✨ GitLab: Security Policy check

[raghavkaul]

What kind of change does this PR introduce?

Adds GitLab support for the Security-Policy check. Also changes Repo.Org() to align better with its named meaning.

What is the new behavior (if this is a feature change)?**

Checks for Security policy file in the repo. Doesn't attempt to check for Org-level security policy (no equivalent to .github folder in GitLab). GetOrganizationSecurityPolicy is exposed as a method of RepoClient.

• Tests for the changes have been added (for bug fixes/features)

Does this PR introduce a user-facing change?

GitLab support for Security-Policy check

[codecov]

Codecov Report

Merging #2754 (7a60cf7) into main (8966abd) will decrease coverage by 0.30%.
The diff coverage is 25.37%.

❗ Current head 7a60cf7 differs from pull request most recent head 227bb4a. Consider uploading reports for the commit 227bb4a to get more accurate results

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2754      +/-   ##
==========================================
- Coverage   49.51%   49.21%   -0.30%     
==========================================
  Files         157      158       +1     
  Lines       11795    11962     +167     
==========================================
+ Hits         5840     5887      +47     
- Misses       5601     5706     +105     
- Partials      354      369      +15     

[azeemshaikh38]

Nice PR, thanks. LGTM with comments.

[spencerschrock]

I'd argue changing an interface is a breaking change.

[azeemshaikh38]

I'd argue changing an interface is a breaking change.

That's fair. Maybe remove all occurences of Org() in checks package, mark the API as deprecated in RepoClient and we can remove the APi before v5 release. Would that work?

[spencerschrock]

I'd argue changing an interface is a breaking change.

That's fair. Maybe remove all occurences of Org() in checks package, mark the API as deprecated in RepoClient and we can remove the APi before v5 release. Would that work?

that works for Org in the Repo interface. But RepoClient had a method added which is also a breaking change.

[spencerschrock]

in terms of breaking changes, if the only breakage is Allstar (who has a mock client that would need to stub the new method), it's probably safe to do if we give Allstar a heads up. And it's a small enough that we could send the update PR

[azeemshaikh38]

in terms of breaking changes, if the only breakage is Allstar (who has a mock client that would need to stub the new method), it's probably safe to do if we give Allstar a heads up. And it's a small enough that we could send the update PR

Can Allstar use Scorecard's mock client - https://github.com/ossf/scorecard/blob/main/clients/mockclients/repo_client.go ?

[raghavkaul]

Thanks Spencer for pointing that out, I wasn't previously aware that people relied on Scorecard's interfaces. I gave a heads up to the Allstar maintainer and they said that they are aware of breakages and will upgrade manually.