✨ Skip checks that don't apply to the current repo type (#5000)

* ✨ Skip checks that don't apply to the current repo type

Scorecard's Azure DevOps support runs every check regardless of
whether it makes sense for the platform. Checks like
Dangerous-Workflow and Token-Permissions look exclusively at
GitHub Actions files and produce misleading results on non-GitHub
repos.

The repos field in checks.yaml already listed supported platforms
per check, but nothing enforced it at runtime. Now GetEnabled
reads that field and drops checks that don't list the repo's
platform.

- Add RepoType to the Repo interface (GitHub, GitLab,
  Azure DevOps, local) with implementations on all four concrete
  types and the mock
- Pass RepoType through to policy.GetEnabled, which filters
  checks against checks.yaml's repos field
- Tag 11 checks as supporting Azure DevOps based on which
  client methods are actually implemented

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

* Fix repo-type filtering: cache docs, case-insensitive lookup, pass type in serve

- Parse checks.yaml once per GetEnabled call instead of per-check
- Use case-insensitive check name lookup so CLI args like
  'binary-artifacts' don't bypass the repo-type filter
- Pass repo.Type() in serve.go where the repo is already available

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

* Skip docs parsing when repoType is empty, use O(1) lookup map

- Only call docs.Read() when repoType is non-empty
- Build a lowercased name -> supported types map once per
  GetEnabled call instead of O(N) GetChecks() scan per check

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

* Cache parsed checks.yaml with sync.Once in docs.Read()

The embedded YAML is immutable at runtime, so parsing it
once and reusing the result is safe. Avoids repeated
unmarshalling across GetEnabled calls in cron/multi-repo
paths.

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

* Fix lint: rename cachedErr to errCachedRead, fix var block ordering

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

---------

Signed-off-by: Jamie Magee <jamie.magee@gmail.com>

Author: JamieMagee

clients/azuredevopsrepo/repo.go

@@ -100,6 +100,11 @@ func (r *Repo) Metadata() []string {
 	return r.metadata
 }
 
+// Type implements Repo.Type.
+func (r *Repo) Type() clients.RepoType {
+	return clients.RepoTypeAzureDevOps
+}
+
 // Path() implements RepoClient.Path.
 func (r *Repo) Path() string {
 	return fmt.Sprintf("%s/%s/%s/%s", r.organization, r.project, "_git", r.name)

clients/githubrepo/repo.go

@@ -112,6 +112,11 @@ func (r *Repo) Metadata() []string {
 	return r.metadata
 }
 
+// Type implements Repo.Type.
+func (r *Repo) Type() clients.RepoType {
+	return clients.RepoTypeGitHub
+}
+
 func (r *Repo) commitExpression() string {
 	if strings.EqualFold(r.commitSHA, clients.HeadSHA) {
 		// TODO(#575): Confirm that this works as expected.

clients/gitlabrepo/repo.go

@@ -166,6 +166,11 @@ func (r *Repo) Metadata() []string {
 	return r.metadata
 }
 
+// Type implements Repo.Type.
+func (r *Repo) Type() clients.RepoType {
+	return clients.RepoTypeGitLab
+}
+
 // Path() implements RepoClient.Path.
 func (r *Repo) Path() string {
 	return fmt.Sprintf("%s/%s", r.owner, r.project)

clients/localdir/repo.go

@@ -69,6 +69,11 @@ func (r *Repo) AppendMetadata(m ...string) {
 	r.metadata = append(r.metadata, m...)
 }
 
