gitlab-compliance 2.4.0__tar.gz → 2.6.0__tar.gz

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlab-compliance
-Version: 2.4.0
+Version: 2.6.0
 Summary: BDD compliance testing for GitLab CI/CD pipelines and project settings — by MaturityBuilder
 License-Expression: Apache-2.0
 License-File: LICENSE
@@ -34,7 +34,7 @@ Requires-Dist: requests (==2.34.2)
 Requires-Dist: rich (==15.0.0)
 Requires-Dist: semver (==3.0.4)
 Requires-Dist: typer (==0.27.0)
-Requires-Dist: urllib3 (==2.7.0)
+Requires-Dist: urllib3 (==2.8.0)
 Project-URL: Documentation, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Home Page, https://maturitybuilder.github.io/gitlab-compliance/
 Project-URL: Repository, https://github.com/MaturityBuilder/gitlab-compliance

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gitlab-compliance"
-version = "2.4.0"
+version = "2.6.0"
 dynamic = [ "readme" ]
 license = "Apache-2.0"
 requires-python = ">=3.12"
@@ -42,7 +42,7 @@ pytablewriter = "1.2.1"
 oyaml = "*"
 typer = "0.27.0"
 markdown-analysis = "0.1.5"
-urllib3 = "2.7.0"
+urllib3 = "2.8.0"
 jq = "1.12.0"
 click = "^8.1.8"
 semver = "3.0.4"
@@ -62,6 +62,8 @@ gitlab-compliance = 'src.gitlab_compliance:gitlab_compliance'
 [tool.poetry.group.dev.dependencies]
 setuptools = "83.0.0"
 pytest = "^9.0.3"
+pytest-xdist = "^3.8.0"
+pytest-cov = "^6.2.1"
 pre-commit = "^4.6.1"
 pyyaml = "^6.0.3"
 coverage = "^7.9.2"

gitlab_compliance-2.6.0/src/__init__.py

@@ -0,0 +1 @@
+__version__ = "2.4.0"  # x-release-please-version

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/src/compliance/behave_support/steps/script_steps.py

@@ -6,6 +6,33 @@ from behave import given, then, when
 
 from src.compliance.behave_support.environment import _skip_remaining_steps
 from src.compliance.script_analysis import (
+    evidence_backticks,
+    evidence_bashism_in_posix_test,
+    evidence_bashisms_without_bash,
+    evidence_chmod_777,
+    evidence_curl_missing_fail,
+    evidence_dangerous_rm,
+    evidence_deprecated_ci_build,
+    evidence_download_without_checksum,
+    evidence_eval,
+    evidence_hardcoded_secrets,
+    evidence_insecure_temp_files,
+    evidence_invalid_shebang,
+    evidence_masked_failure,
+    evidence_missing_strict_mode,
+    evidence_nested_backticks,
+    evidence_pipeline_without_pipefail,
+    evidence_posix_bashisms,
+    evidence_remote_pipe,
+    evidence_unpinned_docker,
+    evidence_unpinned_manager,
+    evidence_unquoted_command_substitution,
+    evidence_unquoted_path_variables,
+    evidence_unquoted_test_variables,
+    evidence_unquoted_variables,
+    evidence_unresolved_references,
+    evidence_unsafe_array_expansion,
+    evidence_unverified_git_clone,
     format_script_violation,
     job_has_effective_script,
     job_has_script_field,
@@ -49,6 +76,19 @@ from src.compliance.script_analysis import (
 from src.compliance.stash import filter_entities, name_starts_with
 
 
+def _shell_check_verbose(context) -> bool:
+    config = getattr(context, "config", None)
+    userdata = getattr(config, "userdata", None) if config is not None else None
+    if not isinstance(userdata, dict):
+        return False
+    return str(userdata.get("shell_check_verbose", "false")).lower() in {
+        "true",
+        "1",
+        "yes",
+        "on",
+    }
+
+
 def _set_stash(context, entities: list[dict]):
     context.stash = list(entities)
     context.step_mode = "given"
@@ -72,32 +112,36 @@ def _apply_filter(context, entities: list[dict], reason: str):
     context.stash = entities
 
