Switch the pinned action support to use the new frizbee version

go.mod

@@ -53,7 +53,7 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/spf13/viper v1.19.0
 	github.com/sqlc-dev/pqtype v0.3.0
-	github.com/stacklok/frizbee v0.0.15
+	github.com/stacklok/frizbee v0.0.16
 	github.com/stretchr/testify v1.9.0
 	github.com/styrainc/regal v0.22.0
 	github.com/thomaspoignant/go-feature-flag v1.27.0

go.sum

@@ -493,6 +493,8 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 h1:pRhl55Yx1eC7BZ1N+BBWwn
 github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0/go.mod h1:XKMd7iuf/RGPSMJ/U4HP0zS2Z9Fh8Ps9a+6X26m/tmI=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 h1:bkypFPDjIYGfCYD5mRBvpqxfYX1YCS1PXdKYWi8FsN0=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0/go.mod h1:P+Lt/0by1T8bfcF3z737NnSbmxQAppXMRziHUxPOC8k=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542 h1:2VTzZjLZBgl62/EtslCrtky5vbi9dd7HrQPQIx6wqiw=
+github.com/h2non/parth v0.0.0-20190131123155-b4df798d6542/go.mod h1:Ow0tF8D4Kplbc8s8sSb3V2oUCygFHVp8gC3Dn6U4MNI=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -862,8 +864,8 @@ github.com/spf13/viper v1.19.0/go.mod h1:GQUN9bilAbhU/jgc1bKs99f/suXKeUMct8Adx5+
 github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
 github.com/sqlc-dev/pqtype v0.3.0 h1:b09TewZ3cSnO5+M1Kqq05y0+OjqIptxELaSayg7bmqk=
 github.com/sqlc-dev/pqtype v0.3.0/go.mod h1:oyUjp5981ctiL9UYvj1bVvCKi8OXkCa0u645hce7CAs=
-github.com/stacklok/frizbee v0.0.15 h1:W3gocAzapIvQAm1MTF5GFBwGQSCdv0Kk/CweTNGb5IY=
-github.com/stacklok/frizbee v0.0.15/go.mod h1:rpmtCItZMef9w5wQRQz8N3DRYplAdxFAL8JDZYFOjeM=
+github.com/stacklok/frizbee v0.0.16 h1:32EWzD9xrySyDfcuaEs5/6YCe3pCt37Ej6UpfDYHjKA=
+github.com/stacklok/frizbee v0.0.16/go.mod h1:Hvi3/ryonTgeMBG4/EtBGjfK49W0rP0P3+0RAg3kqHI=
 github.com/stoewer/go-strcase v1.3.0 h1:g0eASXYtp+yvN9fK8sH94oCIk0fau9uV1/ZdJ0AVEzs=
 github.com/stoewer/go-strcase v1.3.0/go.mod h1:fAH5hQ5pehh+j3nZfvwdk2RgEgQjAoM8wodgtPmh1xo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -1345,6 +1347,8 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EV
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
 gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
+gopkg.in/h2non/gock.v1 v1.1.2 h1:jBbHXgGBK/AoPVfJh5x4r/WxIrElvbLel8TCZkkZJoY=
+gopkg.in/h2non/gock.v1 v1.1.2/go.mod h1:n7UGz/ckNChHiK05rDoiC4MYSunEC/lyaUm2WWaDva0=
 gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=

internal/engine/actions/remediate/pull_request/types_actions_replace_tags.go

@@ -20,10 +20,8 @@ import (
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
-	fzconfig "github.com/stacklok/frizbee/pkg/config"
-	"github.com/stacklok/frizbee/pkg/ghactions"
-	"github.com/stacklok/frizbee/pkg/utils"
-	"gopkg.in/yaml.v3"
+	"github.com/stacklok/frizbee/pkg/replacer"
+	"github.com/stacklok/frizbee/pkg/utils/config"
 
 	"github.com/stacklok/minder/internal/engine/interfaces"
 	v1 "github.com/stacklok/minder/pkg/providers/v1"
@@ -34,7 +32,7 @@ var _ fsModifier = (*frizbeeTagResolveModification)(nil)
 type frizbeeTagResolveModification struct {
 	fsChangeSet
 
