Repository: google/osv-scanner
Pull request #613 (2023-10-26 03:36:00)

Some minor post release fixes
- Fix github action documentation to have correct examples
- Update jekyll feed dependency, which renovate bot fails to do for some reason
- Set the upload-tag-name to actually upload the verification along with the release using the new pipeline. (This is because the new pipeline no longer runs "on" a commit, so cannot automatically pick up the tag. This actually causes bigger problems in that we can't verify the tag (see https://github.com/slsa-framework/slsa-github-generator/issues/1947))


Patch:
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index d7d567f..78a2a82 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -140,3 +140,4 @@ jobs:
       base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
       upload-assets: true # upload to a new release
       draft-release: true # upload to a new draft release
+      upload-tag-name: "${{ inputs.version }}"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 90a9c25..1ea9e12 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -70,6 +70,9 @@ To run tests:
 ./scripts/run_tests.sh
 ```
 
+By default, tests that require additional dependencies beyond the go toolchain are skipped.
+Enable these tests by setting the env variable `TEST_ACCEPTANCE=true`.
+
 You can generate an HTML coverage report by running:
 
 ```shell
diff --git a/docs/Gemfile b/docs/Gemfile
index 3ef7eb7..0bffcee 100644
--- a/docs/Gemfile
+++ b/docs/Gemfile
@@ -14,7 +14,7 @@ source "https://rubygems.org"
 gem "github-pages", "~> 228", group: :jekyll_plugins
 # If you have any plugins, put them here!
 group :jekyll_plugins do
-  gem "jekyll-feed", "~> 0.12"
+  gem "jekyll-feed", "~> 0.17"
 end
 
 # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem
diff --git a/docs/github-action.md b/docs/github-action.md
index 4ee0a94..ef3d757 100644
--- a/docs/github-action.md
+++ b/docs/github-action.md
@@ -83,8 +83,8 @@ jobs:
     uses: "google/osv-scanner/.github/workflows/osv-scanner-reusable.yml"
     with:
       scan-args: |-
-        ./path/to/lockfile1
-        requirements.txt:./path/to/python-lockfile2.txt
+        --lockfile=./path/to/lockfile1
+        --lockfile=requirements.txt:./path/to/python-lockfile2.txt
 ```
 ##### Default arguments
 ```yml


Test patch:
diff --git a/.github/workflows/test-action/action.yml b/.github/workflows/test-action/action.yml
index a66778c..e4c611e 100644
--- a/.github/workflows/test-action/action.yml
+++ b/.github/workflows/test-action/action.yml
@@ -20,6 +20,8 @@ runs:
   steps:
     - name: Run go test
       shell: bash
+      env:
+        TEST_ACCEPTANCE: true
       run: ./scripts/run_tests.sh
     - name: Upload coverage to Codecov
       uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
diff --git a/internal/sourceanalysis/rust_test.go b/internal/sourceanalysis/rust_test.go
index 7fce52c..be97cd0 100644
--- a/internal/sourceanalysis/rust_test.go
+++ b/internal/sourceanalysis/rust_test.go
@@ -67,6 +67,7 @@ func Test_functionsFromDWARF(t *testing.T) {
 }
 
 func Test_rustBuildSource(t *testing.T) {
+	testutility.AcceptanceTests(t, "Requires rust toolchain to be installed")
 	t.Parallel()
 
 	workingDir, err := os.Getwd()
diff --git a/internal/testutility/utility.go b/internal/testutility/utility.go
index 9438be2..1501c5e 100644
--- a/internal/testutility/utility.go
+++ b/internal/testutility/utility.go
@@ -99,3 +99,12 @@ func AssertMatchFixtureText(t *testing.T, path string, actual string) {
 		}
 	}
 }
+
+// AcceptanceTests marks this test function as a extended that require additional dependencies
+// automatically skipped unless running in a CI environment
+func AcceptanceTests(t *testing.T, reason string) {
+	t.Helper()
+	if os.Getenv("TEST_ACCEPTANCE") != "true" {
+		t.Skip("Skipping extended test: ", reason)
+	}
+}