feat(source/gitlab): support glob patterns in repositories field #4581
Conversation
| // resolveRepositories determines which repositories to scan based on s.repos configuration. | ||
| // It handles three cases: | ||
| // 1. Glob patterns (e.g., "org/*"): enumerates all projects and filters using patterns | ||
| // 2. Explicit URLs: normalizes and reports directly without enumeration | ||
| // 3. Empty: enumerates all projects using includeRepos/ignoreRepos filters | ||
| // | ||
| // All discovered repositories are reported via reporter.UnitOk(). | ||
| func (s *Source) resolveRepositories( |
There was a problem hiding this comment.
Looking at the implementation for includeRepos, it looks pretty straightforward where we directly pass in the s.includeRepos slice to buildIgnorer. Why can't we do the same with repos? Why do we need to handle all these cases separately? Is there any context I'm missing here?
There was a problem hiding this comment.
Good question! Here's what I've understood since working on this:
includeRepos:
- Always a filter on enumerated projects
- Assumes you're scanning "everything with filters"
- Always calls listProjects() then filters results
repos:
- Can be explicit URLs OR glob patterns
- Supports 3 distinct modes:
a. Explicit URLs only - Use directly, no enumeration needed
b. Glob patterns - Enumerate projects and filter
c. Mixed - Enumerate for globs, use explicit URLs directly
kashifkhan0771
left a comment
kashifkhan0771
left a comment
There was a problem hiding this comment.
One recommendation is to keep the GitLab source behavior consistent with GitHub. Users should not be allowed to use --repo together with --org. The --include-repo flag should only be valid when used with --org or --group-id (GitLab only), as its description states: "Repositories to include in an org scan."
Ideally, this is the best approach because glob patterns should only apply to repositories within an organization or group. The user specifies an org or group and then defines which repositories matching the glob pattern should be scanned. This keeps GitLab consistent with the GitHub source and simplifies the implementation.
After this the flow will be like:
|
Description:
Add support for glob patterns in the repositories field, allowing flexible repository matching alongside explicit URLs. Refactors repository resolution logic into resolveRepositories() to eliminate duplication between Chunks() and Enumerate(), improving maintainability and consistency.
Checklist:
make test-community)?make lintthis requires golangci-lint)?