Docker setup for parsing dependency update information from ght pull request events

Dockerfile

FROM node:12-buster-slim

# ----
# Instal essentials
RUN apt-get update && \
    apt-get install -y build-essential && \
    apt-get clean && \
    apt-get autoclean && \
    apt-get autoremove

# ----
# Import script
COPY ./main.sh /
COPY ./format.js /
ENTRYPOINT ["/main.sh"]

format.js

#!/usr/bin/env node

const fs = require('fs');
var stdin = process.openStdin();

var data = "";

stdin.on('data', chunk => {
	data += chunk;
});



stdin.on('end', () => {
	var obj = JSON.parse(data);
	fs.writeFile("row.txt", obj.ts + ","  + obj.number + "," + obj.url + "," + obj.title + "," + obj.state + "," + obj.slug + "," + obj.sha + "," + obj.path, function (err) {
		if (err) {
			return console.error(err);
		}
		console.error("[NODEJS] row.txt created");
	});
	fs.writeFile("patch.diff", JSON.parse(obj.patch), function (err) {
		if (err) {
			return console.error.log(err);
		}
	console.error("[NODEJS] patch.diff created!");
	});

});

main.sh

#!/usr/bin/env bash

###
###  ONLY STDIN/STDOUT
###  docker run -i dependabot_entries < JSON_OBJECT
###

PATCH_FILE=patch.diff
ROW=row.txt
DEP_INFO=dep

###
## 1. parse & generate row.txt and patch.diff
###
cat | node format.js 


if [[ ! -f "$PATCH_FILE" ]]; then
    >&2 echo "$PATCH_FILE is missing!"
    exit 2
fi

if [[ ! -f "$ROW" ]]; then
    >&2 echo "$ROW is missing!"
    exit 2
fi

###
## 2. Extract data from the patch
###
NEW_VER=$( grep -m 1 -E "^\+" $PATCH_FILE   | grep version)
OLD_VER=$( grep -m 1 -nE "^\-" $PATCH_FILE | grep version)


###
## 3. Extract line number data
###
LINE_NUMBER=$(echo "$OLD_VER" | awk -F":" '{print $1}')
START=$((LINE_NUMBER-3))
END=$((LINE_NUMBER-1))
sed -n "$START,$END p;$LINE_NUMBER q" $PATCH_FILE > $DEP_INFO


###
## 4. Validate data
###
GROUPID=$(cat $DEP_INFO | sed -n 2p)
ARTIFACTID=$(cat $DEP_INFO | sed -n 3p)

## check if <dependency> is there?
## if [[ $(head -n 1 $DEP_INFO) != *"<dependency>"* ]] && [[ $(head -n 1 $DEP_INFO) != *"<parent>"* ]] && [[ $(head -n 1 $DEP_INFO) != *"<plugin>"* ]]
if [[ $(head -n 1 $DEP_INFO) != *"<dependency>"* ]]; then
    >&2 echo "not a dependency tag!"
    >&2 echo "output: $(head -n 1 $DEP_INFO)"
    exit 1
fi

## check if <groupid> is there?
if [[ $GROUPID != *"<groupId>"* ]]; then
    >&2 echo "<groupId> tag is missing!"
    >&2 echo "output: $GROUPID"
    exit 1
fi

## check if <artifactId> is there?
if [[ $ARTIFACTID != *"<artifactId>"* ]]; then
    >&2 echo "<artifactId> tag is missing!"
    >&2 echo "output: $ARTIFACTID"
    exit 1
fi

###
## 5. Extract values using regex
###

x="version"
NEW=$(echo "$NEW_VER" | sed -n "/$x/{s/.*<$x>\(.*\)<\/$x>.*/\1/;p}")
OLD=$(echo "$OLD_VER" | sed -n "/$x/{s/.*<$x>\(.*\)<\/$x>.*/\1/;p}")

x="groupId"
GID=$(echo "$GROUPID" | sed -n "/$x/{s/.*<$x>\(.*\)<\/$x>.*/\1/;p}")
x="artifactId"
AID=$(echo "$ARTIFACTID" | sed -n "/$x/{s/.*<$x>\(.*\)<\/$x>.*/\1/;p}")

###
## 6. Print data
###
echo -e "$(head -1 $ROW),$GID,$AID,$OLD,$NEW"
exit 0

run.sh

#!/usr/bin/env bash

for k in $(jq -r '.[] | @base64' "$1"); do
    _jq() {
     echo "${k}" | base64 --decode | jq -r "${1}"
    }
    _jq '.' | docker run -i dependabot_json2csv
done

Run instructions

Pre-req

• jq installed on your machine
• JSON-file generated from this script

git clone https://gist.github.com/jhejderup/7a653d7a91ea82e8cd34d34424a1a1cf dependabot_json2csv
cd dependabot_json2csv
chmod +x main.sh
chmod +x run.sh
docker build -t  dependabot_json2csv .
./run.sh [JSON-FILE] > data.csv

NB: Only parses patches that have a change in a <version> tag inside a <dependency> clause (also in order dependency -> groupid -> artifactid -> version)