Using separate parameter files (.json or .bicepparam) breaks the BICEP scanning

[xyl-jc]

Hi everyone,

Hope someone can help me with this.
Scanning BICEP files with parameters defined on top of the file works fine. Scan results are displayed in the "Tests" tab.
However when I want to start using a separate parameter file so I can point to different environments the PSRul for Azure fails with the following error:
##[error]Failed to expand bicep source '/home/vsts/work/1/s/deployment/main.bicep'. Exception calling "GetBicepResources" with "2" argument(s): "Unable to expand resources because the source file '/home/vsts/work/1/s/deployment/main.bicep' was not valid. An error occurred evaluating expression '[format('module-{0}', parameters('storageAccountName'))]' line 28. The parameter named 'storageAccountName' was not set or a defaultValue was defined."

I also did read discussion #1256, but nothing seems to get my pipeline scanning my BICEP files.

[BernieWhite]

Hi @xyl-jc, the instructions included in https://azure.github.io/PSRule.Rules.Azure/using-bicep/#testing-bicep-modules should help.

In short:

• Bicep modules with required parameters are not tested directly. They are tested via a .tests.bicep file which references the module with required parameters. You can also test different variations of parameter values.
  • Path exclusions are set to skip modules and include tests or deployments.

---

I hope this helps.

[BernieWhite]

@xyl-jc Are you able to post your final ps-rule.yaml and a snippet from your pipeline that you are using to call PSRule from Azure DevOps?

[xyl-jc]

@BernieWhite

ps-rule.yml:

requires:
  # Require a minimum of PSRule for Azure v1.12.2
  PSRule.Rules.Azure: ">=1.12.2"

include:
  module:
    - PSRule.Rules.Azure

input:
  pathIgnore:
    # Exclude all files
    - '**'
    # Exclude bicepconfig.json
    - 'bicepconfig.json'
    # Include test files from modules
    - '!modules/**/*.test.bicep'
    # Include bicep parameter files for environments
    - '!**/*.bicepparam'

configuration:
  # Enable expansion of Azure Template files.
  AZURE_PARAMETER_FILE_EXPANSION: false
  AZURE_BICEP_PARAMS_FILE_EXPANSION: true

  # Enable expansion of Azure Bicep files.
  AZURE_BICEP_FILE_EXPANSION: true
  AZURE_BICEP_FILE_EXPANSION_TIMEOUT: 20

  # Configure the minimum AKS cluster version.
  AZURE_AKS_CLUSTER_MINIMUM_VERSION: 1.22.4

rule:
  # Enable custom rules that don't exist in the baseline
  includeLocal: true
  exclude:
    # Ignore the following rules for all resources
    - Azure.Resource.UseTags
    - Azure.Template.UseDescriptions

My template pipeline:

parameters:
  # Pipeline-related parameters
  targetEnvironment: '$(targetEnvironment)'
  serviceConnection: '$(serviceConnection)'
  poolName: '$(poolName)'
  vmImage: '$(vmImage)'
  defaultJobTimeoutInMinutes: 120
  # Logic-related parameters
  deploymentBlocks: ''
  location: '$(defaultLocation)'
  resourceGroupName: '$(defaultResourceGroupName)'
  subscriptionId: '$(ARM_SUBSCRIPTION_ID)'
  managementGroupId: '$(ARM_MGMTGROUP_ID)'
  tenantId: "$(ARM_TENANT_ID)"
  # Azure PowerShell Version parameters
  azurePowerShellVersion: '$(azurePowerShellVersion)'
  preferredAzurePowerShellVersion: '$(preferredAzurePowerShellVersion)'

jobs:
  - ${{ each deploymentBlock in parameters.deploymentBlocks }}:
    - job: PSRule
      displayName: Lint code with [${{ deploymentBlock.Path }}]
      pool:
          ${{ if ne(parameters.vmImage, '') }}:
            vmImage: ${{ parameters.vmImage }}
          ${{ if ne(parameters.poolName, '') }}:
            name: ${{ parameters.poolName }}
      steps:
        # [Multi Repo] Support task
        #--------------------------
        - task: PowerShell@2
          displayName: Handle Multi-Repo Invocation
          inputs:
            targetType: inline
            pwsh: true
            script: |
              # Handle multiple-repositories
              if( "${{ join(';',parameters.checkoutRepositories) }}".length -gt 0) {
                Write-Verbose "Multi-Repo Checkout" -Verbose
                $componentRepoRoot = Join-Path '$(System.DefaultWorkingDirectory)' '$(componentsRepository)'
              } else {
                Write-Verbose "No Multi-Repo Checkout" -Verbose
                $componentRepoRoot = '$(System.DefaultWorkingDirectory)'
                $parametersRepoRoot = '$(System.DefaultWorkingDirectory)'
              }

              Write-Output "##vso[task.setvariable variable=componentRepoRoot]$componentRepoRoot"
              Write-Output "##vso[task.setvariable variable=parametersRepoRoot]$parametersRepoRoot"

