gitlab-compliance 2.0.0__py3-none-any.whl

src/compliance/behave_support/steps/then_steps.py

@@ -0,0 +1,234 @@
+"""THEN steps for GitLab compliance policies."""
+
+from __future__ import annotations
+
+from behave import then
+
+from src.compliance.stash import (
+    assert_all,
+    container_image_has_newer_release,
+    container_image_newer_release_older_than_days,
+    container_image_release_lag_exceeds_days,
+    container_image_uses_sha256,
+    container_image_within_latest_tags,
+    entity_has_property,
+    extends_includes,
+    get_property,
+    include_has_newer_release,
+    include_has_valid_semver,
+    include_newer_release_older_than_days,
+    include_release_lag_exceeds_days,
+    include_version_is_latest,
+    include_within_latest_tags,
+    normalize_value,
+    property_matches,
+    property_matches_regex,
+    property_not_matches_regex,
+)
+
+
+def _ensure_then_mode(context):
+    if context.scenario_skipped:
+        return False
+    context.step_mode = "then"
+    if not context.stash:
+        raise AssertionError("No entities in stash to assert against.")
+    return True
+
+
+@then("it must contain {property_name}")
+def then_must_contain(context, property_name):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: entity_has_property(e, property_name),
+        f"Entities missing required property '{property_name}'",
+    )
+
+
+@then("it must not contain {property_name}")
+def then_must_not_contain(context, property_name):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not entity_has_property(e, property_name),
+        f"Entities must not contain '{property_name}'",
+    )
+
+
+@then("its {property_name} must be {expected}")
+def then_property_must_be(context, property_name, expected):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: property_matches(e, property_name, expected),
+        f"Entities where {property_name} must be {expected}",
+    )
+
+
+@then('its {property_name} must match "{pattern}"')
+def then_property_must_match(context, property_name, pattern):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: property_matches_regex(e, property_name, pattern),
+        f"Entities where {property_name} must match /{pattern}/",
+    )
+
+
+@then('its {property_name} must not match "{pattern}"')
+def then_property_must_not_match(context, property_name, pattern):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: property_not_matches_regex(e, property_name, pattern),
+        f"Entities where {property_name} must not match /{pattern}/",
+    )
+
+
+@then("its {property_name} must not be null")
+def then_property_not_null(context, property_name):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: normalize_value(get_property(e, property_name)).strip() != "",
+        f"Entities where {property_name} must not be null",
+    )
+
+
+@then('its extends must include "{template}"')
+def then_extends_includes(context, template):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: extends_includes(e, template),
+        f"Entities must extend '{template}'",
+    )
+
+
+@then("it must use valid semver")
+def then_version_valid_semver(context):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        include_has_valid_semver,
+        "Includes must use a valid semver version",
+    )
+
+
+@then("a newer release must not be available")
+def then_no_newer_release(context):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not include_has_newer_release(e),
+        "Includes must not have a newer release available",
+    )
+
+
+@then("a newer release must not be available for more than {days:d} days")
+def then_no_newer_release_beyond_grace_days(context, days):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not include_newer_release_older_than_days(e, days),
+        f"Includes must not have a newer release available for more than {days} days",
+    )
+
+
+@then("its release lag must not exceed {days:d} days")
+def then_release_lag_must_not_exceed_days(context, days):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not include_release_lag_exceeds_days(e, days),
+        f"Includes must not have release lag exceeding {days} days",
+    )
+
+
+@then("it must be within the latest {count:d} tags")
+def then_must_be_within_latest_tags(context, count):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: include_within_latest_tags(e, count),
+        f"Includes must be within the latest {count} semver tags",
+    )
+
+
+@then("it must use sha256 digest")
+def then_must_use_sha256_digest(context):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        container_image_uses_sha256,
+        "Container images must use a sha256 digest",
+    )
+
+
+@then("a newer image release must not be available")
+def then_no_newer_image_release(context):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not container_image_has_newer_release(e),
+        "Container images must not have a newer release available",
+    )
+
+
+@then("a newer image release must not be available for more than {days:d} days")
+def then_no_newer_image_release_beyond_grace_days(context, days):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not container_image_newer_release_older_than_days(e, days),
+        f"Container images must not have a newer release available for more than {days} days",
+    )
+
+
+@then("its image release lag must not exceed {days:d} days")
+def then_image_release_lag_must_not_exceed_days(context, days):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: not container_image_release_lag_exceeds_days(e, days),
+        f"Container images must not have image release lag exceeding {days} days",
+    )
+
+
+@then("it must be within the latest {count:d} image tags")
+def then_must_be_within_latest_image_tags(context, count):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        lambda e: container_image_within_latest_tags(e, count),
+        f"Container images must be within the latest {count} image tags",
+    )
+
+
+@then("it must track the latest release")
+def then_version_is_latest_release(context):
+    if not _ensure_then_mode(context):
+        return
+    assert_all(
+        context.stash,
+        include_version_is_latest,
+        "Includes must reference the latest semver release",
+    )

