Support Parallel Workflow Steps + More Lenient Parsing (#445)

* making parser more lenient so we don';t lose data when parsing
* flattening parallel steps so we can run our existing rego rules without change

Author: SUSTAPLE117

models/github_actions.go

@@ -114,6 +114,10 @@ type GithubActionsStep struct {
 	Line             int               `json:"line" yaml:"-"`
 	Action           string            `json:"action,omitempty" yaml:"-"`
 
+	// Set when the step comes from a flattened `parallel:` block (steps that
+	// run concurrently). No order index: parallel steps have no defined order.
+	Parallel bool `json:"parallel,omitempty" yaml:"-"`
+
 	Lines map[string]int `json:"lines" yaml:"-"`
 }
 
@@ -216,7 +220,7 @@ func (o GithubActionsMetadata) IsValid() bool {
 
 func (o *GithubActionsJobs) UnmarshalYAML(node *yaml.Node) error {
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for jobs")
+		return nil
 	}
 
 	*o = make(GithubActionsJobs, 0, len(node.Content)/2)
@@ -233,7 +237,8 @@ func (o *GithubActionsJobs) UnmarshalYAML(node *yaml.Node) error {
 		}
 		err := value.Decode(&job)
 		if err != nil {
-			return err
+			// Skip the offending job, keep the rest of the workflow.
+			continue
 		}
 
 		for j := 0; j < len(value.Content); j += 2 {
@@ -261,7 +266,7 @@ func (o *GithubActionsJobSecrets) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for secrets")
+		return nil
 	}
 
 	for i := 0; i < len(node.Content); i += 2 {
@@ -280,13 +285,15 @@ func (o *StringList) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	if node.Kind != yaml.SequenceNode {
-		return fmt.Errorf("invalid yaml node type %v for string list", node.Kind)
+		// Lenient: unexpected shapes leave an empty list rather than failing
+		// the entire workflow parse.
+		return nil
 	}
 
-	var l []string = make([]string, len(node.Content))
+	l := make([]string, len(node.Content))
 	err := node.Decode(&l)
 	if err != nil {
-		return err
+		return nil
 	}
 
 	*o = l
@@ -319,20 +326,23 @@ func (o *GithubActionsEvents) UnmarshalYAML(node *yaml.Node) error {
 
 				err := value.Decode(&crons)
 				if err != nil {
-					return err
+					// Skip a malformed schedule block, keep other events.
+					continue
 				}
 
 				for _, c := range crons {
 					if c.Cron == "" {
-						return fmt.Errorf("invalid cron object")
+						// Skip empty/invalid cron entries individually.
+						continue
 					}
 
 					event.Cron = append(event.Cron, c.Cron)
 				}
 			} else {
 				err := value.Decode(&event)
 				if err != nil {
-					return err
+					// Skip the offending event, keep the rest.
+					continue
 				}
 			}
 
@@ -345,7 +355,7 @@ func (o *GithubActionsEvents) UnmarshalYAML(node *yaml.Node) error {
 
 func (o *GithubActionsOutputs) UnmarshalYAML(node *yaml.Node) error {
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for outputs")
+		return nil
 	}
 
 	for i := 0; i < len(node.Content); i += 2 {
@@ -360,7 +370,8 @@ func (o *GithubActionsOutputs) UnmarshalYAML(node *yaml.Node) error {
 			output = GithubActionsOutput{Name: name}
 			err := value.Decode(&output)
 			if err != nil {
-				return err
+				// Skip the offending output, keep the rest.
+				continue
 			}
 			*o = append(*o, output)
 		}
@@ -372,7 +383,7 @@ func (o *GithubActionsOutputs) UnmarshalYAML(node *yaml.Node) error {
 
 func (o *GithubActionsInputs) UnmarshalYAML(node *yaml.Node) error {
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for inputs")
+		return nil
 	}
 
 	for i := 0; i < len(node.Content); i += 2 {
@@ -382,7 +393,8 @@ func (o *GithubActionsInputs) UnmarshalYAML(node *yaml.Node) error {
 		err := value.Decode(&input)
 
 		if err != nil {
-			return err
+			// Skip the offending input, keep the rest.
+			continue
 		}
 
