gitlab-compliance 2.4.0__tar.gz → 2.5.0__tar.gz

{gitlab_compliance-2.4.0 → gitlab_compliance-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-compliance
-Version: 2.4.0
+Version: 2.5.0
 Summary: BDD compliance testing for GitLab CI/CD pipelines and project settings — by MaturityBuilder
 License-Expression: Apache-2.0
 License-File: LICENSE

{gitlab_compliance-2.4.0 → gitlab_compliance-2.5.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitlab-compliance"
-version = "2.4.0"
+version = "2.5.0"
 dynamic = [ "readme" ]
 license = "Apache-2.0"
 requires-python = ">=3.12"

gitlab_compliance-2.5.0/src/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.4.0"  # x-release-please-version

{gitlab_compliance-2.4.0 → gitlab_compliance-2.5.0}/src/compliance/behave_support/steps/script_steps.py

@@ -6,6 +6,33 @@ from behave import given, then, when
 
 from src.compliance.behave_support.environment import _skip_remaining_steps
 from src.compliance.script_analysis import (
+    evidence_backticks,
+    evidence_bashism_in_posix_test,
+    evidence_bashisms_without_bash,
+    evidence_chmod_777,
+    evidence_curl_missing_fail,
+    evidence_dangerous_rm,
+    evidence_deprecated_ci_build,
+    evidence_download_without_checksum,
+    evidence_eval,
+    evidence_hardcoded_secrets,
+    evidence_insecure_temp_files,
+    evidence_invalid_shebang,
+    evidence_masked_failure,
+    evidence_missing_strict_mode,
+    evidence_nested_backticks,
+    evidence_pipeline_without_pipefail,
+    evidence_posix_bashisms,
+    evidence_remote_pipe,
+    evidence_unpinned_docker,
+    evidence_unpinned_manager,
+    evidence_unquoted_command_substitution,
+    evidence_unquoted_path_variables,
+    evidence_unquoted_test_variables,
+    evidence_unquoted_variables,
+    evidence_unresolved_references,
+    evidence_unsafe_array_expansion,
+    evidence_unverified_git_clone,
     format_script_violation,
     job_has_effective_script,
     job_has_script_field,
@@ -49,6 +76,19 @@ from src.compliance.script_analysis import (
 from src.compliance.stash import filter_entities, name_starts_with
 
 
+def _shell_check_verbose(context) -> bool:
+    config = getattr(context, "config", None)
+    userdata = getattr(config, "userdata", None) if config is not None else None
+    if not isinstance(userdata, dict):
+        return False
+    return str(userdata.get("shell_check_verbose", "false")).lower() in {
+        "true",
+        "1",
+        "yes",
+        "on",
+    }
+
+
 def _set_stash(context, entities: list[dict]):
     context.stash = list(entities)
     context.step_mode = "given"
@@ -72,32 +112,36 @@ def _apply_filter(context, entities: list[dict], reason: str):
     context.stash = entities
 
 
-def _assert_none(context, predicate, message: str):
+def _assert_none(context, predicate, message: str, evidence=None):
     if context.scenario_skipped:
         return
     context.step_mode = "then"
     if not context.stash:
         raise AssertionError("No entities in stash to assert against.")
-    failures = [
-        format_script_violation(entity, message)
-        for entity in context.stash
-        if predicate(entity)
-    ]
+    verbose = _shell_check_verbose(context)
+    failures = []
+    for entity in context.stash:
+        if not predicate(entity):
+            continue
+        found = evidence(entity) if verbose and evidence is not None else None
+        failures.append(format_script_violation(entity, message, found=found))
     if failures:
         raise AssertionError("; ".join(failures))
 
 
-def _assert_all_true(context, predicate, message: str):
+def _assert_all_true(context, predicate, message: str, evidence=None):
     if context.scenario_skipped:
         return
     context.step_mode = "then"
     if not context.stash:
         raise AssertionError("No entities in stash to assert against.")
-    failures = [
-        format_script_violation(entity, message)
-        for entity in context.stash
-        if not predicate(entity)
-    ]
+    verbose = _shell_check_verbose(context)
+    failures = []
+    for entity in context.stash:
+        if predicate(entity):
+            continue
+        found = evidence(entity) if verbose and evidence is not None else None
+        failures.append(format_script_violation(entity, message, found=found))
     if failures:
         raise AssertionError("; ".join(failures))
 
@@ -230,6 +274,7 @@ def then_variables_quoted(context):
         context,
         script_has_unquoted_variables,
         "Unquoted variable expansions found",
+        evidence=evidence_unquoted_variables,
     )
 
