Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(github): Fix GHA IR resource names in case of 2 identical images #4108

Merged
merged 3 commits into from
Dec 19, 2022
Merged

fix(github): Fix GHA IR resource names in case of 2 identical images #4108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
72ce388
fix gha ir resource names
Dec 19, 2022
3c8b9e9
fix fixture
Dec 19, 2022
5487cf0
iterate only over lines after jobs start line
Dec 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion checkov/github_actions/image_referencer/provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,8 @@ def extract_images_from_workflow(self) -> list[Image]:

elif isinstance(container, str):
image = container
start_line = [line_number for line_number, line in self.workflow_line_numbers if image in line][0]
start_line = [line_number for line_number, line in
self.workflow_line_numbers[job_object[START_LINE]:] if image in line][0]
end_line = start_line + 1

if image:
Expand Down
128 changes: 128 additions & 0 deletions tests/github_actions/image_referencer/conftest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,134 @@ def workflow_without_images() -> dict[str, Any]:
"__endline__": 21
}

@pytest.fixture
def workflow_line_numbers_with_two_identical_images() -> list[tuple[int, str]]:
return [(1, 'name: Name\n'),
(2, 'on:\n'),
(3, ' workflow_dispatch:\n'),
(4, ' inputs:\n'),
(5, ' logLevel:\n'),
(6, " description: 'Log level'\n"),
(7, '\n'),
(8, 'jobs:\n'),
(9, ' first_job:\n'),
(10, ' runs-on: ubuntu-latest\n'),
(11, ' name: Name\n'),
(12, ' container: node:14.16\n'),
(13, ' steps:\n'),
(14, ' - name: Checkout codebase\n'),
(15, ' uses: actions/checkout@v3\n'),
(16, ' - name: infrastructure\n'),
(17, ' working-directory: terraform\n'),
(18, ' shell: bash\n'),
(19, ' env:\n'),
(20, ' TF_INPUT: 0\n'),
(21, ' run: |\n'),
(22, ' terragrunt init\n'),
(23, ' terragrunt destroy -auto-approve -var-file devl.tfvars\n'),
(24, ' second_job:\n'),
(25, ' runs-on: ubuntu-latest\n'),
(26, ' name: Name\n'),
(27, ' container: node:14.16\n'),
(28, ' steps:\n'),
(29, ' - name: Checkout codebase\n'),
(30, ' uses: actions/checkout@v3\n'),
(31, ' - name: infrastructure\n'),
(32, ' working-directory: terraform\n'),
(33, ' shell: bash\n'),
(34, ' env:\n'),
(35, ' TF_INPUT: 0\n'),
(36, ' run: |\n'),
(37, ' terragrunt init\n'),
(38, ' terragrunt destroy -auto-approve -var-file devl.tfvars\n')
]


@pytest.fixture
def workflow_with_two_identical_images() -> dict[str, Any]:
return {
"name": "Name",
"on": {
"workflow_dispatch": {
"inputs": {
"logLevel": {
"description": "Log level",
"__startline__": 6,
"__endline__": 8
},
"__startline__": 5,
"__endline__": 8
},
"__startline__": 4,
"__endline__": 8
},
"__startline__": 3,
"__endline__": 8
},
"jobs": {
"first_job": {
"runs-on": "ubuntu-latest",
"name": "Name",
"container": "node:14.16",
"steps": [
{
"name": "Checkout codebase",
"uses": "actions/checkout@v3",
"__startline__": 14,
"__endline__": 16
},
{
"name": "infrastructure",
"working-directory": "terraform",
"shell": "bash",
"env": {
"TF_INPUT": 0,
"__startline__": 20,
"__endline__": 21
},
"run": "terragrunt init\nterragrunt destroy -auto-approve -var-file devl.tfvars\n",
"__startline__": 16,
"__endline__": 24
}
],
"__startline__": 10,
"__endline__": 24
},
"second_job": {
"runs-on": "ubuntu-latest",
"name": "Name",
"container": "node:14.16",
"steps": [
{
"name": "Checkout codebase",
"uses": "actions/checkout@v3",
"__startline__": 29,
"__endline__": 31
},
{
"name": "infrastructure",
"working-directory": "terraform",
"shell": "bash",
"env": {
"TF_INPUT": 0,
"__startline__": 35,
"__endline__": 36
},
"run": "terragrunt init\nterragrunt destroy -auto-approve -var-file devl.tfvars\n",
"__startline__": 31,
"__endline__": 39
}
],
"__startline__": 25,
"__endline__": 39
},
"__startline__": 24,
"__endline__": 39
},
"__startline__": 1,
"__endline__": 39
}


@pytest.fixture
def workflow_line_numbers_without_image() -> list[tuple[int, str]]:
Expand Down
14 changes: 14 additions & 0 deletions tests/github_actions/image_referencer/test_github_action_provider.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,20 @@ def test_extract_images_from_workflow_no_images(workflow_without_images, workflo
assert not images


def test_extract_images_from_workflow_correct_line_numbers(workflow_with_two_identical_images,
workflow_line_numbers_with_two_identical_images):
file_path = '/.github/workflows/unsecure_command.yaml'

gha_provider = GithubActionProvider(file_path=file_path, workflow_config=workflow_with_two_identical_images,
workflow_line_numbers=workflow_line_numbers_with_two_identical_images)
images = gha_provider.extract_images_from_workflow()

assert len(images) == 2
assert images[0].start_line != images[1].start_line
assert images[0].end_line != images[1].end_line
assert images[0].related_resource_id != images[1].related_resource_id


@pytest.mark.parametrize(
"start_line,end_line,expected_key",
[
Expand Down