From a2ec64d92e5a6529b9eea50396136c8a0f6e8220 Mon Sep 17 00:00:00 2001 From: jmeridth Date: Wed, 7 Oct 2026 18:28:39 -0500 Subject: [PATCH 1/2] feat: accept both .yml and .yaml Security Insights filenames What/Why The spec now accepts security-insights.yaml as well as .yml. SecurityInsightsFilenames() returns both, .yml first, so consumers such as the OSPS Baseline scanner can find either. SecurityInsightsFilename is deprecated. Proof it works New TestSecurityInsightsFilenames. go test, golangci-lint, and make covcheck (76.5%) pass. Risk Low. Additive. The deprecated constant is unchanged. AI role Drafted by Claude Opus 5.5 and reviewed by the maintainer, who chose the function shape and the deprecation. Review focus The .yml-first order, which consumers rely on to fall back to .yml when both files exist. Signed-off-by: jmeridth --- CHANGELOG.md | 10 ++++++++++ v2/si/security_insights.go | 9 +++++++++ v2/si/security_insights_test.go | 11 +++++++++++ 3 files changed, 30 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 21afa40..7b4c6c8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,15 @@ # Changelog +## Unreleased + +### Features + +- `SecurityInsightsFilenames()` returns both accepted names, `security-insights.yml` and `security-insights.yaml`, matching the spec + +### Deprecations + +- `SecurityInsightsFilename` names only the `.yml` file. Use `SecurityInsightsFilenames()` instead + ## v2.1.0 This release is made in concert with the v2.1.0 release of [Security Insights](https://github.com/ossf/security-insights-spec) diff --git a/v2/si/security_insights.go b/v2/si/security_insights.go index 594ad0a..d77f793 100644 --- a/v2/si/security_insights.go +++ b/v2/si/security_insights.go @@ -13,8 +13,17 @@ import ( ) // SecurityInsightsFilename is the expected name of the YAML file containing the insights data. See https://github.com/ossf/security-insights-spec?tab=readme-ov-file#usage for more details. +// +// Deprecated: the spec accepts both .yml and .yaml. Use SecurityInsightsFilenames. const SecurityInsightsFilename = "security-insights.yml" +// SecurityInsightsFilenames returns every name a SecurityInsights YAML file may +// use. The historical .yml name comes first, so callers that stop at the first +// match keep their current behavior. A project should keep only one of them. +func SecurityInsightsFilenames() []string { + return []string{SecurityInsightsFilename, "security-insights.yaml"} +} + func fetchParentSecurityInsights(parentUrl string) (bytes []byte, err error) { request, err := http.NewRequest("GET", parentUrl, nil) if err != nil { diff --git a/v2/si/security_insights_test.go b/v2/si/security_insights_test.go index 8719e71..aec17ab 100644 --- a/v2/si/security_insights_test.go +++ b/v2/si/security_insights_test.go @@ -125,6 +125,17 @@ func TestNewURL(t *testing.T) { }) } } + +func TestSecurityInsightsFilenames(t *testing.T) { + assert.Equal(t, []string{"security-insights.yml", "security-insights.yaml"}, SecurityInsightsFilenames()) + + t.Run("returns a fresh slice", func(t *testing.T) { + names := SecurityInsightsFilenames() + names[0] = "changed" + assert.Equal(t, "security-insights.yml", SecurityInsightsFilenames()[0]) + }) +} + func TestNewEmail(t *testing.T) { tests := []struct { name string From 193e488d472f4eac56fdcf2dbb88417f355046ee Mon Sep 17 00:00:00 2001 From: jmeridth Date: Thu, 8 Oct 2026 02:30:36 -0500 Subject: [PATCH 2/2] docs: prepare the v2.2.1 changelog What/Why Names the release v2.2.1, matching spec v2.2.0, and records the in-scope and out-of-scope loading fix from #71. Proof it works Docs only. Risk Low. The bug fix entry describes #71, which must merge before the tag. AI role Drafted by Claude Opus 5.5. The maintainer chose the version. Review focus The version number. Signed-off-by: jmeridth --- CHANGELOG.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b4c6c8..107edf2 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,6 @@ # Changelog -## Unreleased +## v2.2.1 ### Features @@ -10,6 +10,10 @@ - `SecurityInsightsFilename` names only the `.yml` file. Use `SecurityInsightsFilenames()` instead +### Bug Fixes + +- `in-scope` and `out-of-scope` load as string lists. Files that set either field no longer fail to load ([#68](https://github.com/ossf/si-tooling/issues/68)) + ## v2.1.0 This release is made in concert with the v2.1.0 release of [Security Insights](https://github.com/ossf/security-insights-spec)