src/compliance/behave_support/steps/when_steps.py

@@ -0,0 +1,168 @@
+"""WHEN steps for GitLab compliance policies."""
+
+from __future__ import annotations
+
+from behave import when
+
+from src.compliance.behave_support.environment import _skip_remaining_steps
+from src.compliance.stash import (
+    container_image_has_newer_release,
+    container_image_newer_release_older_than_days,
+    container_image_not_within_latest_tags,
+    container_image_release_lag_exceeds_days,
+    entity_has_property,
+    filter_entities,
+    include_has_newer_release,
+    include_newer_release_older_than_days,
+    include_not_within_latest_tags,
+    include_release_lag_exceeds_days,
+    name_starts_with,
+    property_matches,
+    property_matches_regex,
+)
+
+
+def _apply_filter(context, entities: list[dict], reason: str):
+    if context.scenario_skipped:
+        return
+    context.step_mode = "when"
+    if not entities:
+        _skip_remaining_steps(context, reason)
+        return
+    context.stash = entities
+
+
+@when("it has {property_name}")
+def when_it_has(context, property_name):
+    filtered = filter_entities(
+        context.stash, lambda e: entity_has_property(e, property_name)
+    )
+    _apply_filter(context, filtered, f"No entities with property '{property_name}'")
+
+
+@when("it does not have {property_name}")
+def when_it_does_not_have(context, property_name):
+    filtered = filter_entities(
+        context.stash, lambda e: not entity_has_property(e, property_name)
+    )
+    _apply_filter(
+        context, filtered, f"All entities already have property '{property_name}'"
+    )
+
+
+@when("its {property_name} is {expected}")
+def when_property_is(context, property_name, expected):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: property_matches(e, property_name, expected),
+    )
+    _apply_filter(context, filtered, f"No entities where {property_name} is {expected}")
+
+
+@when('its {property_name} matches "{pattern}"')
+def when_property_matches(context, property_name, pattern):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: property_matches_regex(e, property_name, pattern),
+    )
+    _apply_filter(
+        context, filtered, f"No entities where {property_name} matches {pattern}"
+    )
+
+
+@when('its name does not start with "{prefix}"')
+def when_name_not_starts_with(context, prefix):
+    filtered = filter_entities(context.stash, lambda e: not name_starts_with(e, prefix))
+    _apply_filter(context, filtered, f"All entity names start with '{prefix}'")
+
+
+@when("a newer release is available")
+def when_newer_release_available(context):
+    filtered = filter_entities(context.stash, include_has_newer_release)
+    _apply_filter(context, filtered, "No includes with a newer release available")
+
+
+@when("a newer release is available for more than {days:d} days")
+def when_newer_release_available_for_more_than_days(context, days):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: include_newer_release_older_than_days(e, days),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No includes with a newer release available for more than {days} days",
+    )
+
+
+@when("its release lag exceeds {days:d} days")
+def when_release_lag_exceeds_days(context, days):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: include_release_lag_exceeds_days(e, days),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No includes with release lag exceeding {days} days",
+    )
+
+
+@when("it is not within the latest {count:d} tags")
+def when_not_within_latest_tags(context, count):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: include_not_within_latest_tags(e, count),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No includes outside the latest {count} tags",
+    )
+
+
+@when("a newer image release is available")
+def when_newer_image_release_available(context):
+    filtered = filter_entities(context.stash, container_image_has_newer_release)
+    _apply_filter(
+        context, filtered, "No container images with a newer release available"
+    )
+
+
+@when("a newer image release is available for more than {days:d} days")
+def when_newer_image_release_available_for_more_than_days(context, days):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: container_image_newer_release_older_than_days(e, days),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No container images with a newer release available for more than {days} days",
+    )
+
+
+@when("its image release lag exceeds {days:d} days")
+def when_image_release_lag_exceeds_days(context, days):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: container_image_release_lag_exceeds_days(e, days),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No container images with image release lag exceeding {days} days",
+    )
+
+
+@when("it is not within the latest {count:d} image tags")
+def when_not_within_latest_image_tags(context, count):
+    filtered = filter_entities(
+        context.stash,
+        lambda e: container_image_not_within_latest_tags(e, count),
+    )
+    _apply_filter(
+        context,
+        filtered,
+        f"No container images outside the latest {count} image tags",
+    )

