implement scan and skip rules #441
Conversation
patilpankaj212
commented
Dec 23, 2020
patilpankaj212
commented
- command line options to scan and skip specific rules
- config file based rule scanning and skipping
- unit tests
2. tests around rule scanning and skipping
Codecov Report
@@ Coverage Diff @@
## master #441 +/- ##
==========================================
+ Coverage 73.39% 74.11% +0.72%
==========================================
Files 86 87 +1
Lines 1962 2013 +51
==========================================
+ Hits 1440 1492 +52
Misses 388 388
+ Partials 134 133 -1
|
2. define variable for error string in test func
pkg/http-server/remote-repo.go
Outdated
| @@ -112,7 +112,7 @@ func (s *scanRemoteRepoReq) ScanRemoteRepo(iacType, iacVersion string, cloudType | |||
|
|
|||
| // create a new runtime executor for scanning the remote repo | |||
| executor, err := runtime.NewExecutor(iacType, iacVersion, cloudType, | |||
| "", iacDirPath, "", policyPath) | |||
| "", iacDirPath, "", policyPath, []string{}, []string{}) | |||
There was a problem hiding this comment.
We should be taking rules to scan and skip for the API server as well. This functionality applies to the scanning for API server as well.
| filterRules(e, policyPath, scanRules, skipRules) | ||
|
|
||
| // update the rule count | ||
| e.stats.ruleCount = len(e.regoDataMap) |
There was a problem hiding this comment.
May be it's a good idea to error out if the ruleCount is less than 1.
There was a problem hiding this comment.
multiple engines are created based on policy path slice, cannot error out.
pkg/runtime/executor.go
Outdated
| } | ||
| if len(rules) > 0 { | ||
| if key == scanRulesKey { | ||
| e.scanRules = append(e.scanRules, rules...) |
There was a problem hiding this comment.
Not the right place to append to scan rules, this function should just return the list of rules. Caller function should take responsibility of using the list of rules. In this way this function can become more generic and we would not require to pass the Executor object to this.
There was a problem hiding this comment.
removed in the refactored code
pkg/runtime/executor.go
Outdated
| @@ -139,3 +168,68 @@ func (e *Executor) Execute() (results Output, err error) { | |||
| // successful | |||
| return results, nil | |||
| } | |||
|
|
|||
| // read the config file and update scan and skip rules | |||
| func (e *Executor) initScanAndSkipRules() error { | |||
There was a problem hiding this comment.
Also, initRules() as a function name should suffice, isn't it?
2. refactor the existing config reader code 3. update unit tests 4. incorporate PR review comments
|
Kudos, SonarCloud Quality Gate passed!
|
