Merge pull request #3 from spiegel-im-spiegel/add-actions-and-testing

Add actions and testing

.gitattributes

@@ -0,0 +1 @@
+*.go text eol=lf

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,71 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
+name: "CodeQL"
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [master]
+  schedule:
+    - cron: '0 20 * * 0'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        # Override automatic language detection by changing the below list
+        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
+        language: ['go']
+        # Learn more...
+        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v2
+      with:
+        # We must fetch at least the immediate parents so that if this is
+        # a pull request then we can checkout the head.
+        fetch-depth: 2
+
+    # If this run was triggered by a pull request event, then checkout
+    # the head of the pull request instead of the merge commit.
+    - run: git checkout HEAD^2
+      if: ${{ github.event_name == 'pull_request' }}
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v1
+      with:
+        languages: ${{ matrix.language }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file. 
+        # Prefix the list here with "+" to use these queries and those in the config file.
+        # queries: ./path/to/local/query, your-org/your-repo/queries@main
+
+    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+    # If this step fails, then you should remove it and run the build manually (see below)
+    - name: Autobuild
+      uses: github/codeql-action/autobuild@v1
+
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 https://git.io/JvXDl
+
+    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
+    #    and modify them (or add more) to build your code if your project
+    #    uses a compiled language
+
+    #- run: |
+    #   make bootstrap
+    #   make release
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v1

.github/workflows/lint.yml

@@ -0,0 +1,25 @@
+name: lint
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+  pull_request:
+jobs:
+  golangci:
+    strategy:
+      matrix:
+        go-version: [1.15.x]
+        os: [ubuntu-latest]
+    name: lint
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v2
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v2
+        with:
+          # Required: the version of golangci-lint is required and must be specified without patch version: we always use the latest patch version.
+          version: latest
+      - name: testing
+        run: go test ./...

.github/workflows/vulns.yml

@@ -0,0 +1,21 @@
+name: vulns
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - master
+  pull_request:
+jobs:
+  vulns:
+    name: Vulnerability scanner
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ^1.13
+      - name: WriteGoList
+        run: go list -json -m all > go.list
+      - name: Nancy
+        uses: sonatype-nexus-community/nancy-github-action@main

README.md

@@ -1,6 +1,7 @@
 # [go-cvss] - Common Vulnerability Scoring System (CVSS) Version 3
 
-[![Build Status](https://travis-ci.org/spiegel-im-spiegel/go-cvss.svg?branch=master)](https://travis-ci.org/spiegel-im-spiegel/go-cvss)
+[![check vulns](https://github.com/spiegel-im-spiegel/go-cvss/workflows/vulns/badge.svg)](https://github.com/spiegel-im-spiegel/go-cvss/actions)
+[![lint status](https://github.com/spiegel-im-spiegel/go-cvss/workflows/lint/badge.svg)](https://github.com/spiegel-im-spiegel/go-cvss/actions)
 [![GitHub license](https://img.shields.io/badge/license-Apache%202-blue.svg)](https://raw.githubusercontent.com/spiegel-im-spiegel/go-cvss/master/LICENSE)
 [![GitHub release](https://img.shields.io/github/release/spiegel-im-spiegel/go-cvss.svg)](https://github.com/spiegel-im-spiegel/go-cvss/releases/latest)
 

clean-all.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+rm ./go.sum
+go clean -cache
+go clean -modcache

go.mod

@@ -1,8 +1,8 @@
 module github.com/spiegel-im-spiegel/go-cvss
 
-go 1.13
+go 1.15
 
 require (
-	github.com/spiegel-im-spiegel/errs v0.3.4
-	golang.org/x/text v0.3.2
+	github.com/spiegel-im-spiegel/errs v1.0.2
+	golang.org/x/text v0.3.3
 )

go.sum

@@ -1,5 +1,5 @@
-github.com/spiegel-im-spiegel/errs v0.3.4 h1:lqiLtlT2ex7zpYS+WNWFuFX2x/o8RnG/UeaA8CFRYeE=
-github.com/spiegel-im-spiegel/errs v0.3.4/go.mod h1:NwHSe6m3oAhRj2bAkkbzz9xAffIDNcP9uTdyJd9fJNs=
-golang.org/x/text v0.3.2 h1:tW2bmiBqwgJj/UpqtC8EpXEZVYOwU0yG4iWbprSVAcs=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+github.com/spiegel-im-spiegel/errs v1.0.2 h1:v4amEwRDqRWjKHOILQnJSovYhZ4ZttEnBBXNXEzS6Sc=
+github.com/spiegel-im-spiegel/errs v1.0.2/go.mod h1:UoasJYYujMcdkbT9USv8dfZWoMyaY3btqQxoLJImw0A=
+golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

test-all.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+go mod verify || exit 1
+go mod tidy -v || exit 1
+go list -json -m all | nancy sleuth -n || exit 1
+golangci-lint run ./... || exit 1
+go test ./...

