✨ implement more of the Azure DevOps client

[JamieMagee]

What kind of change does this PR introduce?

Includes:

• GetBranch
• GetSuccessfulWorkflowRuns
• ListCheckRunsForRef
• ListStatuses
• ListWebhooks
• SearchCommits

Also, includes comments about methods which can never be implemented:

• GetOrgRepoClient
  • Org repository, AKA the <org>/.github repository, is a GitHub-specific feature
• ListLicenses
  • Azure DevOps doesn't have a license detection feature. Thankfully, the License check falls back to file-based detection.

Still need to implement:

• ListReleases
  • Needs a little more investigation to line up the Azure DevOps implementation with what Scorecard expects

(Is it a bug fix, feature, docs update, something else?)

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

Missing implementations for the methods listed above

What is the new behavior (if this is a feature change)?**

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Next step of #4177

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

implement more of the Azure DevOps client

[codecov]

Codecov Report

Attention: Patch coverage is 54.13223% with 222 lines in your changes missing coverage. Please review.

Project coverage is 68.47%. Comparing base (353ed60) to head (a58e4f5).
Report is 85 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4456      +/-   ##
==========================================
+ Coverage   66.80%   68.47%   +1.67%     
==========================================
  Files         230      246      +16     
  Lines       16602    18427    +1825     
==========================================
+ Hits        11091    12618    +1527     
- Misses       4808     4983     +175     
- Partials      703      826     +123     

[spencerschrock]

How do Branch-Protection and SAST look now?

[JamieMagee]

SAST works perfectly, but Branch-Protection is still broken until ListReleases is implemented:

SAST

$ env SCORECARD_EXPERIMENTAL=1 go run ./. --repo https://dev.azure.com/jamiemagee/jamiemagee/_git/scorecard --checks SAST
Starting [SAST]
Finished [SAST]

RESULTS
-------
Aggregate score: 10.0 / 10

Check scores:
|---------|------|----------------------------|-----------------------------------------------------------------|
|  SCORE  | NAME |           REASON           |                    DOCUMENTATION/REMEDIATION                    |
|---------|------|----------------------------|-----------------------------------------------------------------|
| 10 / 10 | SAST | SAST tool detected: CodeQL | https://github.com/ossf/scorecard/blob/main/docs/checks.md#sast |
|---------|------|----------------------------|-----------------------------------------------------------------|

Branch-Protection

$ env SCORECARD_EXPERIMENTAL=1 go run ./. --repo https://dev.azure.com/jamiemagee/jamiemagee/_git/scorecard --checks Branch-Protection
Starting [Branch-Protection]
Finished [Branch-Protection]

RESULTS
-------
Aggregate score: ?

Check scores:
|-------|-------------------|--------------------------------|------------------------------------------------------------------------------|
| SCORE |       NAME        |             REASON             |                          DOCUMENTATION/REMEDIATION                           |
|-------|-------------------|--------------------------------|------------------------------------------------------------------------------|
| ?     | Branch-Protection | internal error: unsupported    | https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection |
|       |                   | feature                        |                                                                              |
|-------|-------------------|--------------------------------|------------------------------------------------------------------------------|
Error: check runtime error: Branch-Protection: internal error: unsupported feature
2024/12/18 10:58:02 error during command execution: check runtime error: Branch-Protection: internal error: unsupported feature
exit status 1

The issue with ListReleases on Azure DevOps is it doesn't have a concept of a release in the same way that GitHub and GitLab do. What is called a release on Azure DevOps is a type of build pipeline. I'm still trying to figure out the best way to map the Scorecard concept to Azure DevOps, but I didn't want to block these changes until I have figured it out.

The approach I'm working on at the moment is listing releases, finding the build that triggered the release, and using the artifacts produced by the build.

[spencerschrock]

SAST works perfectly

I'll note this is falling back to the github detection of the .github/workflows, and not through your added vstfs:///build/build string (which will be more likely for AZDO projects I assume?)

The issue with ListReleases on Azure DevOps is it doesn't have a concept of a release in the same way that GitHub and GitLab do

I'm curious if we should just continue on the ListReleases ErrUnsupportedCheck so we get branch protection data for the default branch at least

[JamieMagee]

I'll note this is falling back to the github detection of the .github/workflows, and not through your added vstfs:///build/build string (which will be more likely for AZDO projects I assume?)

That's an issue with the check itself than with the Azure DevOps client. There are definitely a couple of checks like that.

The SAST check specifically would need to be updated to look for all YAML files in the repository, because Azure Pipelines files can be in any arbitrary location in the repository, and look for the AdvancedSecurity-Codeql-Analyze task. See Code scanning for GitHub Advanced Security for Azure DevOps for more information.

I'm curious if we should just continue on the ListReleases ErrUnsupportedCheck so we get branch protection data for the default branch at least

Yes, that would be one approach. But I don't want to expand the scope of this PR too much more.

[spencerschrock]

The SAST check specifically would need to be updated to look for all YAML files in the repository, because Azure Pipelines files can be in any arbitrary location in the repository, and look for the AdvancedSecurity-Codeql-Analyze task

Whoops, I had meant CI-Tests, as that's what you added the vstfs:///build/build string for.