        # [Agent] Bicep Lint
        #-----------------------
        - task: AzurePowerShell@5
          displayName: Run Bicep linter
          inputs:
            azureSubscription: ${{ parameters.serviceConnection }}
            azurePowerShellVersion: ${{ parameters.azurePowerShellVersion }}
            preferredAzurePowerShellVersion: ${{ parameters.preferredAzurePowerShellVersion }}
            ScriptType: InlineScript
            pwsh: true
            inline: |
              if(-not [String]::IsNullOrEmpty('${{ deploymentBlock.templateFilePath }}')) {
                $templateFilePath = Join-Path '$(componentRepoRoot)' '${{ deploymentBlock.Path }}' '${{ deploymentBlock.templateFilePath }}'
              } else {
                # Use default path
                $templateFilePath = (Test-Path (Join-Path '$(componentRepoRoot)' '${{ deploymentBlock.Path }}' 'deploy.bicep')) ?
                  (Join-Path '$(componentRepoRoot)' '${{ deploymentBlock.Path }}' 'deploy.bicep') :
                  (Join-Path '$(componentRepoRoot)' '${{ deploymentBlock.Path }}' 'deploy.json')
              }
              az bicep build --file $templateFilePath
              Write-Output "##vso[task.setvariable variable=templateFilePath]$templateFilePath"

        # [Agent] PSRule Tests
        #-----------------------
        - task: ps-rule-assert@2
          displayName: Analyze Azure template files
          continueOnError: true
          inputs:
            inputType: repository
            inputPath: $(templateFilePath)
            modules: 'PSRule.Rules.Azure'
            outputFormat: NUnit3
            outputPath: $(System.DefaultWorkingDirectory)/psrule-results.xml
            baseline: $(psruleBaselineName)

        # [Agent] Publish PSrule Tests
        #-----------------------------
        - task: PublishTestResults@2
          displayName: 'Publish PSRule Results'
          inputs:
            testRunTitle: 'PSRule-build'
            testRunner: NUnit
            testResultsFiles: "$(System.DefaultWorkingDirectory)/psrule-results.xml"
            failTaskOnFailedTests: false

[xyl-jc]

Even with very simple pipeline:

trigger: none

variables:
  - template: "/.azuredevops/pipelineVariables/global.variables.yml"
  - group: "PLATFORM_VARIABLES"

stages:
- stage: Lint
  jobs:
  - job: PSRule
    displayName: Lint code with
    pool:
      vmImage: ubuntu-latest
    steps:
    - task: AzurePowerShell@5
      displayName: Run Bicep linter
      inputs:
        azureSubscription: $(serviceConnection)
        azurePowerShellVersion: latestVersion
        ScriptType: InlineScript
        pwsh: true
        inline: |
          az bicep build --file .\deployment\main.bicep

    # [Agent] PSRule Tests
    #-----------------------
    - task: ps-rule-assert@2
      displayName: Analyze Azure template files
      continueOnError: true
      inputs:
        inputType: repository
        inputPath: deployment/main.bicep
        modules: 'PSRule.Rules.Azure'
        outputFormat: NUnit3
        outputPath: $(System.DefaultWorkingDirectory)/psrule-results.xml
        baseline: $(psruleBaselineName)

    # [Agent] Publish PSrule Tests
    #-----------------------------
    - task: PublishTestResults@2
      displayName: 'Publish PSRule Results'
      inputs:
        testRunTitle: 'PSRule-build'
        testRunner: NUnit
        testResultsFiles: "$(System.DefaultWorkingDirectory)/psrule-results.xml"
        failTaskOnFailedTests: false

Error:

Using PSRule v2.9.0
Using PSRule.Rules.Azure v1.27.3

----------------------------
Explore documentation: https://aka.ms/ps-rule
Contribute and find source: https://github.com/microsoft/PSRule
Report issues: https://github.com/microsoft/PSRule/issues
PSRule.Rules.Azure: https://aka.ms/ps-rule-azure
----------------------------

From repository: https://cpsandbox@dev.azure.com/cpsandbox/Azure-management/_git/TemplateRepo
  on : main
  at : d714f2b1cc1b037d8cf14667e22c77f4fb08b1c7

##[error]Failed to expand bicep source '/home/vsts/work/1/s/deployment/main.bicep'. Exception calling "GetBicepResources" with "2" argument(s): "Unable to expand resources because the source file '/home/vsts/work/1/s/deployment/main.bicep' was not valid. An error occurred evaluating expression '[format('module-{0}', parameters('storageAccountName'))]' line 28. The parameter named 'storageAccountName' was not set or a defaultValue was defined."
##[warning]Target object 'deployment/main.bicep' has not been processed because no matching rules were found.

Rules processed: 0, failed: 0, errored: 0
Run TemplateRepo/326 completed in 00:00:05.0700291
Output written to the following file: '/home/vsts/work/1/s/psrule-results.xml'
##[error]One or more assertions failed.

[BernieWhite]

@xyl-jc The problem is with the inputPath parameter for the pipeline.

   - task: ps-rule-assert@2
      displayName: Analyze Azure template files
      continueOnError: true
      inputs:
        inputType: repository
        inputPath: deployment/main.bicep
        modules: 'PSRule.Rules.Azure'
        outputFormat: NUnit3
        outputPath: $(System.DefaultWorkingDirectory)/psrule-results.xml
        baseline: $(psruleBaselineName)

This code is asking PSRule to scan deployment/main.bicep when it should be excluded/ ignored.

You can just set inputPath to deployment/ if you want to scan any files in deployment/.

I would recommend just not setting inputPath at all. Then your input.pathIgnore setting should only find the correct files.