fixture-updater - what is this?

[fopinappb]

django-DefectDojo/.github/workflows/update-sample-data.yml

Line 25 in 9df71ad

./fixture-updater dojo/fixtures/defect_dojo_sample_data.json

Hi, what is this source-less binary under VCS?
I only see it in use here. Is it something to pull data to create fixtures? Or to load?

Can I suggest taking it off the repo and the update sample data workflow can use it via docker or download it when called?

This binary raised some eyebrowns internally and I wasn't able to justify why it's here 😄

[mtesauro]

It's a small Go binary that we wrote to update the dates in the fixtures to current so our fixtures wouldn't end up aging ungracefully like they had for years. I think we run it every quarter or maybe month - TBH, I can't remember. TBH, I prefer writing tools in Go vs something like Bash so they can't be messed with aka we know fixture-updater works as expected and it's kinda nice having that functionality solidified into a binary. Here's the last commit from running it.

It's about 250 lines of Go code. I guess we could move that code to a repo in this GH Org if people are uncomfortable with it.

I dug through Slack to find the description of what it does from the person who wrote it:

As it currently stands, fixture-updater simply performs a deep search for dates within the provided fixture. It finds the most recent date, sets that date to the current date/time, and shifts all the other dates up by the same amount. If it turns out that it's more important that the dates look new (i.e. the discovery dates that are actually displayed in the UI need to be brand new), we can change this functionality in the future

We could move that source to a repo in this GH org - it's hardly like there's anything revolutionary in that source. Maybe drop a comment to the repo in that GH Workflow yaml file.

So, let me know what you think. It was such a small and rather insignificant part of this repo I'd not though twice about it since we fixed the "dang these fixtures produce old looking data for the Community Demo server" problem we ran into when we wrote that.

[fopina]

Right, and as part of the demo server setup I guess it wouldn’t really matter for those using the project. I only noticed it because I decided to use the same sample data in our “quick dev setup” to have findings and products to work on features, rather than maintain a fixture of our own

As I looked quickly through the code I think it’s far from alarming as the only place it’s executed is a workflow that runs on demand. But, given the context of an OSS python project, it’s weird to bump into a binary in the git repo with no source or any information about it.

Wouldn’t a <1kb python script achieve the same of this 1.5mg non-transparent binary?
Was it a choice from the “go-dojo” time 😄 ?

I’d be happy to take the time to rewrite it if it helps and you all agree it would look better

[mtesauro]

I'm not opposed to it being in Python if the community feels better about it.

The only goal I had was keeping the dates in the fixtures updated so they look reasonable when they're used.

I use them in the public demo and have used them when creating training instances in the past. I think they're used in some of our GHA test but dates for those aren't all that important.

So, if you want to put in a PR to replace that Go binary with Python, that's fine by me.

[fopina]

@Maffooch I saw the first commit of the binary was yours, are you also ok with taking a swing at this?

[fopina]

Hey guys, I took codex for a spin and opened #14336 for this (after a few iterations and manual tweaking), I hope it looks good to you all 👍

[valentijnscholten]

@fopina A python rewrite would be welcome!

[fopina]

@valentijnscholten so you can welcome #14336 😃