Skip to content

Commit 64edfd0

Browse files
varunsh-codervarunsh-coder
authored
Merge pull request #2511 from step-security/bug/addHardenRunner
fix: bug secure-repo parsing
2 parents cea4ccb + fcd7381 commit 64edfd0

File tree

4 files changed

+144
-1
lines changed

4 files changed

+144
-1
lines changed

‎remediation/workflow/hardenrunner/addaction.go

+3-1
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,9 @@ func addAction(inputYaml, jobName, action string) (string, error) {
6161
return "", fmt.Errorf("unable to parse yaml %v", err)
6262
}
6363

64-
jobNode := permissions.IterateNode(&t, jobName, "!!map", 0)
64+
jobNode := permissions.IterateNode(&t, "jobs", "!!map", 0)
65+
66+
jobNode = permissions.IterateNode(&t, jobName, "!!map", jobNode.Line)
6567

6668
jobNode = permissions.IterateNode(&t, "steps", "!!seq", jobNode.Line)
6769

‎remediation/workflow/hardenrunner/addaction_test.go

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ func TestAddAction(t *testing.T) {
2525
{name: "already present", args: args{inputYaml: "alreadypresent.yml", action: "step-security/harden-runner@v2"}, want: "alreadypresent.yml", wantErr: false, wantUpdated: true},
2626
{name: "already present 2", args: args{inputYaml: "alreadypresent_2.yml", action: "step-security/harden-runner@v2"}, want: "alreadypresent_2.yml", wantErr: false, wantUpdated: false},
2727
{name: "reusable job", args: args{inputYaml: "reusablejob.yml", action: "step-security/harden-runner@v2"}, want: "reusablejob.yml", wantErr: false, wantUpdated: false},
28+
{name: "job name in input", args: args{inputYaml: "jobNameInInput.yml", action: "step-security/harden-runner@v2"}, want: "jobNameInInput.yml", wantErr: false, wantUpdated: true},
2829
}
2930
for _, tt := range tests {
3031
t.Run(tt.name, func(t *testing.T) {

‎testfiles/addaction/input/jobNameInInput.yml

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
name: coveo-example-library
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'coveo-example-library/**'
9+
- '!**.lock'
10+
- '!**.md'
11+
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
paths:
15+
- 'coveo-example-library/**'
16+
- '.github/workflows/coveo-example-library.yml'
17+
- '!**.md'
18+
19+
workflow_dispatch:
20+
inputs:
21+
publish:
22+
description: "Publish to pypi.org?"
23+
required: false
24+
default: 'false'
25+
26+
jobs:
27+
pyprojectci:
28+
name: pyproject ci
29+
runs-on: ${{ matrix.os }}
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
python-version: ["3.8", "3.10"]
35+
os: [ubuntu-latest, windows-latest, macos-latest]
36+
37+
steps:
38+
- name: Run stew ci
39+
uses: coveo/stew@main
40+
with:
41+
project-name: ${{ github.workflow }}
42+
python-version: ${{ matrix.python-version }}
43+
poetry-version: "<2"
44+
45+
publish:
46+
name: Publish to pypi.org
47+
runs-on: ubuntu-20.04
48+
needs: pyprojectci
49+
50+
steps:
51+
- name: Checkout repository
52+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
53+
54+
- name: Setup python 3.9
55+
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
56+
with:
57+
python-version: 3.9
58+
59+
- name: Publish to pypi
60+
uses: ./.github/workflows/actions/publish-to-pypi
61+
with:
62+
project-name: ${{ github.workflow }}
63+
pypi-token: ${{ secrets.PYPI_TOKEN_COVEO_EXAMPLE_LIBRARY }}
64+
pre-release: ${{ github.ref != 'refs/heads/main' }}
65+
dry-run: true

‎testfiles/addaction/output/jobNameInInput.yml

+75
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
name: coveo-example-library
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'coveo-example-library/**'
9+
- '!**.lock'
10+
- '!**.md'
11+
12+
pull_request:
13+
types: [opened, synchronize, reopened]
14+
paths:
15+
- 'coveo-example-library/**'
16+
- '.github/workflows/coveo-example-library.yml'
17+
- '!**.md'
18+
19+
workflow_dispatch:
20+
inputs:
21+
publish:
22+
description: "Publish to pypi.org?"
23+
required: false
24+
default: 'false'
25+
26+
jobs:
27+
pyprojectci:
28+
name: pyproject ci
29+
runs-on: ${{ matrix.os }}
30+
31+
strategy:
32+
fail-fast: false
33+
matrix:
34+
python-version: ["3.8", "3.10"]
35+
os: [ubuntu-latest, windows-latest, macos-latest]
36+
37+
steps:
38+
- name: Harden the runner (Audit all outbound calls)
39+
uses: step-security/harden-runner@v2
40+
with:
41+
egress-policy: audit
42+
43+
- name: Run stew ci
44+
uses: coveo/stew@main
45+
with:
46+
project-name: ${{ github.workflow }}
47+
python-version: ${{ matrix.python-version }}
48+
poetry-version: "<2"
49+
50+
publish:
51+
name: Publish to pypi.org
52+
runs-on: ubuntu-20.04
53+
needs: pyprojectci
54+
55+
steps:
56+
- name: Harden the runner (Audit all outbound calls)
57+
uses: step-security/harden-runner@v2
58+
with:
59+
egress-policy: audit
60+
61+
- name: Checkout repository
62+
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
63+
64+
- name: Setup python 3.9
65+
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2.3.4
66+
with:
67+
python-version: 3.9
68+
69+
- name: Publish to pypi
70+
uses: ./.github/workflows/actions/publish-to-pypi
71+
with:
72+
project-name: ${{ github.workflow }}
73+
pypi-token: ${{ secrets.PYPI_TOKEN_COVEO_EXAMPLE_LIBRARY }}
74+
pre-release: ${{ github.ref != 'refs/heads/main' }}
75+
dry-run: true

0 commit comments

Comments
 (0)