feat: implement issue #842 — SonarCloud: GitHub Actions / dependency hardening #843
+30
−2
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -57,6 +57,34 @@ workflow_command_lines() { | |
| [ "$fail" -eq 0 ] | ||
| } | ||
|
|
||
| @test "every 'go install' in a workflow is version-pinned and S8545-exempted" { | ||
| # S8545 flags `go install` as non-lockfile-enforcing. Go has no --locked / | ||
| # --require-hashes equivalent: a pinned `@vX.Y.Z` is the reproducible install | ||
| # (verified via the Go checksum DB, sum.golang.org), so the finding is a confirmed | ||
| # false positive suppressed with an inline `# NOSONAR(githubactions:S8545)` | ||
| # marker. This guard fails loud if a new `go install` is added unpinned | ||
| # (@latest/@main) or without the marker. | ||
| local fail=0 file cmd | ||
| while IFS=$'\t' read -r file cmd || [ -n "$file" ]; do | ||
| case "$cmd" in | ||
| *"go install"*) | ||
| case "$cmd" in | ||
| *[a-zA-Z0-9_-]go\ install*) : ;; | ||
| *) | ||
| case "$cmd" in *"@v"[0-9]*) : ;; *) | ||
| echo "UNPINNED go install (needs @vX.Y.Z): ${file##*/}: $cmd"; fail=1 ;; | ||
| esac | ||
| case "$cmd" in *"NOSONAR(githubactions:S8545)"*) : ;; *) | ||
| echo "MISSING # NOSONAR(githubactions:S8545): ${file##*/}: $cmd"; fail=1 ;; | ||
| esac | ||
|
Comment on lines
+74
to
+79
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win Validate command tokens, not arbitrary line text. The checks search the complete raw line, so an unpinned command such as Proposed validation shape- case "$cmd" in *"`@v`"[0-9]*) : ;; *)
+ cmd_without_comment=${cmd%%#*}
+ if [[ "$cmd_without_comment" =~ (^|[[:space:]])go[[:space:]]+install[[:space:]]+[^[:space:]]+@v[0-9]+(\.[0-9]+){2}([[:space:]]|$) ]]; then
+ :
+ else
echo "UNPINNED go install (needs `@vX.Y.Z`): ${file##*/}: $cmd"; fail=1 ;;
- esac
+ fi🤖 Prompt for AI Agents |
||
| ;; | ||
| esac | ||
| ;; | ||
| esac | ||
|
don-petry marked this conversation as resolved.
|
||
| done < <(workflow_command_lines) | ||
| [ "$fail" -eq 0 ] | ||
| } | ||
|
|
||
| @test "each hash-locked requirements file referenced by a workflow exists" { | ||
| local fail=0 file cmd path | ||
| while IFS=$'\t' read -r file cmd || [ -n "$file" ]; do | ||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
Cover
.yamlworkflows too.workflow_command_linesonly enumerates.ymlfiles, so this “every workflow” guard will miss unpinnedgo installcommands in.yamlworkflows. Extend the helper to scan both extensions.As per coding guidelines, workflow checks must cover both
.ymland.yamlfiles.Proposed fix
🤖 Prompt for AI Agents
Source: Coding guidelines