src/compliance/console.py

@@ -0,0 +1,95 @@
+"""Rich console output for compliance results."""
+
+from __future__ import annotations
+
+from rich.console import Console
+from rich.panel import Panel
+from rich.table import Table
+from rich.text import Text
+
+from src.compliance.models import ComplianceResult
+
+console = Console()
+
+_STATUS_STYLES = {
+    "passed": "bold green",
+    "failed": "bold red",
+    "skipped": "bold yellow",
+}
+
+
+def render_compliance_console(
+    result: ComplianceResult,
+    pipeline_file: str,
+    features_dir: str,
+) -> None:
+    overall = "Compliance Passed" if result.success else "Compliance Failed"
+    border_style = "green" if result.success else "red"
+
+    console.print(
+        Panel(
+            f"[bold]Pipeline:[/bold] {pipeline_file}\n"
+            f"[bold]Policies:[/bold] {features_dir}",
+            title=overall,
+            border_style=border_style,
+        )
+    )
+
+    summary = Table(title="Summary", show_header=True, header_style="bold")
+    summary.add_column("Status", style="cyan")
+    summary.add_column("Count", justify="right")
+    summary.add_row("[green]Passed[/green]", str(result.passed))
+    summary.add_row("[red]Failed[/red]", str(result.failed))
+    summary.add_row("[yellow]Skipped[/yellow]", str(result.skipped))
+    summary.add_row("[bold]Total[/bold]", str(result.scenarios))
+    console.print(summary)
+
+    failures = [
+        scenario for scenario in result.scenario_results if scenario.status == "failed"
+    ]
+    if failures:
+        console.rule("[bold red]Failure details")
+        for scenario in failures:
+            label = scenario.policy_id or scenario.feature
+            title = scenario.title or scenario.name
+            console.print(f"[bold red]{label}[/bold red] — {title}")
+            if scenario.description:
+                console.print(scenario.description, style="italic")
+            if scenario.message:
+                console.print(scenario.message, style="dim")
+
+    skipped = [
+        scenario for scenario in result.scenario_results if scenario.status == "skipped"
+    ]
+    if skipped:
+        console.rule("[bold yellow]Skipped scenarios")
+        for scenario in skipped:
+            reason = scenario.message or "Filter did not match any entities."
+            label = scenario.policy_id or scenario.feature
+            title = scenario.title or scenario.name
+            console.print(f"[yellow]{label}[/yellow] — {title}: {reason}")
+
+    scenarios = Table(title="Scenarios", show_header=True, header_style="bold")
+    scenarios.add_column("ID", style="magenta", no_wrap=True)
+    scenarios.add_column("Feature", style="cyan", no_wrap=True)
+    scenarios.add_column("Policy")
+    scenarios.add_column("Status", justify="center")
+
+    for scenario in result.scenario_results:
+        style = _STATUS_STYLES.get(scenario.status, "bold white")
+        scenarios.add_row(
+            scenario.policy_id or "-",
+            scenario.feature,
+            scenario.title or scenario.name,
+            Text(scenario.status.upper(), style=style),
+        )
+
+    console.print(scenarios)
+
+    console.print()
+    console.print(
+        f"[bold]{result.passed} passed[/bold], "
+        f"[bold]{result.failed} failed[/bold], "
+        f"[bold]{result.skipped} skipped[/bold] "
+        f"({result.scenarios} scenarios in {result.features} features)"
+    )

