opendefensecloud / solution-arsenal / 32713150327
80%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 89
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 80.288% (-0.06%) from 80.347%
32713150327

push

github

web-flow 
perf(hooks): take vulnerability scanning out of the commit path (#770)

## What
Closes #669

Speed up the pre-commit hooks: warm commits drop from ~6.9s (code
change) and ~78.5s (dependency change) to ~6s.

## Why
Two independent causes, found by measuring each hook step:

- **osv-scanner (~71s).** The hook runs `make scan` on any
`go.mod`/`go.sum` change, which resolves all 1444 `go.sum` entries
against the osv.dev API. Measured 64.6s with default flags vs 0.10s with
`--offline-vulnerabilities`, so it is network latency, not local work.
`.github/workflows/osv-scanner.yml` already scans on push and on every
pull request, so this was duplicate coverage paid for by blocking
commits.
- **golangci-lint ran twice.** Once as `run --fix` from `make fmt`, then
again as `run -v` from `make lint`.

A popular theory was that `web/node_modules` (375M, 26203 files) was
slowing the scans. It is not: osv-scanner honors `.gitignore` and scans
that tree in 0.09s, and `make fmt`/`make lint` operate on `git
ls-files`, so nothing in the hook chain walks the untracked tree.

## Testing
- Verified an unfixable violation still blocks the commit: staging a
`forbidigo` + `unused` violation fails the `lint` hook at `Makefile:
lint-fix`, exit 1.
- Verified autofix survives the split: `importas` rewrote `meta` to
`metav1` (declaration and usage) and `misspell` fixed `recieve`; the
first attempt aborts with "files were modified by this hook" and the
second passes after `git add`.
- Verified coverage parity with CI: every check in `make lint` still
runs in the commit path, 19 of the 56 enabled linters can autofix and
still do.
- `make fmt`, `make lint-fix`, `make lint`, `make shellcheck` and
`pre-commit run --all-files` all exit 0. `make codegen` produces no
diff.

## Notes for reviewers
No API, CRD, or RBAC changes. Three behavioral changes worth a look:

- **Local vulnerability scanning is gone.** Contributors now find CVE
issues at CI rather than before push. This matches the t... (continued)

5511 of 6864 relevant lines covered (80.29%)

30.92 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
73.13
 -2.99% pkg/controller/registrybinding_controller.go
2
78.44
 -0.18% pkg/controller/target_controller.go
Jobs
ID Job ID Ran Files Coverage
1 32713150327.1 89
80.29
 GitHub Action Run
Source Files on build 32713150327