gitlabcis 1.3.2__py3-none-any.whl

gitlabcis/tests/unit/benchmarks/build_pipelines_2/pipeline_instructions_2_3_test.py

@@ -0,0 +1,340 @@
+# -----------------------------------------------------------------------------
+
+import base64
+from unittest.mock import Mock, patch
+
+import pytest  # noqa: F401
+import yaml
+from conftest import run
+from gitlab.exceptions import GitlabHttpError
+
+from gitlabcis.benchmarks.build_pipelines_2 import pipeline_instructions_2_3
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.getConfig')
+def test_build_steps_as_code(mockGetConfig, glEntity, glObject):
+
+    test = pipeline_instructions_2_3.build_steps_as_code
+
+    mockGetConfig.return_value = {'gitlab-ci.yml': 'content'}
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.return_value = {None: 'No CI file found'}
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.return_value = {False: 'Invalid CI file'}
+    run(glEntity, glObject, test, False)
+
+    mockGetConfig.side_effect = GitlabHttpError('Error', response_code=401)
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.side_effect = GitlabHttpError('Error', response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.getConfig')
+def test_build_stage_io(mockGetConfig, glEntity, glObject):
+
+    test = pipeline_instructions_2_3.build_stage_io
+
+    def setup_ci_yaml(yaml_content):
+        mock_file = Mock()
+        mock_file.content = base64.b64encode(
+            yaml.dump(
+                yaml_content
+            ).encode()).decode('utf-8')
+        return {mock_file: 'reason'}
+
+    mockGetConfig.return_value = {None: 'No CI file found'}
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.return_value = setup_ci_yaml({})
+    run(glEntity, glObject, test, False)
+
+    mockGetConfig.return_value = setup_ci_yaml({'stages': ['test']})
+    run(glEntity, glObject, test, False)
+
+    mockGetConfig.return_value = setup_ci_yaml({'stages': ['build', 'test']})
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.return_value = setup_ci_yaml({
+        'stages': ['build', 'test'],
+        'build_job': {'stage': 'build'}
+    })
+    run(glEntity, glObject, test, False)
+
+    mockGetConfig.return_value = setup_ci_yaml({
+        'stages': ['build', 'test'],
+        'build_job': {'stage': 'build', 'script': ['echo "Building"']}
+    })
+    run(glEntity, glObject, test, False)
+
+    mockGetConfig.return_value = setup_ci_yaml({
+        'stages': ['build', 'test'],
+        'build_job': {
+            'stage': 'build',
+            'script': ['echo "Building"'],
+            'artifacts': {'paths': ['build/']}
+        }
+    })
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=403)
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None
+
+
+# -----------------------------------------------------------------------------
+
+
+def test_secure_pipeline_output(glEntity, glObject):
+
+    test = pipeline_instructions_2_3.secure_pipeline_output
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.getConfig')
+def test_track_pipeline_files(mockGetConfig, glEntity, glObject):
+
+    test = pipeline_instructions_2_3.track_pipeline_files
+
+    mockGetConfig.return_value = {None: 'No CI file found'}
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.return_value = {'real-fake-file': 'i promise'}
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=403)
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+def test_limit_pipeline_triggers(glEntity, glObject):
+
+    test = pipeline_instructions_2_3.limit_pipeline_triggers
+
+    glEntity.protected_environments.list.return_value = []
+    run(glEntity, glObject, test, False)
+
+    glEntity.protected_environments.list.return_value = [Mock()]
+    run(glEntity, glObject, test, None)
+
+    glEntity.protected_environments.list.side_effect = GitlabHttpError(
+        response_code=403)
+    run(glEntity, glObject, test, None)
+
+    glEntity.protected_environments.list.side_effect = GitlabHttpError(
+        response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+def test_pipeline_misconfiguration_scanning(glEntity, glObject, gqlClient):
+
+    test = pipeline_instructions_2_3.pipeline_misconfiguration_scanning
+
+    kwargs = {
+        'graphQLEndpoint': 'https://example.com/graphql',
+        'graphQLHeaders': {'Authorization': 'Bearer token'}
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                            actions:
+                              - scan: sast
+                              - scan: dast
+                              - scan: secret_detection
+                              - scan: cluster_image_scanning
+                              - scan: container_scanning
+                              - scan: sast_iac
+                              - scan: dependency_scanning
+                            rules:
+                              - type: pipeline
+                                branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, True, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                            actions:
+                              - scan: sast
+                              - scan: dast
+                            rules:
+                              - type: pipeline
+                                branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, True, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                            actions:
+                              - scan: secret_detection
+                            rules:
+                              - type: pipeline
+                                branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {'project': {}}
+    run(glEntity, glObject, test, False, **kwargs)
+
+# -----------------------------------------------------------------------------
+
+
+def test_pipeline_vuln_scanning(glEntity, glObject, gqlClient):
+
+    test = pipeline_instructions_2_3.pipeline_vuln_scanning
+
+    kwargs = {
+        'graphQLEndpoint': 'https://example.com/graphql',
+        'graphQLHeaders': {'Authorization': 'Bearer token'}
+    }
+    glEntity.path_with_namespace = 'test/project'
+
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                        actions:
+                          - scan: sast
+                          - scan: dast
+                          - scan: secret_detection
+                          - scan: cluster_image_scanning
+                          - scan: container_scanning
+                          - scan: sast_iac
+                          - scan: dependency_scanning
+                        rules:
+                          - type: pipeline
+                            branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, True, **kwargs)
+
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                        actions:
+                          - scan: sast
+                          - scan: dast
+                        rules:
+                          - type: pipeline
+                            branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, True, **kwargs)
+
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': [
+                    {
+                        'enabled': True,
+                        'yaml': '''
+                        actions:
+                          - scan: secret_detection
+                        rules:
+                          - type: pipeline
+                            branches: ['*']
+                        '''
+                    }
+                ]
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    gqlClient.return_value.execute.return_value = {
+        'project': {
+            'scanExecutionPolicies': {
+                'nodes': []
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    gqlClient.return_value.execute.return_value = {}
+    run(glEntity, glObject, test, False, **kwargs)
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.searchConfig')
+def test_pipeline_secret_scanning(mockSearchConfig, glEntity, glObject):
+
+    test = pipeline_instructions_2_3.pipeline_secret_scanning
+
+    mockSearchConfig.return_value = {True: 'Secret-Detection found'}
+    run(glEntity, glObject, test, True)
+
+    mockSearchConfig.return_value = {False: 'Secret-Detection not found'}
+    run(glEntity, glObject, test, False)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=401)
+    run(glEntity, glObject, test, None)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None