src/compliance/container_fix.py

@@ -0,0 +1,135 @@
+"""Auto-fix container images to sha256 digests in GitLab CI YAML."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+
+@dataclass
+class ContainerImageFix:
+    source_file: str
+    line: int
+    parent_job: str
+    image_source: str
+    current_image: str
+    fixed_image: str
+
+
+def collect_container_image_fixes(entities: dict) -> list[ContainerImageFix]:
+    fixes: list[ContainerImageFix] = []
+    for image in entities.get("container_images", []):
+        current = str(image.get("image", "")).strip()
+        digest = str(image.get("latest_digest", "")).strip()
+        if not current or not digest:
+            continue
+        if "@sha256:" in current:
+            continue
+        repository_part = current.split("@sha256:", 1)[0]
+        if ":" in repository_part:
+            base = repository_part.rsplit(":", 1)[0]
+        else:
+            base = repository_part
+        fixed_image = f"{base}@sha256:{digest}"
+        fixes.append(
+            ContainerImageFix(
+                source_file=str(image.get("source_file", "")),
+                line=int(image.get("line", 0) or 0),
+                parent_job=str(image.get("parent_job", "")),
+                image_source=str(image.get("image_source", "")),
+                current_image=current,
+                fixed_image=fixed_image,
+            )
+        )
+    return fixes
+
+
+def _replace_image_line(line: str, current_image: str, fixed_image: str) -> str | None:
+    escaped = re.escape(current_image)
+    match = re.match(
+        rf"^(\s*image:\s*)(['\"]?)({escaped})\2(\s*(?:#.*)?)?$",
+        line.rstrip("\n"),
+    )
+    if not match:
+        return None
+    prefix, quote, _value, suffix = match.groups()
+    suffix = suffix or ""
+    if quote:
+        result = f"{prefix}{quote}{fixed_image}{quote}{suffix}"
+    else:
+        result = f"{prefix}{fixed_image}{suffix}"
+    return result + ("\n" if line.endswith("\n") else "")
+
+
+def _replace_service_entry(
+    line: str, current_image: str, fixed_image: str
+) -> str | None:
+    escaped = re.escape(current_image)
+    stripped = line.rstrip("\n")
+    newline = "\n" if line.endswith("\n") else ""
+
+    for pattern in (
+        rf"^(\s*-\s*)(['\"]?)({escaped})\2(\s*(?:#.*)?)?$",
+        rf"^(\s*name:\s*)(['\"]?)({escaped})\2(\s*(?:#.*)?)?$",
+    ):
+        match = re.match(pattern, stripped)
+        if not match:
+            continue
+        prefix, quote, _value, suffix = match.groups()
+        suffix = suffix or ""
+        if quote:
+            return f"{prefix}{quote}{fixed_image}{quote}{suffix}{newline}"
+        return f"{prefix}{fixed_image}{suffix}{newline}"
+    return None
+
+
+def _is_service_image_line(line: str) -> bool:
+    stripped = line.lstrip()
+    return stripped.startswith("- ") or stripped.startswith("name:")
+
+
+def _apply_fix_to_file(fix: ContainerImageFix, lines: list[str]) -> bool:
+    if fix.line <= 0 or fix.line > len(lines):
+        return False
+    start = fix.line - 1
+    job_header = lines[start].strip()
+    if not job_header.startswith(f"{fix.parent_job}:"):
+        return False
+    end = min(len(lines), start + 40)
+    for index in range(start, end):
+        line = lines[index]
+        if index > start and re.match(r"^[a-zA-Z0-9_.-]+:\s*$", line):
+            break
+        updated = None
+        if fix.image_source == "job" and re.search(r"^\s*image:\s*", line):
+            updated = _replace_image_line(line, fix.current_image, fix.fixed_image)
+        elif fix.image_source == "service" and _is_service_image_line(line):
+            updated = _replace_service_entry(line, fix.current_image, fix.fixed_image)
+        if updated and updated != line:
+            lines[index] = updated if updated.endswith("\n") else updated + "\n"
+            return True
+    return False
+
+
+def apply_container_image_fixes(
+    fixes: list[ContainerImageFix],
+) -> list[ContainerImageFix]:
+    applied: list[ContainerImageFix] = []
+    by_file: dict[str, list[ContainerImageFix]] = {}
+    for fix in fixes:
+        if not fix.source_file:
+            continue
+        by_file.setdefault(fix.source_file, []).append(fix)
+
+    for source_file, file_fixes in by_file.items():
+        with open(source_file, encoding="utf-8") as handle:
+            lines = handle.readlines()
+        changed = False
+        for fix in file_fixes:
+            if _apply_fix_to_file(fix, lines):
+                applied.append(fix)
+                changed = True
+        if changed:
+            with open(source_file, "w", encoding="utf-8") as handle:
+                handle.writelines(lines)
+    return applied