Skip to content

chore(deps): bump privateer-sdk to v1.33.2 - #475

Merged
eddie-knight merged 1 commit into
ossf:mainfrom
eddie-knight:chore/bump-privateer-sdk-1.33.2
Sep 8, 2026
Merged

chore(deps): bump privateer-sdk to v1.33.2#475
eddie-knight merged 1 commit into
ossf:mainfrom
eddie-knight:chore/bump-privateer-sdk-1.33.2

Conversation

@eddie-knight

@eddie-knight eddie-knight commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator

Picks up the fix that makes a published EvaluationLog readable

Picks up the fix that makes a published EvaluationLog readable. Through
go-gemara v0.9.2 an assessment step marshalled to its function name but had no
unmarshaler, so no log this plugin published could be decoded again — grc.store
rejected every one at ingest with

  cannot unmarshal string into ... .steps of type gemara.AssessmentStep

go-gemara v0.10.0 (gemaraproj/go-gemara#129) gives AssessmentStep a decoder and
adds NamedStep; privateer-sdk v1.33.2 (privateerproj/privateer-sdk#298) wraps the
typed-step adapter in it. This plugin registers through
AddEvaluationSuiteTypedForAllCatalogs (main.go:92), so both land here with no
source change: the SDK's adapter closure no longer erases the step symbol, and
results carry names like

  github.com/ossf/pvtr-github-repo-scanner/evaluation_plans/reusable_steps.IsActive

in place of pluginkit.adaptTypedSteps[...].func1.

go-gemara moves v0.9.2 -> v0.10.0 as a transitive requirement of the SDK; the
rest of the go.mod churn is `go mod tidy`. Both replace directives stay
commented out.

Verified with the released modules (GOWORK=off, no workspace resolution):
go build, go vet, gofmt and `make test` all clean.

Signed-off-by: Eddie Knight <knight@linux.com>
@eddie-knight
eddie-knight merged commit 54aec19 into ossf:main Sep 8, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants