PyPI - devsecops-engine-tools - Versions diffs - 1.171.0__tar.gz → 1.172.0__tar.gz - Mend

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.171.0
+Version: 1.172.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

@@ -263,6 +263,15 @@ def get_inputs_from_cli(args):
         required=False,
         help="Address of the Docker daemon to connect to."
     )
+    parser.add_argument(
+        "--excepted_checks",
+        type=str,
+        required=False,
+        default="",
+        help="Comma-separated list of check ids already excepted for this execution, they are treated as \
+        soft-fail: the findings are reported but do not break the build. Only applies to engine_iac. \
+        Ej: CKV_AWS_18,CKV_AWS_21",
+    )
     TOOLS = {
         "engine_iac": ["checkov", "kics", "kubescape", "conftest"],
         "engine_secret": ["trufflehog", "gitleaks", "all_tools"],
@@ -310,6 +319,7 @@ def get_inputs_from_cli(args):
         "dast_file_path": args.dast_file_path,
         "context": args.context,
         "docker_address": args.docker_address,
+        "excepted_checks": args.excepted_checks,
     }

@@ -10,7 +10,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.report import (
     Report,
 )
 from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
-    format_date,
+    format_optional_date,
     format_expired_date,
 )
 from prettytable import PrettyTable, DOUBLE_BORDER
@@ -120,7 +120,7 @@ class PrinterPrettyTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"]),
                     self._check_spaces(exclusion["service"]),
                     ", ".join(exclusion["tags"]),
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]
@@ -163,7 +163,7 @@ class PrinterPrettyTable(PrinterTableGateway):
                     exclusion["severity"],
                     exclusion["id"],
                     exclusion["where"],
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]

@@ -10,7 +10,7 @@ from devsecops_engine_tools.engine_core.src.domain.model.report import (
     Report,
 )
 from devsecops_engine_tools.engine_core.src.infrastructure.helpers.util import (
-    format_date,
+    format_optional_date,
     format_expired_date,
 )
 from rich.console import Console
@@ -64,7 +64,7 @@ class PrinterRichTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"], exclusion["vm_id_url"]),
                     ", ".join(exclusion["tags"]),
                     exclusion["service"],
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]
@@ -87,7 +87,7 @@ class PrinterRichTable(PrinterTableGateway):
                     self._check_spaces(exclusion["vm_id"], exclusion["vm_id_url"]),
                     exclusion.get("service", ""),
                     ", ".join(exclusion["tags"]),
-                    format_date(exclusion["create_date"], "%d%m%Y", "%d/%m/%Y"),
+                    format_optional_date(exclusion["create_date"]),
                     format_expired_date(exclusion["expired_date"]),
                     exclusion["reason"],
                 ]

@@ -5,12 +5,21 @@ def format_date(date, to_format, from_format):
     return datetime.strptime(date, to_format).strftime(from_format)
-def format_expired_date(expired_date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
-    if expired_date and expired_date != "undefined":
-        return format_date(expired_date, input_format, output_format)
+def format_optional_date(date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
+    """
+    Formats a date that may not be defined. Exclusions can legitimately come without
+    dates (the Exclusions model defaults them to an empty string), so rendering them
+    must not fail.
+    """
+    if date and date != "undefined":
+        return format_date(date, input_format, output_format)
     return "NA"
+def format_expired_date(expired_date, input_format="%d%m%Y", output_format="%d/%m/%Y"):
+    return format_optional_date(expired_date, input_format, output_format)
 def define_env(variable_env, branch):
     if variable_env is not None:
         return variable_env.lower()

@@ -1,5 +1,6 @@
 import os
 import re
+from datetime import datetime
 from devsecops_engine_tools.engine_sast.engine_iac.src.domain.model.gateways.tool_gateway import (
     ToolGateway,
 )
@@ -19,6 +20,8 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger()
 class IacScan:
+    EXCEPTED_CHECKS_REASON = "Excepted check (soft fail)"
     def __init__(
         self, tool_gateway: ToolGateway, devops_platform_gateway: DevopsPlatformGateway, remote_config_source_gateway: DevopsPlatformGateway
     ):
@@ -69,6 +72,9 @@ class IacScan:
             totalized_exclusions.extend(
                 [Exclusions(**elem) for elem in config_tool_core.exclusions_scope]
             )
+        totalized_exclusions.extend(
+            self._build_excepted_checks_exclusions(dict_args, findings_list)
+        )
         input_core = InputCore(
             totalized_exclusions=totalized_exclusions,
@@ -89,6 +95,56 @@ class IacScan:
         return findings_list, input_core
+    def _build_excepted_checks_exclusions(self, dict_args, findings_list):
+        """
+        Translates the --excepted_checks CLI flag (comma separated check ids already
+        approved as exceptions outside the engine) into Exclusions, so those findings
+        are still reported but do not break the build.
+        The severity is taken from each finding instead of being hardcoded because
+        BreakBuild._filter_findings only excludes a finding when the exclusion matches
+        its severity or its priority scale, and the priority is not resolved yet at
+        this point of the execution.
+        """
+        excepted_checks = {
+            check.strip()
+            for check in (dict_args.get("excepted_checks") or "").split(",")
+            if check.strip()
+        }
+        if not excepted_checks:
+            return []
+        severities_by_check = {}
+        for finding in findings_list:
+            if finding.id in excepted_checks:
+                severities_by_check.setdefault(finding.id, set()).add(finding.severity)
+        without_findings = excepted_checks - set(severities_by_check)
+        if without_findings:
+            logger.info(
+                "%s of %s excepted checks have no findings in this execution",
+                len(without_findings),
+                len(excepted_checks),
+            )
+            logger.debug(
+                "Excepted checks without findings: %s", ", ".join(sorted(without_findings))
+            )
+        create_date = datetime.now().strftime("%d%m%Y")
+        return [
+            Exclusions(
+                **{
+                    "id": check_id,
+                    "where": "all",
+                    "severity": severity,
+                    "create_date": create_date,
+                    "reason": self.EXCEPTED_CHECKS_REASON,
+                }
+            )
+            for check_id in sorted(severities_by_check)
+            for severity in sorted(severities_by_check[check_id])
+        ]
     def _complete_config_tool(self, data_file_tool, exclusions, tool, dict_args):
         config_tool = ConfigTool(json_data=data_file_tool)

	@@ -0,0 +1 @@
1	+ version = '1.172.0'

	@@ -1 +0,0 @@
1	- version = '1.171.0'

devsecops-engine-tools 1.171.0__tar.gz → 1.172.0__tar.gz

devsecops-engine-tools 1.171.0tar.gz → 1.172.0tar.gz