feat(pipeline): Support GitHub Actions commit enumeration

[Dwdr]

Overview

Adds automated Git commit enumeration support for the GitHub Actions ecosystem within the OSV worker pipeline (go/internal/worker/pipeline/githubactions/).

Fixes #6013

Details

Currently, GitHub Actions advisories imported into OSV only specify SEMVER or ECOSYSTEM version ranges. When workflows pin actions to immutable Git commit SHAs (as recommended by OpenSSF Scorecard), vulnerability scanners querying OSV by commit SHA cannot match these advisories.

This pull request implements:

1. Repository Extraction (ExtractGitHubRepoURL): Parses GitHub Action package identifiers into their canonical repository URLs (https://github.com/<owner>/<repo>), gracefully handling nested sub-action directories (e.g., docker/build-push-action/v2), leading slashes, .git suffixes, and directory traversal (..) attempts.
2. Pipeline Enricher (githubactions.Enricher): Inspects vulnerability records affecting the GitHub Actions ecosystem. For each affected package, it extracts the repository URL and injects companion Range_GIT ranges duplicating the version events (introduced / fixed / last_affected).
3. Downstream Gitter Activation: Because OSV's worker engine already inspects Range_GIT ranges and queries the Gitter service, injecting companion Range_GIT ranges automatically enumerates intermediate commits and tags into affected.versions with zero changes required to Gitter or the core engine.
4. Idempotency & Safety: Duplicate runs of Enrich do not duplicate existing Range_GIT entries, and events are deep-copied to prevent shared pointer mutation.
5. Registry Integration: Registers &githubactions.Enricher{} in internal/worker/pipeline/registry/registry.go.

Testing

• Added 25 table-driven unit tests in go/internal/worker/pipeline/githubactions/githubactions_test.go covering URL canonicalization, sub-action normalization, malicious path handling, SEMVER/ECOSYSTEM range companion generation, non-GitHub Actions filtering, and idempotency.
• Ran all unit tests concurrently with the Go data race detector:
  go test -race -v ./internal/worker/pipeline/githubactions/... (100% PASS).
• Verified code formatting and vetting:
  gofmt -s -d (0 diffs).
  go vet ./internal/worker/pipeline/githubactions/... (0 warnings).
• Cleaned up all linter checks (stringscutprefix, nlreturn, and protogetter protobuf accessor compliance).

[Dwdr]

/gemini review

[G-Rath]

Please read our contributing guide before opening pull requests

[Dwdr]

Apologies @G-Rath ! I missed the issue creation step.

I have opened a tracking issue #6013 per the contributing guide 🙏

[michaelkedar]

Thanks for working on this!

[michaelkedar]

nit: strings.Contains(owner, "..") does cover owner == "..", so we could make this if statement a bit shorter

[Dwdr]

Thanks for the suggestion! I simplified the traversal and removed owner == ".." , repo == ".."

[michaelkedar]

We actually need to convert these from version strings to git commit SHAs ("introduced": "0", "fixed": "123abcdef....").
We have a GetTags method on the Gitter client which should return the list of tags and commits - you should be able to create and add the Gitter client to the EnrichParams to use it.

I think you'll still need to do some form of normalisation of the git tags to match the version - a quick look at some of the Github Actions repos is that the tags often have a leading v that would need to be stripped. I'm not too sure if any other normalization is necessary, but there is some more thorough logic somewhere in vulnfeeds that might be useful reference if needed.

[Dwdr]

I see! Got it, I

• added GitterClient to EnrichParams and used GetTags to resolve boundary tags to commit hashes, with in-memory caching per repo
• Handled tag normalization similar to the vulnfeeds logic (thank you for the reference!)
• Unresolved tags will be skipped gracefully without failing the pipeline
• Added unit tests with a mock Gitter client

[michaelkedar]

nit: we could use this constant from osv-schema/bindings/go/osvconstants

[Dwdr]

Got it! I removed the local constant and replaced it with string(osvconstants.EcosystemGitHubActions) from osv-schema/bindings/go/osvconstants, thank you for pointing that out! Didn't see the constant there