Merge branch 'main' into dependabot/npm_and_yarn/internal/staticanaly…

…sis/parsing/parsing-minor-updates-6e50c97aa9
ossf · Dec 14, 2023 · 35849b7 · 35849b7
2 parents cdeaf03 + 6979ff6
commit 35849b7
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 3 deletions.
diff --git a/.github/workflows/depsreview.yml b/.github/workflows/depsreview.yml
@@ -15,4 +15,4 @@ jobs:
       - name: 'Checkout Repository'
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@7bbfa034e752445ea40215fff1c3bf9597993d3f # v3.1.3
+        uses: actions/dependency-review-action@01bc87099ba56df1e897b6874784491ea6309bc4 # v3.1.4
diff --git a/internal/staticanalysis/result.go b/internal/staticanalysis/result.go
@@ -13,7 +13,8 @@ import (
 // Result (staticanalysis.Result) is the top-level internal data structure
 // that stores all data produced by static analysis performed on a package artifact.
 type Result struct {
-	Files []SingleResult
+	ArchiveSHA256 string
+	Files         []SingleResult
 }
 
 /*

diff --git a/sandboxes/staticanalysis/staticanalyze.go b/sandboxes/staticanalysis/staticanalyze.go
@@ -180,6 +180,14 @@ func run() (err error) {
 		return fmt.Errorf("static analysis error: %w", err)
 	}
 
+	startHashTime := time.Now()
+	archiveHash, err := utils.SHA256Hash(archivePath)
+	if err != nil {
+		slog.WarnContext(ctx, "failed to calculate archive checksum", "error", err)
+	}
+	results.ArchiveSHA256 = archiveHash
+	hashTime := time.Since(startHashTime)
+
 	startWritingResultsTime := time.Now()
 
 	jsonResult, err := json.Marshal(results)
@@ -209,11 +217,12 @@ func run() (err error) {
 	writingResultsTime := time.Since(startWritingResultsTime)
 
 	totalTime := time.Since(startTime)
-	otherTime := totalTime - writingResultsTime - analysisTime - extractionTime
+	otherTime := totalTime - writingResultsTime - analysisTime - extractionTime - hashTime
 
 	slog.InfoContext(ctx, "Execution times",
 		"download and extraction", extractionTime,
 		"analysis", analysisTime,
+		"sha256Hash calculation", hashTime,
 		"writing results", writingResultsTime,
 		"other", otherTime,
 		"total", totalTime)