 		*o = append(*o, input)
@@ -400,7 +412,7 @@ func (o *GithubActionsEnvs) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for env")
+		return nil
 	}
 
 	for i := 0; i < len(node.Content); i += 2 {
@@ -412,6 +424,48 @@ func (o *GithubActionsEnvs) UnmarshalYAML(node *yaml.Node) error {
 	return nil
 }
 
+func (o *GithubActionsSteps) UnmarshalYAML(node *yaml.Node) error {
+	// Be lenient: a single malformed step should only drop that step, not the
+	// whole job (and therefore not the whole workflow file).
+	if node.Kind != yaml.SequenceNode {
+		return nil
+	}
+
+	for _, item := range node.Content {
+		// flatten parallel steps
+		if p := mappingValue(item, "parallel"); p != nil {
+			var nested GithubActionsSteps
+			_ = p.Decode(&nested) // recurses; handles nested parallel
+			for k := range nested {
+				nested[k].Parallel = true
+			}
+			*o = append(*o, nested...)
+			continue
+		}
+
+		var step GithubActionsStep
+		if err := item.Decode(&step); err != nil {
+			continue
+		}
+		*o = append(*o, step)
+	}
+
+	return nil
+}
+
+// mappingValue returns the value node for key in a mapping node, or nil.
+func mappingValue(node *yaml.Node, key string) *yaml.Node {
+	if node.Kind != yaml.MappingNode {
+		return nil
+	}
+	for i := 0; i+1 < len(node.Content); i += 2 {
+		if node.Content[i].Value == key {
+			return node.Content[i+1]
+		}
+	}
+	return nil
+}
+
 func (o *GithubActionsStep) UnmarshalYAML(node *yaml.Node) error {
 	type Alias GithubActionsStep
 	t := Alias{
@@ -467,7 +521,9 @@ func (o *GithubActionsPermissions) UnmarshalYAML(node *yaml.Node) error {
 		case "read-all":
 			permission = PermissionRead
 		default:
-			return fmt.Errorf("invalid permission %s", node.Value)
+			// Unknown scalar (e.g. a typo): leave permissions empty rather
+			// than failing the whole workflow parse.
+			return nil
 		}
 
 		*o = make(GithubActionsPermissions, 0, len(AllScopes))
@@ -478,7 +534,7 @@ func (o *GithubActionsPermissions) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for permissions")
+		return nil
 	}
 
 	*o = make(GithubActionsPermissions, 0, len(node.Content)/2)
@@ -497,7 +553,7 @@ func (o *GithubActionsJobRunsOn) UnmarshalYAML(node *yaml.Node) error {
 		var runsOn StringList
 		err := node.Decode(&runsOn)
 		if err != nil {
-			return err
+			return nil
 		}
 		*o = GithubActionsJobRunsOn(runsOn)
 	}
@@ -510,18 +566,19 @@ func (o *GithubActionsJobRunsOn) UnmarshalYAML(node *yaml.Node) error {
 		var runsOn RunsOn
 		err := node.Decode(&runsOn)
 		if err != nil {
-			return err
+			return nil
 		}
 		for _, group := range runsOn.Group {
 			if group == "" {
-				return fmt.Errorf("unexpected empty group")
+				// Skip empty entries individually instead of failing.
+				continue
 			}
 			*o = append(*o, fmt.Sprintf("group:%s", group))
 		}
 
 		for _, label := range runsOn.Labels {
 			if label == "" {
-				return fmt.Errorf("unexpected empty label")
+				continue
 			}
 			*o = append(*o, fmt.Sprintf("label:%s", label))
 		}
@@ -540,7 +597,8 @@ func (o *GithubActionsJobContainer) UnmarshalYAML(node *yaml.Node) error {
 	var c container
 	err := node.Decode(&c)
 	if err != nil {
-		return err
+		// Lenient: leave the container empty rather than failing the parse.
+		return nil
 	}
 	*o = GithubActionsJobContainer(c)
 	return nil
@@ -553,13 +611,13 @@ func (o *GithubActionsJobEnvironments) UnmarshalYAML(node *yaml.Node) error {
 	}
 
 	if node.Kind != yaml.MappingNode {
-		return fmt.Errorf("invalid yaml node type for environment")
+		return nil
 	}
 
 	var env GithubActionsJobEnvironment
 	err := node.Decode(&env)
 	if err != nil {
-		return err
+		return nil
 	}
 
 	*o = GithubActionsJobEnvironments{env}