gitlabcis/tests/unit/benchmarks/build_pipelines_2/pipeline_integrity_2_4_test.py

@@ -0,0 +1,115 @@
+# -----------------------------------------------------------------------------
+
+import base64
+from unittest.mock import Mock, patch
+
+import pytest  # noqa: F401
+import yaml
+from conftest import run
+from gitlab.exceptions import GitlabHttpError
+
+from gitlabcis.benchmarks.build_pipelines_2 import pipeline_integrity_2_4
+
+# -----------------------------------------------------------------------------
+
+
+def test_sign_artifacts(glEntity, glObject):
+
+    test = pipeline_integrity_2_4.sign_artifacts
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_lock_dependencies(glEntity, glObject):
+
+    test = pipeline_integrity_2_4.lock_dependencies
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.searchConfig')
+def test_validate_dependencies(mockSearchConfig, glEntity, glObject):
+
+    test = pipeline_integrity_2_4.validate_dependencies
+
+    mockSearchConfig.return_value = {True: 'Dependency Scanning found'}
+    run(glEntity, glObject, test, True)
+
+    mockSearchConfig.return_value = {False: 'Dependency Scanning not found'}
+    run(glEntity, glObject, test, False)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=401)
+    run(glEntity, glObject, test, None)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.getConfig')
+def test_create_reproducible_artifacts(mockGetConfig, glEntity, glObject):
+
+    test = pipeline_integrity_2_4.create_reproducible_artifacts
+
+    def setup_ci_yaml(yaml_content):
+        mock_file = Mock()
+        mock_file.content = base64.b64encode(
+            yaml.dump(
+                yaml_content
+            ).encode()).decode('utf-8')
+        return {mock_file: 'reason'}
+
+    mockGetConfig.return_value = {None: 'File not found'}
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.return_value = setup_ci_yaml({})
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.return_value = setup_ci_yaml({'stages': ['test']})
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.return_value = setup_ci_yaml({
+        'stages': ['build', 'test'],
+        'build_job': {'stage': 'build', 'artifacts': {'paths': ['**/*']}}
+    })
+    run(glEntity, glObject, test, True)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=401)
+    run(glEntity, glObject, test, None)
+
+    mockGetConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+@patch('gitlabcis.utils.ci.searchConfig')
+def test_pipeline_produces_sbom(mockSearchConfig, glEntity, glObject):
+
+    test = pipeline_integrity_2_4.pipeline_produces_sbom
+
+    mockSearchConfig.return_value = {True: 'Dependency Scanning found'}
+    run(glEntity, glObject, test, True)
+
+    mockSearchConfig.return_value = {False: 'Dependency Scanning not found'}
+    run(glEntity, glObject, test, False)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=401)
+    run(glEntity, glObject, test, None)
+
+    mockSearchConfig.side_effect = GitlabHttpError(response_code=418)
+    assert test(glEntity, glObject) is None
+
+# -----------------------------------------------------------------------------
+
+
+def test_pipeline_sign_sbom(glEntity, glObject):
+
+    test = pipeline_integrity_2_4.pipeline_sign_sbom
+
+    run(glEntity, glObject, test, None)