 
@@ -239,6 +284,7 @@ def then_path_variables_quoted(context):
         context,
         script_has_unquoted_path_variables,
         "Unquoted variables used in file paths",
+        evidence=evidence_unquoted_path_variables,
     )
 
 
@@ -248,6 +294,7 @@ def then_cmd_sub_quoted(context):
         context,
         script_has_unquoted_command_substitution,
         "Unquoted command substitution found",
+        evidence=evidence_unquoted_command_substitution,
     )
 
 
@@ -257,6 +304,7 @@ def then_array_at_syntax(context):
         context,
         script_has_unsafe_array_expansion,
         "Unsafe array expansion found",
+        evidence=evidence_unsafe_array_expansion,
     )
 
 
@@ -266,6 +314,7 @@ def then_strict_mode_table(context):
         context,
         script_enables_strict_mode,
         "Multi-line script missing set -e/-u/pipefail",
+        evidence=evidence_missing_strict_mode,
     )
 
 
@@ -277,7 +326,12 @@ def then_failure_handled(context):
             return True
         return not script_masks_failures(entity)
 
-    _assert_all_true(context, ok, "Command failures are not handled explicitly")
+    _assert_all_true(
+        context,
+        ok,
+        "Command failures are not handled explicitly",
+        evidence=evidence_masked_failure,
+    )
 
 
 @then("functions must propagate failures")
@@ -291,6 +345,7 @@ def then_functions_propagate(context):
         context,
         script_functions_mask_failures,
         "Functions mask failures with || true",
+        evidence=evidence_masked_failure,
     )
 
 
@@ -300,6 +355,7 @@ def then_file_paths_quoted(context):
         context,
         script_has_unquoted_path_variables,
         "Unquoted file paths found",
+        evidence=evidence_unquoted_path_variables,
     )
 
 
@@ -309,6 +365,7 @@ def then_mktemp_used(context):
         context,
         script_uses_insecure_temp_files,
         "Insecure temporary file creation without mktemp",
+        evidence=evidence_insecure_temp_files,
     )
 
 
@@ -318,12 +375,18 @@ def then_rm_protected(context):
         context,
         script_has_dangerous_rm,
         "Dangerous recursive rm without path validation",
+        evidence=evidence_dangerous_rm,
     )
 
 
 @then("command substitution must use dollar parentheses")
 def then_no_backticks(context):
-    _assert_none(context, script_uses_backticks, "Legacy backtick substitution found")
+    _assert_none(
+        context,
+        script_uses_backticks,
+        "Legacy backtick substitution found",
+        evidence=evidence_backticks,
+    )
 
 
 @then("nested command substitution must use dollar parentheses")
@@ -332,6 +395,7 @@ def then_nested_dollar(context):
         context,
         script_has_nested_backticks,
         "Nested backtick substitution found",
+        evidence=evidence_nested_backticks,
     )
 
 
@@ -341,6 +405,7 @@ def then_posix_operators(context):
         context,
         script_has_bashism_in_posix_test,
         "Non-portable operators in [ tests",
+        evidence=evidence_bashism_in_posix_test,
     )
 
 
@@ -350,6 +415,7 @@ def then_test_vars_quoted(context):
         context,
         script_has_unquoted_test_variables,
         "Unquoted variables in test expressions",
+        evidence=evidence_unquoted_test_variables,
     )
 
 
@@ -359,12 +425,15 @@ def then_pipefail(context):
         context,
         lambda e: (not script_has_pipeline(e)) or script_has_pipefail(e),
         "Pipeline used without pipefail",
+        evidence=evidence_pipeline_without_pipefail,
     )
 
 
 @then("eval must not be used")
 def then_no_eval(context):
-    _assert_none(context, script_uses_eval, "eval is used in script")
+    _assert_none(
+        context, script_uses_eval, "eval is used in script", evidence=evidence_eval
+    )
 
 
 @then("untrusted remote scripts must not be executed")
@@ -373,6 +442,7 @@ def then_no_remote_pipe(context):
         context,
         script_has_remote_pipe_to_shell,
         "Remote pipe to shell (curl|sh) detected",
+        evidence=evidence_remote_pipe,
     )
 
 
@@ -382,6 +452,7 @@ def then_user_input_safe(context):
         context,
         script_has_unquoted_variables,
         "User/CI variables used without quoting",
+        evidence=evidence_unquoted_variables,
     )
 
 
@@ -391,6 +462,7 @@ def then_no_secrets(context):
         context,
         script_has_hardcoded_secrets,
         "Hardcoded secret pattern detected",
+        evidence=evidence_hardcoded_secrets,
     )
 
