feat: replace "skip-git" with "include-git", making git repository scanning not the default

BREAKING CHANGE: don't scan git repositories by default, replacing "--skip-git" with "--include-git"

Author: G-Rath

.github/workflows/osv-scanner-reusable-pr.yml

@@ -26,7 +26,6 @@ on:
         type: string
         default: |-
           -r
-          --skip-git
           ./
       results-file-name:
         description: "File name of the result SARIF file"

.github/workflows/osv-scanner-reusable.yml

@@ -26,7 +26,6 @@ on:
         type: string
         default: |-
           -r
-          --skip-git
           ./
       results-file-name:
         description: "File name of the result SARIF file"

.github/workflows/osv-scanner-unified-action.yml

@@ -38,7 +38,6 @@ jobs:
     with:
       # Just scan the root directory and docs, since everything else is fixtures
       scan-args: |-
-        --skip-git
         ./
         ./docs/
   scan-pr:
@@ -52,6 +51,5 @@ jobs:
     with:
       # Just scan the root directory and docs, since everything else is fixtures
       scan-args: |-
-        --skip-git
         ./
         ./docs/

.github/workflows/prerelease-check.yml

@@ -27,7 +27,6 @@ jobs:
       # Only scan the top level go.mod file without recursively scanning directories since
       # this is pipeline is about releasing the go module and binary
       scan-args: |-
-        --skip-git
         ./
 
   format:

actions/scanner/action.yml

@@ -5,7 +5,6 @@ inputs:
   scan-args:
     description: "Arguments to osv-scanner, separated by new line"
     default: |-
-      --skip-git
       --recursive
       ./
 runs:

cmd/osv-scanner/scan/main.go

@@ -68,8 +68,8 @@ func Command(stdout, stderr io.Writer, r *reporter.Reporter) *cli.Command {
 				TakesFile: true,
 			},
 			&cli.BoolFlag{
-				Name:  "skip-git",
-				Usage: "skip scanning git repositories",
+				Name:  "include-git",
+				Usage: "include scanning git repositories",
 				Value: false,
 			},
 			&cli.BoolFlag{
@@ -204,7 +204,7 @@ func action(context *cli.Context, stdout, stderr io.Writer) (reporter.Reporter,
 		SBOMPaths:            context.StringSlice("sbom"),
 		DockerContainerNames: context.StringSlice("docker"),
 		Recursive:            context.Bool("recursive"),
-		SkipGit:              context.Bool("skip-git"),
+		IncludeGit:           context.Bool("include-git"),
 		NoIgnore:             context.Bool("no-ignore"),
 		ConfigOverridePath:   context.String("config"),
 		DirectoryPaths:       context.Args().Slice(),

docs/github-action.md

@@ -138,7 +138,6 @@ jobs:
       # Only scan the top level go.mod file without recursively scanning directories since
       # this is pipeline is about releasing the go module and binary
       scan-args: |-
-        --skip-git
         ./
     permissions:
       # Require writing security events to upload SARIF file to security tab
@@ -167,7 +166,6 @@ The GitHub Actions have the following optional inputs:
   Default:
   ```bash
     --recursive # Recursively scan subdirectories
-    --skip-git=true # Skip commit scanning to focus on dependencies
     ./ # Start the scan from the root of the repository
   ```
 - `results-file-name`: This is the name of the final SARIF file uploaded to Github.
@@ -202,7 +200,6 @@ jobs:
     with:
       scan-args: |-
         --recursive
-        --skip-git=true
         ./
 ```
 

pkg/osvscanner/osvscanner.go

@@ -42,7 +42,7 @@ type ScannerActions struct {
 	DirectoryPaths       []string
 	GitCommits           []string
 	Recursive            bool
-	SkipGit              bool
+	IncludeGit           bool
 	NoIgnore             bool
 	DockerContainerNames []string
 	ConfigOverridePath   string
@@ -108,7 +108,7 @@ const (
 //   - Any lockfiles with scanLockfile
 //   - Any SBOM files with scanSBOMFile
 //   - Any git repositories with scanGit
-func scanDir(r reporter.Reporter, dir string, skipGit bool, recursive bool, useGitIgnore bool, compareOffline bool) ([]scannedPackage, error) {
+func scanDir(r reporter.Reporter, dir string, includeGit bool, recursive bool, useGitIgnore bool, compareOffline bool) ([]scannedPackage, error) {
 	var ignoreMatcher *gitIgnoreMatcher
 	if useGitIgnore {
 		var err error
@@ -152,7 +152,7 @@ func scanDir(r reporter.Reporter, dir string, skipGit bool, recursive bool, useG
 			}
 		}
 
-		if !skipGit && info.IsDir() && info.Name() == ".git" {
+		if includeGit && info.IsDir() && info.Name() == ".git" {
 			pkgs, err := scanGit(r, filepath.Dir(path)+"/")
 			if err != nil {
 				r.Infof("scan failed for git repository, %s: %v\n", path, err)
@@ -828,7 +828,7 @@ func DoScan(actions ScannerActions, r reporter.Reporter) (models.VulnerabilityRe
 	}
 
 	if actions.CompareOffline {
-		actions.SkipGit = true
+		actions.IncludeGit = false
 
 		if len(actions.ScanLicensesAllowlist) > 0 || actions.ScanLicensesSummary {
 			return models.VulnerabilityResults{}, errors.New("cannot retrieve licenses locally")
@@ -903,7 +903,7 @@ func DoScan(actions ScannerActions, r reporter.Reporter) (models.VulnerabilityRe
 
 	for _, dir := range actions.DirectoryPaths {
 		r.Infof("Scanning dir %s\n", dir)
-		pkgs, err := scanDir(r, dir, actions.SkipGit, actions.Recursive, !actions.NoIgnore, actions.CompareOffline)
+		pkgs, err := scanDir(r, dir, actions.IncludeGit, actions.Recursive, !actions.NoIgnore, actions.CompareOffline)
 		if err != nil {
 			return models.VulnerabilityResults{}, err
 		}