gitlabcis/tests/unit/benchmarks/conftest.py

@@ -0,0 +1,47 @@
+# -----------------------------------------------------------------------------
+
+from unittest.mock import Mock, patch
+
+import pytest
+
+# -----------------------------------------------------------------------------
+
+
+@pytest.fixture(scope="function")
+def glEntity():
+    # mock a project:
+    return Mock()
+
+# -----------------------------------------------------------------------------
+
+
+@pytest.fixture(scope="function")
+def glObject(glEntity):
+    # mock a gitlab object:
+    return Mock()
+
+# -----------------------------------------------------------------------------
+
+
+@pytest.fixture(scope="function")
+def unauthorised():
+    from gitlab.exceptions import GitlabGetError
+
+    # mock an unauthorised gitlab object:
+    return Mock(side_effect=GitlabGetError(response_code=401))
+
+# -----------------------------------------------------------------------------
+
+
+@pytest.fixture
+def gqlClient():
+    with patch('gql.Client') as mock:
+        yield mock
+
+# -----------------------------------------------------------------------------
+
+
+def run(glEntity, glObject, test, expectedResult, **kwargs):
+    actualResult = test(glEntity, glObject, **kwargs)
+    print(f'{expectedResult=} - {actualResult=}')
+    assert next(iter(actualResult)) is expectedResult

gitlabcis/tests/unit/benchmarks/dependencies_3/third_party_packages_3_1_test.py

@@ -0,0 +1,135 @@
+# -----------------------------------------------------------------------------
+
+import pytest  # noqa: F401
+from conftest import run
+
+from gitlabcis.benchmarks.dependencies_3 import third_party_packages_3_1
+
+# -----------------------------------------------------------------------------
+
+
+def test_verify_artifacts(glEntity, glObject):
+
+    test = third_party_packages_3_1.verify_artifacts
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_third_party_sbom_required(glEntity, glObject):
+
+    test = third_party_packages_3_1.third_party_sbom_required
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_verify_signed_metadata(glEntity, glObject):
+
+    test = third_party_packages_3_1.verify_signed_metadata
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_monitor_dependencies(glEntity, glObject, gqlClient):
+    from gql.transport.exceptions import TransportServerError
+
+    test = third_party_packages_3_1.monitor_dependencies
+
+    kwargs = {
+        'graphQLEndpoint': 'https://example.com/graphql',
+        'graphQLHeaders': {'Authorization': 'Bearer token'}
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        "project": {
+            "securityScanners": {
+                "enabled": ["DEPENDENCY_SCANNING", "CONTAINER_SCANNING"]
+            }
+        }
+    }
+    run(glEntity, glObject, test, True, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        "project": {
+            "securityScanners": {
+                "enabled": ["DEPENDENCY_SCANNING"]
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        "project": {
+            "securityScanners": {
+                "enabled": ["CONTAINER_SCANNING"]
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        "project": {
+            "securityScanners": {
+                "enabled": []
+            }
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    glEntity.path_with_namespace = 'test/project'
+    gqlClient.return_value.execute.return_value = {
+        "project": {
+            "securityScanners": {}
+        }
+    }
+    run(glEntity, glObject, test, False, **kwargs)
+
+    gqlClient.return_value.execute.side_effect = \
+        TransportServerError('GraphQL Error')
+    run(glEntity, glObject, test, None, **kwargs)
+
+# -----------------------------------------------------------------------------
+
+
+def test_define_package_managers(glEntity, glObject):
+
+    test = third_party_packages_3_1.define_package_managers
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_dependency_sbom(glEntity, glObject):
+
+    test = third_party_packages_3_1.dependency_sbom
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_pin_dependency_version(glEntity, glObject):
+
+    test = third_party_packages_3_1.pin_dependency_version
+
+    run(glEntity, glObject, test, None)
+
+# -----------------------------------------------------------------------------
+
+
+def test_packages_over_60_days_old(glEntity, glObject):
+
+    test = third_party_packages_3_1.packages_over_60_days_old
+
+    run(glEntity, glObject, test, None)