 
-def _assert_none(context, predicate, message: str):
+def _assert_none(context, predicate, message: str, evidence=None):
     if context.scenario_skipped:
         return
     context.step_mode = "then"
     if not context.stash:
         raise AssertionError("No entities in stash to assert against.")
-    failures = [
-        format_script_violation(entity, message)
-        for entity in context.stash
-        if predicate(entity)
-    ]
+    verbose = _shell_check_verbose(context)
+    failures = []
+    for entity in context.stash:
+        if not predicate(entity):
+            continue
+        found = evidence(entity) if verbose and evidence is not None else None
+        failures.append(format_script_violation(entity, message, found=found))
     if failures:
         raise AssertionError("; ".join(failures))
 
 
-def _assert_all_true(context, predicate, message: str):
+def _assert_all_true(context, predicate, message: str, evidence=None):
     if context.scenario_skipped:
         return
     context.step_mode = "then"
     if not context.stash:
         raise AssertionError("No entities in stash to assert against.")
-    failures = [
-        format_script_violation(entity, message)
-        for entity in context.stash
-        if not predicate(entity)
-    ]
+    verbose = _shell_check_verbose(context)
+    failures = []
+    for entity in context.stash:
+        if predicate(entity):
+            continue
+        found = evidence(entity) if verbose and evidence is not None else None
+        failures.append(format_script_violation(entity, message, found=found))
     if failures:
         raise AssertionError("; ".join(failures))
 
@@ -230,6 +274,7 @@ def then_variables_quoted(context):
         context,
         script_has_unquoted_variables,
         "Unquoted variable expansions found",
+        evidence=evidence_unquoted_variables,
     )
 
 
@@ -239,6 +284,7 @@ def then_path_variables_quoted(context):
         context,
         script_has_unquoted_path_variables,
         "Unquoted variables used in file paths",
+        evidence=evidence_unquoted_path_variables,
     )
 
 
@@ -248,6 +294,7 @@ def then_cmd_sub_quoted(context):
         context,
         script_has_unquoted_command_substitution,
         "Unquoted command substitution found",
+        evidence=evidence_unquoted_command_substitution,
     )
 
 
@@ -257,6 +304,7 @@ def then_array_at_syntax(context):
         context,
         script_has_unsafe_array_expansion,
         "Unsafe array expansion found",
+        evidence=evidence_unsafe_array_expansion,
     )
 
 
@@ -266,6 +314,7 @@ def then_strict_mode_table(context):
         context,
         script_enables_strict_mode,
         "Multi-line script missing set -e/-u/pipefail",
+        evidence=evidence_missing_strict_mode,
     )
 
 
@@ -277,7 +326,12 @@ def then_failure_handled(context):
             return True
         return not script_masks_failures(entity)
 
-    _assert_all_true(context, ok, "Command failures are not handled explicitly")
+    _assert_all_true(
+        context,
+        ok,
+        "Command failures are not handled explicitly",
+        evidence=evidence_masked_failure,
+    )
 
 
 @then("functions must propagate failures")
@@ -291,6 +345,7 @@ def then_functions_propagate(context):
         context,
         script_functions_mask_failures,
         "Functions mask failures with || true",
+        evidence=evidence_masked_failure,
     )
 
 
@@ -300,6 +355,7 @@ def then_file_paths_quoted(context):
         context,
         script_has_unquoted_path_variables,
         "Unquoted file paths found",
+        evidence=evidence_unquoted_path_variables,
     )
 
 
@@ -309,6 +365,7 @@ def then_mktemp_used(context):
         context,
         script_uses_insecure_temp_files,
         "Insecure temporary file creation without mktemp",
+        evidence=evidence_insecure_temp_files,
     )
 