 
@@ -400,6 +472,7 @@ def then_downloads_checksum(context):
         context,
         script_downloads_without_checksum,
         "Download without nearby checksum verification",
+        evidence=evidence_download_without_checksum,
     )
 
 
@@ -416,7 +489,12 @@ def then_packages_pinned(context, manager):
     predicate = predicates.get(manager)
     if predicate is None:
         raise AssertionError(f"Unknown package manager '{manager}'")
-    _assert_none(context, predicate, f"Unpinned {manager} package install")
+    _assert_none(
+        context,
+        predicate,
+        f"Unpinned {manager} package install",
+        evidence=lambda entity: evidence_unpinned_manager(entity, manager),
+    )
 
 
 @then("docker commands must pin container images to a tag or sha256 digest")
@@ -425,6 +503,7 @@ def then_docker_images_pinned(context):
         context,
         script_has_unpinned_docker_image,
         "Docker command references an unpinned container image",
+        evidence=evidence_unpinned_docker,
     )
 
 
@@ -434,12 +513,18 @@ def then_git_clone_verified(context):
         context,
         script_has_unverified_git_clone,
         "git clone without commit/tag verification",
+        evidence=evidence_unverified_git_clone,
     )
 
 
 @then("curl must use fail flag")
 def then_curl_fail(context):
-    _assert_none(context, script_curl_missing_fail, "curl without --fail/-f")
+    _assert_none(
+        context,
+        script_curl_missing_fail,
+        "curl without --fail/-f",
+        evidence=evidence_curl_missing_fail,
+    )
 
 
 @then("deprecated CI_BUILD variables must not be used")
@@ -450,6 +535,7 @@ def then_no_ci_build(context):
         context,
         script_uses_deprecated_ci_build_vars,
         "Deprecated $CI_BUILD_* variable used",
+        evidence=evidence_deprecated_ci_build,
     )
 
 
@@ -459,6 +545,7 @@ def then_no_unresolved_refs(context):
         context,
         script_has_unresolved_references,
         "Unresolved !reference in script blocks",
+        evidence=evidence_unresolved_references,
     )
 
 
@@ -468,6 +555,7 @@ def then_shebang_valid(context):
         context,
         lambda e: (not script_has_shebang(e)) or script_shebang_is_valid(e),
         "Invalid shebang in script block",
+        evidence=evidence_invalid_shebang,
     )
 
 
@@ -477,6 +565,7 @@ def then_bash_declared(context):
         context,
         script_bashisms_without_bash_shebang,
         "Bash-specific syntax without bash shebang",
+        evidence=evidence_bashisms_without_bash,
     )
 
 
@@ -486,9 +575,15 @@ def then_posix_no_bashisms(context):
         context,
         script_posix_shebang_with_bashisms,
         "Bashisms used with sh shebang",
+        evidence=evidence_posix_bashisms,
     )
 
 
 @then("chmod 777 must not be used")
 def then_no_chmod_777(context):
-    _assert_none(context, script_has_chmod_777, "chmod 777 is used")
+    _assert_none(
+        context,
+        script_has_chmod_777,
+        "chmod 777 is used",
+        evidence=evidence_chmod_777,
+    )

{gitlab_compliance-2.4.0 → gitlab_compliance-2.5.0}/src/compliance/console.py

@@ -183,14 +183,16 @@ def _summary_table(result: ComplianceResult, *, narrow: bool) -> Table:
     return summary
 
 
-def _scenario_table(result: ComplianceResult, *, width: int) -> Table | None:
+def _scenario_table(
+    result: ComplianceResult, *, width: int, failures_only: bool = False
+) -> Table | None:
     if not result.scenario_results:
         return None
 
     narrow = width < 60
     medium = width < 100
     scenarios = Table(
-        title="Scenarios",
+        title="Scenarios" if not failures_only else "Failed scenarios",
         show_header=True,
         header_style="bold",
         expand=True,
@@ -204,7 +206,10 @@ def _scenario_table(result: ComplianceResult, *, width: int) -> Table | None:
     scenarios.add_column("Policy", overflow="fold")
     scenarios.add_column("Status", justify="center", no_wrap=True)
 
+    rows_added = 0
     for scenario in result.scenario_results:
+        if failures_only and scenario.status != "failed":
+            continue
         style = _STATUS_STYLES.get(scenario.status, "bold white")
         policy = scenario.title or scenario.name
         row: list[str | Text] = []
@@ -214,10 +219,15 @@ def _scenario_table(result: ComplianceResult, *, width: int) -> Table | None:
             row.append(scenario.feature)
         row.extend([policy, Text(scenario.status.upper(), style=style)])
         scenarios.add_row(*row)
+        rows_added += 1
+    if rows_added == 0:
+        return None
     return scenarios
 
