PyPI - devsecops-engine-tools - Versions diffs - 1.152.0__tar.gz → 1.154.0__tar.gz - Mend

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.152.0
+Version: 1.154.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

@@ -109,6 +109,7 @@ def get_inputs_from_cli(args):
             "checkov",
             "kics",
             "kubescape",
+            "conftest",
             "trufflehog",
             "gitleaks",
             "prisma",
@@ -156,7 +157,7 @@ def get_inputs_from_cli(args):
     parser.add_argument(
         "-p",
         "--platform",
-        type=parse_choices({"all", "docker", "k8s", "cloudformation", "openapi", "terraform", "serverless", "bicep"}),
+        type=parse_choices({"all", "docker", "k8s", "cloudformation", "openapi", "terraform", "serverless", "bicep", "n8n"}),
         required=False,
         default="all",
         help="Platform to scan, applies only to the engine_iac tool and it is possible to select several {all, docker, k8s, cloudformation, openapi, terraform}",
@@ -262,7 +263,7 @@ def get_inputs_from_cli(args):
     )
     TOOLS = {
-        "engine_iac": ["checkov", "kics", "kubescape"],
+        "engine_iac": ["checkov", "kics", "kubescape", "conftest"],
         "engine_secret": ["trufflehog", "gitleaks", "all_tools"],
         "engine_container": ["prisma", "trivy"],
         "engine_dependencies": ["xray", "dependency_check", "trivy"],

@@ -58,6 +58,7 @@ class DefectDojoPlatform(VulnerabilityManagementGateway):
     scan_type_mapping = {
         "CHECKOV": "Checkov Scan",
+        "CONFTEST": "Conftest Scan",
         "PRISMA": "Twistlock Image Scan",
         "XRAY": "JFrog Xray On Demand Binary Scan",
         "TRUFFLEHOG": "Trufflehog Scan",

@@ -10,6 +10,9 @@ from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_ada
 from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.kics.kics_tool import (
     KicsTool
 )
+from devsecops_engine_tools.engine_sast.engine_iac.src.infrastructure.driven_adapters.conftest.conftest_tool import (
+    ConftestTool
+)
 def runner_engine_iac(dict_args, tool, secret_tool, devops_platform_gateway, remote_config_source_gateway, env):
@@ -20,7 +23,8 @@ def runner_engine_iac(dict_args, tool, secret_tool, devops_platform_gateway, rem
         tools = {
             "CHECKOV": CheckovTool(),
             "KUBESCAPE": KubescapeTool(),
-            "KICS": KicsTool()
+            "KICS": KicsTool(),
+            "CONFTEST": ConftestTool(),
         }
         if tool in tools:

@@ -111,13 +111,19 @@ class IacScan:
         if config_tool.exclusions.get("All") is not None:
             config_tool.exclusions_all = config_tool.exclusions.get("All").get(tool)
-        if config_tool.exclusions.get(config_tool.scope_pipeline) is not None:
-            config_tool.exclusions_scope = config_tool.exclusions.get(
-                config_tool.scope_pipeline
-            ).get(tool)
-            skip_tool = bool(
-                config_tool.exclusions.get(config_tool.scope_pipeline).get("SKIP_TOOL")
-            )
+        exclusions_scope = config_tool.exclusions.get(config_tool.scope_pipeline)
+        if exclusions_scope is None:
+            for pattern, values in config_tool.exclusions.get(
+                "BY_PATTERN_SEARCH", {}
+            ).items():
+                if re.match(pattern, config_tool.scope_pipeline, re.IGNORECASE):
+                    exclusions_scope = values
+                    break
+        if exclusions_scope is not None:
+            config_tool.exclusions_scope = exclusions_scope.get(tool)
+            skip_tool = bool(exclusions_scope.get("SKIP_TOOL"))
         if dict_args["folder_path"]:
             if (

@@ -36,6 +36,7 @@ list_scan_type = [
     "Checkmarx Scan",
     "Checkmarx Scan detailed",
     "Checkov Scan",
+    "Conftest Scan",
     "Clair Klar Scan",
     "Clair Scan",
     "Cloudsploit Scan",

@@ -86,7 +86,7 @@ class Utils:
                 logger.warning("The secret is not configured for external controls")
-            elif config_tool[tool]["USE_EXTERNAL_CHECKS_GIT"] and platform.system() in (
+            elif config_tool[tool].get("USE_EXTERNAL_CHECKS_GIT", False) and platform.system() in (
                 "Linux", "Darwin",
             ):
                 config_knowns_hosts(
@@ -99,7 +99,7 @@ class Utils:
                 ssh_key_password = decode_base64(secret["repository_ssh_password"])
                 agent_env = add_ssh_private_key(ssh_key_file_path, ssh_key_password)
-            elif config_tool[tool]["USE_EXTERNAL_CHECKS_DIR"]:
+            elif config_tool[tool].get("USE_EXTERNAL_CHECKS_DIR", False):
                 if not github_token:
                     github_token = github_api.get_installation_access_token(
                         secret.get("github_apps"),

	@@ -0,0 +1 @@
1	+ version = '1.154.0'

	@@ -1 +0,0 @@
1	- version = '1.152.0'

devsecops-engine-tools 1.152.0__tar.gz → 1.154.0__tar.gz