finos/git-proxy

I scanned GitProxy using AI based on the most recent OSPS Baseline criteria. Fortunately, the project adheres completely to Level 1, and mostly hits all the notes on Level 2 (the "MUST" criteria). Here are the missing criteria, all of them from Level 3 (note that I excluded false positives): Level 3 OSPS-DO-03.01 — No consumer instructions to verify integrity or authenticity of release assets. OSPS-DO-03.02 — No instructions to verify the identity of the person or process that authored a release. OSPS-DO-05.01 — No statement of when a release line stops receiving security updates. OSPS-QA-02.02 — Releases are not shipped with an SBOM (no CycloneDX/SPDX generation in release workflows). OSPS-SA-03.02 — No threat model or attack-surface analysis document. OSPS-VM-04.02 — No VEX documents for dependency vulnerabilities that do not affect GitProxy. OSPS-VM-05.01 — No documented SCA remediation threshold (tools encode fail-on-severity: high, but that is not a project policy)

Is your feature request related to a problem? Please describe. Right now, getDiff stores the diff as content in a step via step.setContent, making the diff harder to fetch from plugins (as of the plugin revamp #1683) and subsequent actions like scanDiff: ... step.log(`Executing "git diff ${commitFrom} ${action.commitTo}" in ${path}`); const revisionRange = `${commitFrom}..${action.commitTo}`; const diff = await git.diff([revisionRange]); step.log(diff); step.setContent(diff); } catch (error: unknown) { const msg = getErrorMessage(error); step.setError(msg); } finally { action.addStep(step); } return action; Describe the solution you'd like Refactor getDiff so that adding the diff as content isn't necessary. We might need to look into why it was done this way in the first place. If we need to keep it as step content, we can just store the diff regardless via action.diff = diff, and then refactor any usages to use that instead. Additional context R

Is your feature request related to a problem? Please describe. In #1626, we added deprecation warnings for legacy config fields such as sslKeyPemPath, sslCertPemPath and proxyUrl. However, the checks are baked into src/config/deprecatedFields.ts. We can make this cleaner and more extensible by picking up deprecated fields from config.schema.json and keeping it as the source-of-truth. Describe the solution you'd like Fix getDeprecatedConfigWarnings() to pull the deprecated status from schema.config.json and use that to generate the warnings. Perhaps we could add x-deprecated-replacement to the schema so users how to replace the deprecated fields. Additional context Mentioned in #1629 and #1665, original PR #1626, related issue #1545

Cypress is blocked internally so I am struggling to run the e2e tests when pushing changes. Playwright is the approved way to run these tests.

As of #1637, users can see the step currently being executed when running git push, which isn't very valuable in itself: git-proxy-sideband-streaming-demo.mp4 We could extend this to print out some of what we're logging with step.log, though that makes me wonder just how verbose we want the live feedback to be. Only basic logging for step name + errors on failed steps? Optional verbose flag for showing more detailed progress? Describe the solution you'd like Logs that are more useful than what's been done in #1637.