-	fzcfg *fzconfig.GHActions
+	fzcfg *config.GHActions
 
 	ghCli v1.GitHub
 }
@@ -56,8 +54,8 @@ func newFrizbeeTagResolveModification(
 		fsChangeSet: fsChangeSet{
 			fs: params.bfs,
 		},
-		fzcfg: &fzconfig.GHActions{
-			Filter: fzconfig.Filter{
+		fzcfg: &config.GHActions{
+			Filter: config.Filter{
 				Exclude: exclude,
 			},
 		},
@@ -66,35 +64,24 @@ func newFrizbeeTagResolveModification(
 }
 
 func (ftr *frizbeeTagResolveModification) createFsModEntries(ctx context.Context, _ interfaces.ActionsParams) error {
-	entries := []*fsEntry{}
-	cache := utils.NewRefCacher()
+	// Create a new Frizbee instance
+	r := replacer.NewGitHubActionsReplacer(&config.Config{GHActions: *ftr.fzcfg}).WithGitHubClient(ftr.ghCli)
 
-	err := ghactions.TraverseGitHubActionWorkflows(ftr.fs, ".github/workflows", func(path string, wflow *yaml.Node) error {
-		m, err := ghactions.ModifyReferencesInYAMLWithCache(ctx, ftr.ghCli, wflow, ftr.fzcfg, cache)
-		if err != nil {
-			return fmt.Errorf("failed to process YAML file %s: %w", path, err)
-		}
-
-		buf, err := utils.YAMLToBuffer(wflow)
-		if err != nil {
-			return fmt.Errorf("failed to convert YAML to buffer: %w", err)
-		}
-
-		if m {
-			entries = append(entries, &fsEntry{
-				Path:    path,
-				Content: buf.String(),
-				Mode:    filemode.Regular.String(),
-			})
-		}
-
-		return nil
-	})
+	// Parse the .github/workflows directory and replace tags with digests
+	ret, err := r.ParsePathInFS(ctx, ftr.fs, ".github/workflows")
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to parse path in filesystem: %w", err)
 	}
 
-	ftr.entries = entries
+	// Add the modified paths and contents to the fsChangeSet, if any
+	for modifiedPath, modifiedContent := range ret.Modified {
+		ftr.entries = append(ftr.entries, &fsEntry{
+			Path:    modifiedPath,
+			Content: modifiedContent,
+			Mode:    filemode.Regular.String(),
+		})
+	}
+	// All good
 	return nil
 }
 
@@ -136,7 +123,7 @@ func parseExcludeFromDef(def map[string]any) []string {
 
 func parseExcludesFromRepoConfig(fs billy.Filesystem) []string {
 	for _, fname := range []string{".frizbee.yml", ".frizbee.yaml"} {
-		cfg, err := fzconfig.ParseConfigFileFromFS(fs, fname)
+		cfg, err := config.ParseConfigFileFromFS(fs, fname)
 		if err != nil {
 			continue
 		}

internal/engine/eval/rego/lib.go

@@ -29,8 +29,8 @@ import (
 	"github.com/open-policy-agent/opa/ast"
 	"github.com/open-policy-agent/opa/rego"
 	"github.com/open-policy-agent/opa/types"
-	frizgh "github.com/stacklok/frizbee/pkg/ghactions"
-	"gopkg.in/yaml.v3"
+	"github.com/stacklok/frizbee/pkg/replacer"
+	"github.com/stacklok/frizbee/pkg/utils/config"
 
 	engif "github.com/stacklok/minder/internal/engine/interfaces"
 )
@@ -358,22 +358,19 @@ func ListGithubActions(res *engif.Result) func(*rego.Rego) {
 			}
 
 			var terms []*ast.Term
-			err := frizgh.TraverseGitHubActionWorkflows(res.Fs, base, func(_ string, wflow *yaml.Node) error {
-				actions, err := frizgh.ListActionsInYAML(wflow)
-				if err != nil {
-					return err
-				}
-
-				for _, a := range actions {
-					terms = append(terms, ast.StringTerm(a.Action))
-				}
 
-				return nil
-			})
+			// Parse the ingested file system and extract all action references
+			r := replacer.NewGitHubActionsReplacer(&config.Config{})
+			actions, err := r.ListPathInFS(res.Fs, base)
 			if err != nil {
 				return nil, err
 			}
 
+			// Save the action names
+			for _, a := range actions.Entities {
+				terms = append(terms, ast.StringTerm(a.Name))
+			}
+
 			return ast.SetTerm(terms...), nil
 		},
 	)