 
-def _detail_panels(result: ComplianceResult) -> list[Panel]:
+def _detail_panels(
+    result: ComplianceResult, *, failures_only: bool = False
+) -> list[Panel]:
     blocks: list[Panel] = []
     failures = [
         scenario for scenario in result.scenario_results if scenario.status == "failed"
@@ -248,6 +258,9 @@ def _detail_panels(result: ComplianceResult) -> list[Panel]:
             )
         )
 
+    if failures_only:
+        return blocks
+
     skipped = [
         scenario for scenario in result.scenario_results if scenario.status == "skipped"
     ]
@@ -285,6 +298,7 @@ def render_compliance_console(
     *,
     command_title: str = "check",
     console: Console | None = None,
+    failures_only: bool = False,
 ) -> None:
     """Render a width-aware Rich compliance report."""
     out = console or get_console()
@@ -313,10 +327,10 @@ def render_compliance_console(
     )
     out.print(_summary_table(result, narrow=narrow))
 
-    for block in _detail_panels(result):
+    for block in _detail_panels(result, failures_only=failures_only):
         out.print(block)
 
-    scenarios = _scenario_table(result, width=width)
+    scenarios = _scenario_table(result, width=width, failures_only=failures_only)
     if scenarios is not None:
         out.print(scenarios)
 

{gitlab_compliance-2.4.0 → gitlab_compliance-2.5.0}/src/compliance/render.py

@@ -8,6 +8,7 @@ import json
 import os
 import re
 import xml.etree.ElementTree as ET  # nosec B405 - XML is generated, not parsed
+from dataclasses import replace
 from datetime import datetime, timezone
 
 from src.compliance.models import ComplianceResult, ScenarioResult
@@ -473,34 +474,43 @@ def render_compliance_junit(
     pipeline_file: str,
     *,
     suite_name: str = "gitlab-compliance",
+    failures_only: bool = False,
 ) -> str:
     """Render compliance scenarios as JUnit XML for CI test report artifacts."""
+    scenarios = list(result.scenario_results)
+    if failures_only:
+        scenarios = [s for s in scenarios if s.status == "failed"]
+
+    failed = sum(1 for s in scenarios if s.status == "failed")
+    skipped = sum(1 for s in scenarios if s.status == "skipped")
     root = ET.Element(
         "testsuites",
         {
             "name": suite_name,
-            "tests": str(result.scenarios),
-            "failures": str(result.failed),
+            "tests": str(len(scenarios)),
+            "failures": str(failed),
             "errors": "0",
-            "skipped": str(result.skipped),
+            "skipped": str(skipped),
         },
     )
 
-    for feature, scenarios in _group_scenarios_by_feature(
-        result.scenario_results
-    ).items():
+    for feature, feature_scenarios in _group_scenarios_by_feature(scenarios).items():
         suite = ET.SubElement(
             root,
             "testsuite",
             {
                 "name": feature,
-                "tests": str(len(scenarios)),
-                "failures": str(sum(1 for s in scenarios if s.status == "failed")),
+                "tests": str(len(feature_scenarios)),
+                "failures": str(
+                    sum(1 for s in feature_scenarios if s.status == "failed")
+                ),
                 "errors": "0",
-                "skipped": str(sum(1 for s in scenarios if s.status == "skipped")),
+                "skipped": str(
+                    sum(1 for s in feature_scenarios if s.status == "skipped")
+                ),
             },
         )
-        for scenario in scenarios:
+        for scenario in feature_scenarios:
             testcase = ET.SubElement(
                 suite,
                 "testcase",
@@ -557,6 +567,7 @@ def render_compliance_report(
     output_format: str,
     *,
     suite_name: str = "gitlab-compliance",
+    failures_only: bool = False,
 ) -> str | None:
     fmt = output_format.lower()
     if fmt == "markdown":
@@ -566,7 +577,22 @@ def render_compliance_report(
     if fmt == "mr-comment":
         return render_compliance_mr_comment(result, pipeline_file, features_dir)
     if fmt == "codequality":
+        if failures_only:
+            filtered = [s for s in result.scenario_results if s.status == "failed"]
+            result = replace(
+                result,
+                scenario_results=filtered,
+                scenarios=len(filtered),
+                passed=0,
+                failed=len(filtered),
+                skipped=0,
+            )
         return render_compliance_code_quality(result, pipeline_file)
     if fmt == "junit":
-        return render_compliance_junit(result, pipeline_file, suite_name=suite_name)
+        return render_compliance_junit(
+            result,
+            pipeline_file,
+            suite_name=suite_name,
+            failures_only=failures_only,
+        )
     return None