diff --git a/rule-types/github/permissive_license.yaml b/rule-types/github/permissive_license.yaml index e91ba57..190ccdc 100644 --- a/rule-types/github/permissive_license.yaml +++ b/rule-types/github/permissive_license.yaml @@ -19,11 +19,22 @@ def: in_entity: repository rule_schema: {} ingest: - type: git + type: rest + rest: + # This is the path to the data source. Given that this will evaluate + # for each repository in the organization, we use a template that + # will be evaluated for each repository. The structure to use is the + # protobuf structure for the entity that is being evaluated. + endpoint: '/repos/{{.Entity.Owner}}/{{.Entity.Name}}/license' + # This is the method to use to retrieve the data. It should already default to JSON + parse: json + fallback: + - http_code: 404 + body: | + {"http_status": 404, "message": "License details not found} eval: type: rego data_sources: - - name: ghapi - name: spdx rego: type: constraints @@ -34,11 +45,7 @@ def: import future.keywords.if violations[{"msg": msg}] { - owner := input.properties["github/repo_owner"] - repo := input.properties["github/repo_name"] - - resp := minder.datasource.ghapi.license({"owner": owner, "repo": repo}) - license := resp.body.license.spdx_id + license := input.ingested.license.spdx_id resp2 := minder.datasource.spdx.licenses({}) licenses := resp2.body.licenses @@ -49,5 +56,5 @@ def: count(approved_licenses) != 0 license != null not license in approved_licenses - msg := sprintf("License %s of repo %s/%s is not OSI/FSF approved", [license, owner, repo]) + msg := sprintf("License %s is not OSI/FSF approved", [license]) }