What and why?

In v2.45.0, we introduced mandatory git fields for the sarif and sbom commands. That implementation missed use cases where no .git metadata is available as the returned tags object is empty (code link). Our issue arises because we're looping over this tags object where we're not guaranteed to have all the fields set by default.

No .git exists, but the user sets the following environment variables:

export DD_GIT_REPOSITORY_URL = 'github.com/foo/bar'
export DD_GIT_BRANCH = 'main'
export DD_GIT_COMMIT_AUTHOR_EMAIL = 'test@test.com'
export DD_GIT_COMMIT_AUTHOR_NAME = 'tester'
export DD_GIT_COMMIT_COMMITTER_EMAIL = 'test@test.com'
export DD_GIT_COMMIT_COMMITTER_NAME = 'tester'

This would create this tags object:

{
  "git.repository_url": "github.com/foo/bar",
  "git.branch": "main",
  "git.commit.author.email": "test@test.com",
  "git.commit.author.name": "tester",
  "git.commit.committer.email": "test@test.com",
  "git.commit.committer.name": "tester"
}

When we iterate over this object we missed checking whether git.commit.sha is there and valid.

How?

Iterate over each required git field and check whether they exists in the final tags object to ensure we're checking all requirements each time.

Review checklist

• Feature or bugfix MUST have appropriate tests (unit, integration)