v3/base/base.go

@@ -48,23 +48,23 @@ func NewMetrics() *Metrics {
 func Decode(vector string) (*Metrics, error) {
 	values := strings.Split(vector, "/")
 	if len(values) < 9 {
-		return nil, errs.Wrap(cvsserr.ErrInvalidVector, "", errs.WithContext("vector", vector))
+		return nil, errs.Wrap(cvsserr.ErrInvalidVector, errs.WithContext("vector", vector))
 	}
 	//CVSS version
 	num, err := checkVersion(values[0])
 	if err != nil {
-		return nil, errs.Wrap(err, "", errs.WithContext("vector", vector))
+		return nil, errs.Wrap(err, errs.WithContext("vector", vector))
 	}
 	if num == version.Unknown {
-		return nil, errs.Wrap(cvsserr.ErrNotSupportVer, "", errs.WithContext("vector", vector))
+		return nil, errs.Wrap(cvsserr.ErrNotSupportVer, errs.WithContext("vector", vector))
 	}
 	//metrics
 	metrics := NewMetrics()
 	metrics.Ver = num
 	for _, value := range values[1:] {
 		metric := strings.Split(value, ":")
 		if len(metric) != 2 {
-			return nil, errs.Wrap(cvsserr.ErrInvalidVector, "", errs.WithContext("vector", vector))
+			return nil, errs.Wrap(cvsserr.ErrInvalidVector, errs.WithContext("vector", vector))
 		}
 		switch strings.ToUpper(metric[0]) {
 		case "AV": //Attack Vector
@@ -90,18 +90,18 @@ func Decode(vector string) (*Metrics, error) {
 		case "RC": //RemediationLevel
 			metrics.RC = GetReportConfidence(metric[1])
 		default:
-			return nil, errs.Wrap(cvsserr.ErrInvalidVector, "", errs.WithContext("vector", value))
+			return nil, errs.Wrap(cvsserr.ErrInvalidVector, errs.WithContext("vector", value))
 		}
 	}
 	return metrics, metrics.GetError()
 }
 func checkVersion(ver string) (version.Num, error) {
 	v := strings.Split(ver, ":")
 	if len(v) != 2 {
-		return version.Unknown, errs.Wrap(cvsserr.ErrInvalidVector, "", errs.WithContext("vector", ver))
+		return version.Unknown, errs.Wrap(cvsserr.ErrInvalidVector, errs.WithContext("vector", ver))
 	}
 	if strings.ToUpper(v[0]) != "CVSS" {
-		return version.Unknown, errs.Wrap(cvsserr.ErrInvalidVector, "", errs.WithContext("vector", ver))
+		return version.Unknown, errs.Wrap(cvsserr.ErrInvalidVector, errs.WithContext("vector", ver))
 	}
 	return version.Get(v[1]), nil
 }
@@ -140,11 +140,11 @@ func (m *Metrics) Encode() (string, error) {
 //GetError returns error instance if undefined metric
 func (m *Metrics) GetError() error {
 	if m == nil {
-		return errs.Wrap(cvsserr.ErrUndefinedMetric, "")
+		return errs.Wrap(cvsserr.ErrUndefinedMetric)
 	}
 	switch true {
 	case !m.AV.IsDefined(), !m.AC.IsDefined(), !m.PR.IsDefined(), !m.UI.IsDefined(), !m.S.IsDefined(), !m.C.IsDefined(), !m.I.IsDefined(), !m.A.IsDefined():
-		return errs.Wrap(cvsserr.ErrUndefinedMetric, "")
+		return errs.Wrap(cvsserr.ErrUndefinedMetric)
 	default:
 		return nil
 	}

v3/version/version.go

@@ -1,7 +1,5 @@
 package version
 
-import "fmt"
-
 //Num is error number for CVSS
 type Num int
 
@@ -21,7 +19,7 @@ func (n Num) String() string {
 	if s, ok := verStrings[n]; ok {
 		return s
 	}
-	return fmt.Sprintf("unknown")
+	return "unknown"
 }
 
 //Get returns Version number from string