+// Type implements Repo.Type.
+func (r *Repo) Type() clients.RepoType {
+	return clients.RepoTypeLocal
+}
+
 // Path() implements RepoClient.Path.
 func (r *Repo) Path() string {
 	return r.path

clients/mockclients/repo.go

@@ -14,6 +14,20 @@
 
 package clients
 
+// RepoType identifies the hosting platform of a repository.
+type RepoType string
+
+const (
+	// RepoTypeGitHub represents a GitHub-hosted repository.
+	RepoTypeGitHub RepoType = "GitHub"
+	// RepoTypeGitLab represents a GitLab-hosted repository.
+	RepoTypeGitLab RepoType = "GitLab"
+	// RepoTypeAzureDevOps represents an Azure DevOps-hosted repository.
+	RepoTypeAzureDevOps RepoType = "Azure DevOps"
+	// RepoTypeLocal represents a local directory.
+	RepoTypeLocal RepoType = "local"
+)
+
 // Repo interface uniquely identifies a repo.
 type Repo interface {
 	// Path returns the specifier of the repository within its forge
@@ -29,4 +43,6 @@ type Repo interface {
 	IsValid() error
 	Metadata() []string
 	AppendMetadata(metadata ...string)
+	// Type returns the hosting platform type.
+	Type() RepoType
 }

clients/repo.go

@@ -160,7 +160,7 @@ func rootCmd(o *options.Options) error {
 	// this call to policy is different from the one in scorecard.Run
 	// this one is concerned with a policy file, while the scorecard.Run call is
 	// more concerned with the supported request types
-	enabledChecks, err := policy.GetEnabled(pol, o.Checks(), requiredRequestTypes)
+	enabledChecks, err := policy.GetEnabled(pol, o.Checks(), requiredRequestTypes, "")
 	if err != nil {
 		return fmt.Errorf("GetEnabled: %w", err)
 	}

cmd/root.go

@@ -154,7 +154,7 @@ func (s *server) handleScorecard(w http.ResponseWriter, r *http.Request) {
 	if !strings.EqualFold(opts.Commit, clients.HeadSHA) {
 		requiredRequestTypes = append(requiredRequestTypes, checker.CommitBased)
 	}
-	enabledChecks, err := policy.GetEnabled(nil, opts.Checks(), requiredRequestTypes)
+	enabledChecks, err := policy.GetEnabled(nil, opts.Checks(), requiredRequestTypes, repo.Type())
 	if err != nil {
 		http.Error(w, fmt.Sprintf("GetEnabled: %v", err), http.StatusInternalServerError)
 		return

cmd/serve.go

@@ -211,7 +211,7 @@ func processRequest(ctx context.Context,
 			commitSHA = repoReq.GetCommit()
 			requiredRequestType = append(requiredRequestType, checker.CommitBased)
 		}
-		checksToRun, err := policy.GetEnabled(nil /*policy*/, nil /*checks*/, requiredRequestType)
+		checksToRun, err := policy.GetEnabled(nil /*policy*/, nil /*checks*/, requiredRequestType, repo.Type())
 		if err != nil {
 			return fmt.Errorf("error during policy.GetEnabled: %w", err)
 		}

cron/internal/worker/main.go

@@ -19,6 +19,7 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"sync"
 
 	"github.com/ossf/scorecard/v5/docs/checks/internal"
 	sce "github.com/ossf/scorecard/v5/errors"
@@ -28,6 +29,12 @@ var errCheckNotExist = errors.New("check does not exist")
 
 const docURL = "https://github.com/ossf/scorecard/blob/%s/docs/checks.md"
 
+var (
+	readOnce      sync.Once
+	errCachedRead error
+	cachedDoc     Doc
+)
+
 // DocImpl implements `Doc` interface and
 // contains checks' documentation.
 //
@@ -37,15 +44,18 @@ type DocImpl struct {
 }
 
 // Read loads the checks' documentation.
+// The embedded YAML is parsed once and cached for subsequent calls.
 func Read() (Doc, error) {
-	m, e := internal.ReadDoc()
-	if e != nil {
-		d := DocImpl{}
-		return &d, fmt.Errorf("internal.ReadDoc: %w", e)
-	}
-
-	d := DocImpl{internaldoc: m}
-	return &d, nil
+	readOnce.Do(func() {
+		m, e := internal.ReadDoc()
+		if e != nil {
+			cachedDoc = &DocImpl{}
+			errCachedRead = fmt.Errorf("internal.ReadDoc: %w", e)
+			return
+		}
+		cachedDoc = &DocImpl{internaldoc: m}
+	})
+	return cachedDoc, errCachedRead
 }
 
 // GetCheck returns the information for check `name`.