poutine/opa/rego/rules/if_always_true.rego at main · alexandear-org/poutine · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
# METADATA
# title: If condition always evaluates to true
# description: |-
#   GitHub Actions expressions used in if condition of jobs or steps
#   must not contain extra characters or spaces.
#   Otherwise, the condition is always true.
# custom:
#   level: error
package rules.if_always_true

import data.poutine
import rego.v1

rule := poutine.rule(rego.metadata.chain())

results contains poutine.finding(rule, pkg.purl, meta) if {
	pkg := input.packages[_]
	meta := if_conditions[pkg.purl][_]
}

always_true(cond) if {
	contains(cond, "${{")
	not startswith(cond, "${{")
} else if {
	contains(cond, "${{")
	not endswith(cond, "}}")
} else if {
	contains(cond, "${{")
	count(split(cond, "${{")) > 2
}

if_conditions[pkg.purl] contains {
	"path": workflow.path,
	"line": object.get(job.lines, "if", 0),
	"job": job.id,
	"event_triggers": [event | event := workflow.events[j].name],
} if {
	pkg := input.packages[_]
	workflow = pkg.github_actions_workflows[_]
	job := workflow.jobs[_]
	cond := object.get(job, "if", "")

	always_true(cond)
}

if_conditions[pkg.purl] contains {
	"path": workflow.path,
	"line": object.get(step.lines, "if", 0),
	"job": job.id,
	"step": step_id,
	"event_triggers": [event | event := workflow.events[j].name],
} if {
	pkg := input.packages[_]
	workflow = pkg.github_actions_workflows[_]
	job := workflow.jobs[_]
	step := job.steps[step_id]
	cond := object.get(step, "if", "")

	always_true(cond)
}

if_conditions[pkg.purl] contains {
	"path": action.path,
	"line": object.get(step.lines, "if", 0),
	"step": step_id,
} if {
	pkg := input.packages[_]
	action = pkg.github_actions_metadata[_]
	step := action.runs.steps[step_id]
	cond := object.get(step, "if", "")

	always_true(cond)
}