Ability to provide a repo URL

[Jayp0weru5r]

Is your feature request related to a problem? Please describe.
It can be a bit more difficult to have to download the repo locally to perform a scan.
Describe the solution you'd like
Ability to be able to provide a repoURL and it gets downloaded to a tmp directory performs the analysis generates a report and deletes the downloaded folder afterwards.

Describe alternatives you've considered

A flag for git Integration --git utilizes git cli to clone the repo, perform analysis, generate report and clean up cloned directory.

Additional context

[gfs]

This sounds like an interesting idea. I think we can do this by calling oss-download.

[gfs]

oss-download would give us the ability to support download of github sources. @Jayp0weru5r is the code you're working with generally on github?

[gfs]

See microsoft/OSSGadget#195 for adding support for arbitrary git repo uris to oss-download.

[Jayp0weru5r]

oss-download would give us the ability to support download of github sources. @Jayp0weru5r is the code you're working with generally on github?

@gfs we are also working with Azure Devops that is why I I was thinking it could leverage git.

[gfs]

I was mistaken about what we already support in oss-download. Assuming the dev ops feeds are public you could download them with oss-download which uses libgit2sharp. We could (need to talk to @guyacosta first) investigate incorporating the oss-download action in Application inspector.

@Jayp0weru5r

It sounds like your request is:

Given a public url of a git repo like https://path.to/repo.git Return the Application inspector results.

Is that correct? If that is the case its a matter of hooking up a couple of our libraries (some will first need to be published to nuget).

On the other hand, If you want to access authenticated feeds that likely wouldn't be feasible for us to implement and we'd recommend getting the source yourself.

[guyacosta]

I actually implemented an Azure based solution that would handle URL's from packages on other repos but which had a link to a downloadable source location on Github. Haven't been maintaining it and never published it but it would do just that and return the results as part of the HTML get request where you could optionally (not ideal) include credentials for a private repo. Will talk with mngt. team to see if we want to support this and add support for other git repos.

[gfs]

Depends on microsoft/OSSGadget#196.