigInt(0)) trimmed.pop() | ||
|
|
||
| const firstLetterIndex = trimmed.findIndex((segment) => typeof segment === 'string') | ||
| if (firstLetterIndex === -1) return trimmed | ||
|
|
||
| let zeroRunStart = firstLetterIndex | ||
| while (zeroRunStart > 0 && trimmed[zeroRunStart - 1] === BigInt(0)) zeroRunStart-- | ||
| trimmed.splice(zeroRunStart, firstLetterIndex - zeroRunStart) | ||
|
|
||
| return trimmed | ||
| } |
This pull request adds support for version comparison in the
compareVersionutility for the Go and RubyGems ecosystems, ensuring consistent and accurate version ordering across more package types. It also expands test coverage and updates configuration to recognize these new ecosystems.Ecosystem support and logic changes:
go) and RubyGems (rubygems) ecosystems to thecompareVersionfunction, including a new RubyGems version comparison algorithm that mimicsGem::Versionbehavior.VALID_ECOSYSTEMSto includeGoandRubyGems, ensuring these are recognized during schedule validation.Testing improvements:
versionCompare.test.ts.Note
Medium Risk
Changes affect vulnerability range matching (
has_critical_vulnerability) for two new ecosystems; behavior is heavily tested but wrong ordering could mis-flag or miss critical CVEs.Overview
Extends the OSV packages worker so Go and RubyGems advisories can be synced and version ranges evaluated consistently with other ecosystems.
Version ordering:
gois routed through the existing loose semver path (including pseudo-versions).rubygemsgets a new Gem::Version-style comparator (hyphen → prerelease, canonical segments,bigintfor huge numeric segments) wired intocompareVersion. Tests cover CVE-style boundaries, invalid input, and lowercase-only ecosystem keys.OSV ingest: Local
OSV_ECOSYSTEMSandVALID_ECOSYSTEMSnow includeRubyGemsandGo(OSV bucket casing preserved). On worker startup, if the Temporalosv-advisories-syncschedule already exists, its workflow action is updated so a changedOSV_ECOSYSTEMSlist is picked up without manual schedule edits.Reviewed by Cursor Bugbot for commit dbed36f. Bugbot is set up for automated code reviews on this repo. Configure here.