Add support for OpenSSF Security Insights v2

clomonitor-core/Cargo.toml

@@ -33,4 +33,5 @@ tracing = { workspace = true }
 which = { workspace = true }
 
 [dev-dependencies]
+tempfile = { workspace = true }
 wiremock = { workspace = true }

clomonitor-core/src/linter/checks/datasource/github/mod.rs

@@ -95,7 +95,7 @@ pub(crate) fn build_url(path: &Path, owner: &str, repo: &str, branch: &str) -> S
         owner,
         repo,
         branch,
-        path.to_string_lossy(),
+        path_to_url(path),
     )
 }
 
@@ -257,6 +257,17 @@ fn get_owner_and_repo(repo_url: &str) -> Result<(String, String)> {
     Ok((c["org"].to_string(), c["repo"].to_string()))
 }
 
+/// Serialize a repository path using URL separators.
+fn path_to_url(path: &Path) -> String {
+    path.components()
+        .filter_map(|component| match component {
+            std::path::Component::Normal(part) => Some(part.to_string_lossy()),
+            _ => None,
+        })
+        .collect::<Vec<_>>()
+        .join("/")
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -275,6 +286,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn build_url_works_with_nested_paths() {
+        assert_eq!(
+            build_url(
+                Path::new(".github").join("security-insights.yml").as_path(),
+                "owner",
+                "repo",
+                "main"
+            ),
+            "https://github.com/owner/repo/blob/main/.github/security-insights.yml".to_string()
+        );
+    }
+
     #[test]
     fn default_branch_some() {
         let r = MdRepositoryDefaultBranchRef {