 
@@ -318,12 +375,18 @@ def then_rm_protected(context):
         context,
         script_has_dangerous_rm,
         "Dangerous recursive rm without path validation",
+        evidence=evidence_dangerous_rm,
     )
 
 
 @then("command substitution must use dollar parentheses")
 def then_no_backticks(context):
-    _assert_none(context, script_uses_backticks, "Legacy backtick substitution found")
+    _assert_none(
+        context,
+        script_uses_backticks,
+        "Legacy backtick substitution found",
+        evidence=evidence_backticks,
+    )
 
 
 @then("nested command substitution must use dollar parentheses")
@@ -332,6 +395,7 @@ def then_nested_dollar(context):
         context,
         script_has_nested_backticks,
         "Nested backtick substitution found",
+        evidence=evidence_nested_backticks,
     )
 
 
@@ -341,6 +405,7 @@ def then_posix_operators(context):
         context,
         script_has_bashism_in_posix_test,
         "Non-portable operators in [ tests",
+        evidence=evidence_bashism_in_posix_test,
     )
 
 
@@ -350,6 +415,7 @@ def then_test_vars_quoted(context):
         context,
         script_has_unquoted_test_variables,
         "Unquoted variables in test expressions",
+        evidence=evidence_unquoted_test_variables,
     )
 
 
@@ -359,12 +425,15 @@ def then_pipefail(context):
         context,
         lambda e: (not script_has_pipeline(e)) or script_has_pipefail(e),
         "Pipeline used without pipefail",
+        evidence=evidence_pipeline_without_pipefail,
     )
 
 
 @then("eval must not be used")
 def then_no_eval(context):
-    _assert_none(context, script_uses_eval, "eval is used in script")
+    _assert_none(
+        context, script_uses_eval, "eval is used in script", evidence=evidence_eval
+    )
 
 
 @then("untrusted remote scripts must not be executed")
@@ -373,6 +442,7 @@ def then_no_remote_pipe(context):
         context,
         script_has_remote_pipe_to_shell,
         "Remote pipe to shell (curl|sh) detected",
+        evidence=evidence_remote_pipe,
     )
 
 
@@ -382,6 +452,7 @@ def then_user_input_safe(context):
         context,
         script_has_unquoted_variables,
         "User/CI variables used without quoting",
+        evidence=evidence_unquoted_variables,
     )
 
 
@@ -391,6 +462,7 @@ def then_no_secrets(context):
         context,
         script_has_hardcoded_secrets,
         "Hardcoded secret pattern detected",
+        evidence=evidence_hardcoded_secrets,
     )
 
 
@@ -400,6 +472,7 @@ def then_downloads_checksum(context):
         context,
         script_downloads_without_checksum,
         "Download without nearby checksum verification",
+        evidence=evidence_download_without_checksum,
     )
 
 
@@ -416,7 +489,12 @@ def then_packages_pinned(context, manager):
     predicate = predicates.get(manager)
     if predicate is None:
         raise AssertionError(f"Unknown package manager '{manager}'")
-    _assert_none(context, predicate, f"Unpinned {manager} package install")
+    _assert_none(
+        context,
+        predicate,
+        f"Unpinned {manager} package install",
+        evidence=lambda entity: evidence_unpinned_manager(entity, manager),
+    )
 
 
 @then("docker commands must pin container images to a tag or sha256 digest")
@@ -425,6 +503,7 @@ def then_docker_images_pinned(context):
         context,
         script_has_unpinned_docker_image,
         "Docker command references an unpinned container image",
+        evidence=evidence_unpinned_docker,
     )
 
 
@@ -434,12 +513,18 @@ def then_git_clone_verified(context):
         context,
         script_has_unverified_git_clone,
         "git clone without commit/tag verification",
+        evidence=evidence_unverified_git_clone,
     )
 
 
 @then("curl must use fail flag")
 def then_curl_fail(context):
-    _assert_none(context, script_curl_missing_fail, "curl without --fail/-f")
+    _assert_none(
+        context,
+        script_curl_missing_fail,
+        "curl without --fail/-f",
+        evidence=evidence_curl_missing_fail,
+    )
 
