devsecops-engine-tools 1.177.0__tar.gz → 1.178.0__tar.gz

{devsecops_engine_tools-1.177.0 → devsecops_engine_tools-1.178.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.177.0
+Version: 1.178.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

{devsecops_engine_tools-1.177.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_core/src/domain/model/input_core.py

@@ -1,4 +1,4 @@
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from devsecops_engine_tools.engine_core.src.domain.model.exclusions import Exclusions
 from devsecops_engine_tools.engine_core.src.domain.model.threshold import Threshold
 
@@ -12,3 +12,4 @@ class InputCore:
     scope_service: str
     stage_pipeline: str
     debug_exclusion_diagnostics: bool = False
+    base_image_names: list[str] = field(default_factory=list)

{devsecops_engine_tools-1.177.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_core/src/domain/usecases/break_build.py

@@ -58,6 +58,7 @@ class BreakBuild:
                 args,
                 debug=input_core.debug_exclusion_diagnostics,
                 pipeline_name=input_core.scope_pipeline,
+                base_image_names=input_core.base_image_names,
             )
             scan_result["findings_excluded"] = [self._map_finding_excluded(item) for item in findings_excluded]
             
@@ -70,7 +71,13 @@ class BreakBuild:
             self._handle_vulnerabilities(vulnerability_counts, vulnerabilities, threshold, warning_release, scan_result, args, manager)
             self._handle_cve_policy(vulnerabilities, threshold)
             self._handle_compliances(compliance_counts, compliances, threshold, warning_release, scan_result, args, manager)
-            self._handle_exclusions(findings_excluded, exclusions, manager, args)
+            self._handle_exclusions(
+                findings_excluded,
+                exclusions,
+                manager,
+                args,
+                input_core.base_image_names,
+            )
         else:
             print(devops_platform_gateway.message("succeeded", "There are no findings"))
             print(devops_platform_gateway.result_pipeline("succeeded"))
@@ -104,7 +111,13 @@ class BreakBuild:
                         )
 
     def _filter_findings(
-        self, findings_list, exclusions, args, debug=False, pipeline_name=""
+        self,
+        findings_list,
+        exclusions,
+        args,
+        debug=False,
+        pipeline_name="",
+        base_image_names=None,
     ):
         findings_excluded_list = []
         findings_without_exclusions_list = []
@@ -112,7 +125,12 @@ class BreakBuild:
 
         for item in findings_list:
             checks = [
-                (exclusion, self._exclusion_match_details(item, exclusion, args))
+                (
+                    exclusion,
+                    self._exclusion_match_details(
+                        item, exclusion, args, base_image_names
+                    ),
+                )
                 for exclusion in exclusions
             ]
             if debug:
@@ -137,6 +155,7 @@ class BreakBuild:
                         "priority": item.priority.scale if item.priority else None,
                         "module": args.get("module"),
                         "image_to_scan": image_to_scan,
+                        "base_image_names": base_image_names or [],
                     },
                     len(exclusions),
                     candidates,
@@ -150,13 +169,17 @@ class BreakBuild:
         return findings_excluded_list, findings_without_exclusions_list
 
     @staticmethod
-    def _matches_exclusion(item, exclusion, args):
-        return BreakBuild._exclusion_match_details(item, exclusion, args)["matched"]
+    def _matches_exclusion(item, exclusion, args, base_image_names=None):
+        return BreakBuild._exclusion_match_details(
+            item, exclusion, args, base_image_names
+        )["matched"]
 
     @staticmethod
-    def _exclusion_match_details(item, exclusion, args):
+    def _exclusion_match_details(item, exclusion, args, base_image_names=None):
         id_match = exclusion.id == item.id
-        where_match = exclusion.where in item.where or "all" in exclusion.where
+        where_match = bool(exclusion.where) and (
+            exclusion.where in item.where or "all" in exclusion.where
+        )
         finding_priority = item.priority.scale if item.priority else None
         severity_match = BreakBuild._value_in_exclusion_list(
             exclusion.severity, item.severity
@@ -168,9 +191,14 @@ class BreakBuild:
             args.get("module") == "engine_container" and bool(exclusion.check_in_desc)
         )
         image_to_scan = args.get("image_to_scan", "")
+        image_names = [image_to_scan] if image_to_scan else []
+        image_names.extend(base_image_names or [])
         image_match = not image_check_required or (
-            bool(image_to_scan)
-            and any(image_to_scan in image_name for image_name in exclusion.check_in_desc)
+            any(
+                image_name in excluded_image
+                for image_name in image_names
+                for excluded_image in exclusion.check_in_desc
+            )
         )
         matched = (
             id_match
@@ -365,7 +393,12 @@ class BreakBuild:
             print(devops_platform_gateway.result_pipeline("succeeded"))
 
     def _handle_exclusions(
-        self, findings_excluded_list, exclusions, break_build_manager, args
+        self,
+        findings_excluded_list,
+        exclusions,
+        break_build_manager,
+        args,
+        base_image_names=None,
     ):
         devops_platform_gateway = self.devops_platform_gateway
         printer_table_gateway = self.printer_table_gateway
@@ -378,7 +411,9 @@ class BreakBuild:
                 matching_exclusions = [
                     exclusion
                     for exclusion in exclusions
-                    if self._matches_exclusion(item, exclusion, args)
+                    if self._matches_exclusion(
+                        item, exclusion, args, base_image_names
+                    )
                 ]
                 image_exclusions = [
                     exclusion

{devsecops_engine_tools-1.177.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools/engine_sca/engine_container/src/domain/usecases/set_input_core.py

@@ -25,6 +25,18 @@ class SetInputCore:
         self.cross_approval_exclusions = cross_approval_exclusions or []
         self.debug_exclusion_diagnostics = debug_exclusion_diagnostics
 
+    @staticmethod
+    def _get_base_image_names(base_image):
+        if not base_image:
+            return []
+
+        images = base_image[0] if isinstance(base_image, (list, tuple)) else base_image
+        if isinstance(images, str):
+            return [images]
+        if isinstance(images, (list, tuple)):
+            return [image for image in images if isinstance(image, str) and image]
+        return []
+
     def _build_exclusions(self, items, base_image_list, filter_by_base_image):
         list_exclusions = []
         for item in items:
@@ -53,7 +65,8 @@ class SetInputCore:
 
     def get_exclusions(self, exclusions_data, pipeline_name, tool, base_image):
         list_exclusions = []
-        base_image_list = base_image[0][0] if base_image else None
+        base_image_names = self._get_base_image_names(base_image)
+        base_image_list = base_image_names[0] if base_image_names else None
         print("The base image used is:", base_image_list)
         for key, value in exclusions_data.items():
             if key not in {"All", pipeline_name} or not value.get(tool):
@@ -103,4 +116,5 @@ class SetInputCore:
             self.pipeline_name,
             self.stage.capitalize(),
             self.debug_exclusion_diagnostics,
+            self._get_base_image_names(base_image),
         )

devsecops_engine_tools-1.178.0/devsecops_engine_tools/version.py

@@ -0,0 +1 @@
+version = '1.178.0'

{devsecops_engine_tools-1.177.0 → devsecops_engine_tools-1.178.0}/devsecops_engine_tools.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devsecops-engine-tools
-Version: 1.177.0
+Version: 1.178.0
 Summary: Tool for DevSecOps strategy
 Home-page: https://github.com/bancolombia/devsecops-engine-tools
 Author: Bancolombia DevSecOps Team

devsecops_engine_tools-1.177.0/devsecops_engine_tools/version.py

@@ -1 +0,0 @@
-version = '1.177.0'