Add GitHub actions and shared workflow usage catalogers (#2140)

* add github actions usage cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* update integration and cli tests with github actions sample

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add support for shared workflows

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* split github actions usage cataloger

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* add source explanation for github action types

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* a github purl does not always mean the package is a github action

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* keep github action catalogers as dir only catalogers

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

test/cli/packages_cmd_test.go

@@ -6,6 +6,12 @@ import (
 	"testing"
 )
 
+const (
+	// this is the number of packages that should be found in the image-pkg-coverage fixture image
+	// when analyzed with the squashed scope.
+	coverageImageSquashedPackageCount = 24
+)
+
 func TestPackagesCmdFlags(t *testing.T) {
 	hiddenPackagesImage := "docker-archive:" + getFixtureImage(t, "image-hidden-packages")
 	coverageImage := "docker-archive:" + getFixtureImage(t, "image-pkg-coverage")
@@ -114,7 +120,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			name: "squashed-scope-flag",
 			args: []string{"packages", "-o", "json", "-s", "squashed", coverageImage},
 			assertions: []traitAssertion{
-				assertPackageCount(24),
+				assertPackageCount(coverageImageSquashedPackageCount),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -231,7 +237,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 				// the application config in the log matches that of what we expect to have been configured.
 				assertInOutput("parallelism: 2"),
 				assertInOutput("parallelism=2"),
-				assertPackageCount(24),
+				assertPackageCount(coverageImageSquashedPackageCount),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -242,7 +248,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 				// the application config in the log matches that of what we expect to have been configured.
 				assertInOutput("parallelism: 1"),
 				assertInOutput("parallelism=1"),
-				assertPackageCount(24),
+				assertPackageCount(coverageImageSquashedPackageCount),
 				assertSuccessfulReturnCode,
 			},
 		},
@@ -256,7 +262,7 @@ func TestPackagesCmdFlags(t *testing.T) {
 			assertions: []traitAssertion{
 				assertNotInOutput("secret_password"),
 				assertNotInOutput("secret_key_path"),
-				assertPackageCount(24),
+				assertPackageCount(coverageImageSquashedPackageCount),
 				assertSuccessfulReturnCode,
 			},
 		},

test/integration/catalog_packages_cases_test.go

@@ -368,6 +368,20 @@ var dirOnlyTestCases = []testCase{
 			"swift-numerics":         "1.0.2",
 		},
 	},
+	{
+		name:    "find github action packages (from usage in workflow files and composite actions)",
+		pkgType: pkg.GithubActionPkg,
+		pkgInfo: map[string]string{
+			"actions/checkout": "v4",
+		},
+	},
+	{
+		name:    "find github shared workflow calls (from usage in workflow files)",
+		pkgType: pkg.GithubActionWorkflowPkg,
+		pkgInfo: map[string]string{
+			"octo-org/this-repo/.github/workflows/workflow-1.yml": "172239021f7ba04fe7327647b213799853a9eb89",
+		},
+	},
 }
 
 var commonTestCases = []testCase{

test/integration/catalog_packages_test.go

@@ -96,6 +96,8 @@ func TestPkgCoverageImage(t *testing.T) {
 	definedPkgs.Remove(string(pkg.LinuxKernelPkg))
 	definedPkgs.Remove(string(pkg.LinuxKernelModulePkg))
 	definedPkgs.Remove(string(pkg.SwiftPkg))
+	definedPkgs.Remove(string(pkg.GithubActionPkg))
+	definedPkgs.Remove(string(pkg.GithubActionWorkflowPkg))
 
 	var cases []testCase
 	cases = append(cases, commonTestCases...)

test/integration/test-fixtures/image-pkg-coverage/pkgs/github-actions/.github/workflows/validations.yaml

@@ -0,0 +1,18 @@
+name: "Validations"
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  call-workflow-1-in-local-repo:
+    uses: octo-org/this-repo/.github/workflows/workflow-1.yml@172239021f7ba04fe7327647b213799853a9eb89
+
+  Unit-Test:
+    name: "Unit tests"
+    runs-on: ubuntu-20.04
+    steps:
+      - uses: actions/checkout@v4