 
 @then("deprecated CI_BUILD variables must not be used")
@@ -450,6 +535,7 @@ def then_no_ci_build(context):
         context,
         script_uses_deprecated_ci_build_vars,
         "Deprecated $CI_BUILD_* variable used",
+        evidence=evidence_deprecated_ci_build,
     )
 
 
@@ -459,6 +545,7 @@ def then_no_unresolved_refs(context):
         context,
         script_has_unresolved_references,
         "Unresolved !reference in script blocks",
+        evidence=evidence_unresolved_references,
     )
 
 
@@ -468,6 +555,7 @@ def then_shebang_valid(context):
         context,
         lambda e: (not script_has_shebang(e)) or script_shebang_is_valid(e),
         "Invalid shebang in script block",
+        evidence=evidence_invalid_shebang,
     )
 
 
@@ -477,6 +565,7 @@ def then_bash_declared(context):
         context,
         script_bashisms_without_bash_shebang,
         "Bash-specific syntax without bash shebang",
+        evidence=evidence_bashisms_without_bash,
     )
 
 
@@ -486,9 +575,15 @@ def then_posix_no_bashisms(context):
         context,
         script_posix_shebang_with_bashisms,
         "Bashisms used with sh shebang",
+        evidence=evidence_posix_bashisms,
     )
 
 
 @then("chmod 777 must not be used")
 def then_no_chmod_777(context):
-    _assert_none(context, script_has_chmod_777, "chmod 777 is used")
+    _assert_none(
+        context,
+        script_has_chmod_777,
+        "chmod 777 is used",
+        evidence=evidence_chmod_777,
+    )

gitlab_compliance-2.6.0/src/compliance/builtin_policies/baseline-jobs.feature

@@ -0,0 +1,45 @@
+# METADATA
+# title: Baseline job controls
+# description: Core job image and execution rules bundled with gitlab-compliance.
+# custom:
+#   id: GLCI-BUILTIN-BASELINE
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+Feature: Baseline job controls
+
+# METADATA
+# title: Job images must not use the latest tag
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+  Scenario: Job images must not use the latest tag
+    Given I have any job defined
+    When it has image
+    Then its image must not match ":latest$"
+
+# METADATA
+# title: Non-template jobs must define rules
+# custom:
+#   id: GLCI-BUILTIN-BASELINE-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-1
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.32
+  Scenario: Non-template jobs must define rules
+    Given I have any job defined
+    When its name does not start with "."
+    Then it must contain rules

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/component-inputs.feature

@@ -2,10 +2,27 @@
 # title: Component input constraints
 # description: Advanced Scenario Outline for component inputs and conditional fields.
 # custom:
-#   id: GLCI-BUILTIN-COMPONENT-INPUTS
+#   id: GLCI-BUILTIN-COMPONENT
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
 Feature: Component input constraints
 
+# METADATA
+# title: Component input mode constrains dependent fields
+# custom:
+#   id: GLCI-BUILTIN-COMPONENT-01
+#   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#     - CICD-SEC-8
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario Outline: Component input mode constrains dependent fields
     Given I have include type "component" defined
     When the entity input <input> equals <value>

gitlab_compliance-2.6.0/src/compliance/builtin_policies/include-pinning.feature

@@ -0,0 +1,46 @@
+# METADATA
+# title: Include pinning essentials
+# description: Baseline checks for component and fragment version pinning.
+# custom:
+#   id: GLCI-BUILTIN-INCPIN
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+Feature: Include pinning essentials
+
+# METADATA
+# title: Component includes must not track a branch
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-01
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must not track a branch
+    Given I have include type "component" defined
+    Then its version must not match "^(main|master|develop)$"
+
+# METADATA
+# title: Component includes must use semver
+# custom:
+#   id: GLCI-BUILTIN-INCPIN-02
+#   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-3
+#     - CICD-SEC-9
+#   iso27001:
+#     - A.8.25
+#     - A.8.9
+#     - A.5.19
+  Scenario: Component includes must use semver
+    Given I have include type "component" defined
+    Then its version must match "^\\d+\\.\\d+\\.\\d+(-[\\w.]+)?$"

