mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
127 lines
3.8 KiB
Python
127 lines
3.8 KiB
Python
import fnmatch
|
|
import os
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
SECURITY_WORKFLOW_PATH = REPO_ROOT / ".github" / "workflows" / "security-codeql.yml"
|
|
|
|
# Directories skipped when walking the repository
|
|
SKIP_DIRS = {
|
|
".git",
|
|
".venv",
|
|
"venv",
|
|
"__pycache__",
|
|
"node_modules",
|
|
".tox",
|
|
"build",
|
|
"dist",
|
|
}
|
|
|
|
# Hidden directories that may contain real source files for CodeQL
|
|
SCANNED_HIDDEN_DIRS = {
|
|
".github",
|
|
}
|
|
|
|
# Mapping: CodeQL language name -> filename patterns
|
|
CODEQL_FILENAME_INDICATORS: dict[str, list[str]] = {
|
|
"c-cpp": ["*.c", "*.cc", "*.cpp", "*.cxx", "*.h", "*.hh", "*.hpp", "*.hxx"],
|
|
"csharp": ["*.cs"],
|
|
"go": ["*.go"],
|
|
"java-kotlin": ["*.java", "*.kt", "*.kts"],
|
|
"javascript-typescript": ["*.js", "*.jsx", "*.ts", "*.tsx", "*.mjs", "*.cjs"],
|
|
"python": ["*.py"],
|
|
"ruby": ["*.rb"],
|
|
"rust": ["*.rs"],
|
|
"swift": ["*.swift"],
|
|
}
|
|
|
|
# Mapping: CodeQL language name -> repository-relative path patterns
|
|
CODEQL_PATH_INDICATORS: dict[str, list[str]] = {
|
|
"actions": [
|
|
".github/workflows/*.yml",
|
|
".github/workflows/*.yaml",
|
|
"action.yml",
|
|
"action.yaml",
|
|
],
|
|
}
|
|
|
|
|
|
def _load_active_languages() -> set[str]:
|
|
with open(SECURITY_WORKFLOW_PATH) as fh:
|
|
data = yaml.safe_load(fh)
|
|
|
|
include = data["jobs"]["analyze"]["strategy"]["matrix"]["include"]
|
|
return {
|
|
entry["language"]
|
|
for entry in include
|
|
if isinstance(entry, dict) and "language" in entry
|
|
}
|
|
|
|
|
|
def _matching_languages(rel_file: str, filename: str) -> set[str]:
|
|
matched = {
|
|
language
|
|
for language, patterns in CODEQL_FILENAME_INDICATORS.items()
|
|
if any(fnmatch.fnmatch(filename, pattern) for pattern in patterns)
|
|
}
|
|
matched.update(
|
|
language
|
|
for language, patterns in CODEQL_PATH_INDICATORS.items()
|
|
if any(fnmatch.fnmatch(rel_file, pattern) for pattern in patterns)
|
|
)
|
|
return matched
|
|
|
|
|
|
class TestSecurityWorkflowCoverage(unittest.TestCase):
|
|
def test_codeql_languages_match_repository_content(self):
|
|
"""The CodeQL workflow must only enable languages that are actually
|
|
present in the repository, and it must not miss any detected language."""
|
|
|
|
detected_languages: set[str] = set()
|
|
|
|
for dirpath, dirnames, filenames in os.walk(REPO_ROOT):
|
|
dirnames[:] = [
|
|
d
|
|
for d in dirnames
|
|
if d not in SKIP_DIRS
|
|
and (not d.startswith(".") or d in SCANNED_HIDDEN_DIRS)
|
|
]
|
|
|
|
rel_dir = os.path.relpath(dirpath, REPO_ROOT)
|
|
rel_dir = "" if rel_dir == "." else rel_dir
|
|
|
|
for filename in filenames:
|
|
rel_file = os.path.join(rel_dir, filename) if rel_dir else filename
|
|
detected_languages.update(_matching_languages(rel_file, filename))
|
|
|
|
active_languages = _load_active_languages()
|
|
missing_languages = sorted(detected_languages - active_languages)
|
|
extra_languages = sorted(active_languages - detected_languages)
|
|
|
|
problems: list[str] = []
|
|
if missing_languages:
|
|
problems.append(
|
|
"Detected languages missing from .github/workflows/security-codeql.yml:"
|
|
)
|
|
problems.extend(f" - {language}" for language in missing_languages)
|
|
|
|
if extra_languages:
|
|
problems.append(
|
|
"Active CodeQL languages without matching repository files:"
|
|
)
|
|
problems.extend(f" - {language}" for language in extra_languages)
|
|
|
|
if problems:
|
|
self.fail(
|
|
"The CodeQL workflow matrix does not match the repository content.\n"
|
|
"Enable missing languages or comment out inactive ones.\n\n"
|
|
+ "\n".join(problems)
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|