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-ci-conventions.feature

@@ -2,15 +2,24 @@
 # title: GitLab CI script conventions
 # description: CI-specific hygiene for curl and deprecated variables.
 # custom:
-#   id: GLCI-SHELL-CI
+#   id: GLCI-BUILTIN-SHELL-CI
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.25
+#     - A.8.28
 Feature: GitLab CI script conventions
 
 # METADATA
 # title: curl uses fail flag
 # custom:
-#   id: GLCI-SHELL-CI-001
+#   id: GLCI-BUILTIN-SHELL-CI-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: curl must use fail flag
     Given I have any job with effective script defined
     Then curl must use fail flag
@@ -18,8 +27,13 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: Deprecated CI_BUILD variables are not used
 # custom:
-#   id: GLCI-SHELL-CI-002
+#   id: GLCI-BUILTIN-SHELL-CI-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.9
+#     - A.8.25
   Scenario: Deprecated CI_BUILD variables must not be used
     Given I have any job with effective script defined
     Then deprecated CI_BUILD variables must not be used
@@ -27,8 +41,12 @@ Feature: GitLab CI script conventions
 # METADATA
 # title: CI variables should be quoted
 # custom:
-#   id: GLCI-SHELL-CI-003
+#   id: GLCI-BUILTIN-SHELL-CI-03
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: CI variables should be quoted
     Given I have any job with effective script defined
     Then user supplied variables must be quoted or validated

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-command-substitution.feature

@@ -2,15 +2,23 @@
 # title: Command substitution standards
 # description: Prefer modern dollar-parentheses substitution over backticks.
 # custom:
-#   id: GLCI-SHELL-SUB
+#   id: GLCI-BUILTIN-SHELL-SUB
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Command substitution
 
 # METADATA
 # title: Legacy backticks are not used
 # custom:
-#   id: GLCI-SHELL-SUB-001
+#   id: GLCI-BUILTIN-SHELL-SUB-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Legacy backticks are not used
     Given I have any job with effective script defined
     Then command substitution must use dollar parentheses
@@ -18,8 +26,12 @@ Feature: Command substitution
 # METADATA
 # title: Nested command substitution is readable
 # custom:
-#   id: GLCI-SHELL-SUB-002
+#   id: GLCI-BUILTIN-SHELL-SUB-02
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Nested command substitution is readable
     Given I have any job with effective script defined
     Then nested command substitution must use dollar parentheses

{gitlab_compliance-2.4.0 → gitlab_compliance-2.6.0}/src/compliance/builtin_policies/shell/shell-conditionals.feature

@@ -2,15 +2,23 @@
 # title: Conditional expression standards
 # description: Portable and safely quoted test expressions.
 # custom:
-#   id: GLCI-SHELL-TEST
+#   id: GLCI-BUILTIN-SHELL-TEST
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
 Feature: Conditional expressions
 
 # METADATA
 # title: Test operators are portable
 # custom:
-#   id: GLCI-SHELL-TEST-001
+#   id: GLCI-BUILTIN-SHELL-TEST-01
 #   severity: MEDIUM
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Test operators are portable
     Given I have any job with effective script defined
     Then POSIX compliant operators must be used
@@ -18,8 +26,12 @@ Feature: Conditional expressions
 # METADATA
 # title: Variables are quoted in test statements
 # custom:
-#   id: GLCI-SHELL-TEST-002
+#   id: GLCI-BUILTIN-SHELL-TEST-02
 #   severity: HIGH
+#   owasp_cicd:
+#     - CICD-SEC-7
+#   iso27001:
+#     - A.8.28
   Scenario: Variables are quoted in test statements
     Given I have any job with effective script defined
     Then variables in test expressions must be quoted