iam-policy-validator 1.14.4__tar.gz → 1.14.5__tar.gz

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iam-policy-validator
-Version: 1.14.4
+Version: 1.14.5
 Summary: Validate AWS IAM policies for correctness and security using AWS Service Reference API
 Project-URL: Homepage, https://github.com/boogy/iam-policy-validator
 Project-URL: Documentation, https://github.com/boogy/iam-policy-validator/tree/main/docs

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/iam_validator/__version__.py

@@ -3,7 +3,7 @@
 This file is the single source of truth for the package version.
 """
 
-__version__ = "1.14.4"
+__version__ = "1.14.5"
 # Parse version, handling pre-release suffixes like -rc, -alpha, -beta
 _version_base = __version__.split("-", maxsplit=1)[0]  # Remove pre-release suffix if present
 __version_info__ = tuple(int(part) for part in _version_base.split("."))

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/iam_validator/core/label_manager.py

@@ -6,10 +6,11 @@ When those severities are not found, it removes the labels if present.
 """
 
 import logging
+from collections.abc import Callable
 from typing import TYPE_CHECKING
 
 if TYPE_CHECKING:
-    from iam_validator.core.models import PolicyValidationResult, ValidationReport
+    from iam_validator.core.models import PolicyValidationResult, ValidationIssue, ValidationReport
     from iam_validator.integrations.github_integration import GitHubIntegration
 
 logger = logging.getLogger(__name__)
@@ -48,11 +49,17 @@ class LabelManager:
         """
         return bool(self.severity_labels) and self.github.is_configured()
 
-    def _get_severities_in_results(self, results: list["PolicyValidationResult"]) -> set[str]:
+    def _get_severities_in_results(
+        self,
+        results: list["PolicyValidationResult"],
+        is_issue_ignored: Callable[["ValidationIssue", str], bool] | None = None,
+    ) -> set[str]:
         """Extract all severity levels found in validation results.
 
         Args:
             results: List of PolicyValidationResult objects
+            is_issue_ignored: Optional callback to check if an issue is ignored.
+                            Takes (issue, file_path) and returns True if ignored.
 
         Returns:
             Set of severity levels found (e.g., {"error", "critical", "high"})
@@ -60,6 +67,9 @@ class LabelManager:
         severities = set()
         for result in results:
             for issue in result.issues:
+                # Skip ignored issues if a filter is provided
+                if is_issue_ignored and is_issue_ignored(issue, result.policy_file):
+                    continue
                 severities.add(issue.severity)
         return severities
 
@@ -113,17 +123,22 @@ class LabelManager:
         return labels_to_remove
 
     async def manage_labels_from_results(
-        self, results: list["PolicyValidationResult"]
+        self,
+        results: list["PolicyValidationResult"],
+        is_issue_ignored: Callable[["ValidationIssue", str], bool] | None = None,
     ) -> tuple[bool, int, int]:
         """Manage PR labels based on validation results.
 
         This method will:
-        1. Determine which severity levels are present in the results
+        1. Determine which severity levels are present in the results (excluding ignored issues)
         2. Add labels for severities that are found
         3. Remove labels for severities that are not found
 
         Args:
             results: List of PolicyValidationResult objects
+            is_issue_ignored: Optional callback to check if an issue is ignored.
+                            Takes (issue, file_path) and returns True if ignored.
+                            Ignored issues are excluded from label determination.
 
         Returns:
             Tuple of (success, labels_added, labels_removed)
@@ -132,8 +147,8 @@ class LabelManager:
             logger.debug("Label management not enabled (no severity_labels configured)")
             return (True, 0, 0)
 
-        # Get all severities found in results
-        found_severities = self._get_severities_in_results(results)
+        # Get all severities found in results (excluding ignored issues)
+        found_severities = self._get_severities_in_results(results, is_issue_ignored)
         logger.debug(f"Found severities in results: {found_severities}")
 
         # Determine which labels to apply/remove
@@ -182,7 +197,11 @@ class LabelManager:
 
         return (success, added_count, removed_count)
 
-    async def manage_labels_from_report(self, report: "ValidationReport") -> tuple[bool, int, int]:
+    async def manage_labels_from_report(
+        self,
+        report: "ValidationReport",
+        is_issue_ignored: Callable[["ValidationIssue", str], bool] | None = None,
+    ) -> tuple[bool, int, int]:
         """Manage PR labels based on validation report.
 
         This is a convenience method that extracts results from the report
@@ -190,8 +209,11 @@ class LabelManager:
 
         Args:
             report: ValidationReport object
+            is_issue_ignored: Optional callback to check if an issue is ignored.
+                            Takes (issue, file_path) and returns True if ignored.
+                            Ignored issues are excluded from label determination.
 
         Returns:
             Tuple of (success, labels_added, labels_removed)
         """
-        return await self.manage_labels_from_results(report.results)
+        return await self.manage_labels_from_results(report.results, is_issue_ignored)

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/iam_validator/core/pr_commenter.py

@@ -196,7 +196,17 @@ class PRCommenter:
         # Manage PR labels based on severity findings
         if manage_labels and self.severity_labels:
             label_manager = LabelManager(self.github, self.severity_labels)
-            label_success, added, removed = await label_manager.manage_labels_from_report(report)
+
+            # Create a filter function that uses relative paths for ignored finding lookup
+            def is_issue_ignored_for_labels(issue: ValidationIssue, file_path: str) -> bool:
+                relative_path = self._make_relative_path(file_path)
+                if not relative_path:
+                    return False
+                return self._is_issue_ignored(issue, relative_path)
+
+            label_success, added, removed = await label_manager.manage_labels_from_report(
+                report, is_issue_ignored=is_issue_ignored_for_labels
+            )
 
             if not label_success:
                 logger.error("Failed to manage PR labels")

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/iam_validator/integrations/github_integration.py

@@ -1265,6 +1265,26 @@ class GitHubIntegration:
             f"{created_count} created, {deleted_count} deleted (resolved)"
         )
 
+        # Step 4: If no new comments were created but we need to submit APPROVE/REQUEST_CHANGES,
+        # submit a review without inline comments to update the PR review state.
+        # This is important when all issues are ignored/resolved - we need to dismiss
+        # the previous REQUEST_CHANGES review by submitting an APPROVE review.
+        if not new_comments_for_review and event in (
+            ReviewEvent.APPROVE,
+            ReviewEvent.REQUEST_CHANGES,
+        ):
+            # Only submit if there's a meaningful state change to make
+            # (submitting APPROVE when all issues are resolved/ignored)
+            logger.info(f"Submitting {event.value} review (no inline comments)")
+            success = await self.create_review_with_comments(
+                comments=[],
+                body=body or f"<!-- {identifier} -->\nValidation complete.",
+                event=event,
+            )
+            if not success:
+                logger.warning(f"Failed to submit {event.value} review")
+                # Don't fail the whole operation - comments were managed successfully
+
         return True
 
     def _extract_finding_id(self, body: str) -> str | None:

{iam_policy_validator-1.14.4 → iam_policy_validator-1.14.5}/tests/integrations/test_label_manager.py

@@ -399,3 +399,188 @@ class TestLabelManager:
         assert added_labels == {"iam-error", "needs-fix"}
         # Check removed label
         mock_github.remove_label.assert_called_once_with("security-critical")
+
+    # ========== Tests for ignored findings filter ==========
+
+    @pytest.mark.asyncio
+    async def test_manage_labels_with_ignored_filter_excludes_issues(
+        self, mock_github, severity_labels
+    ):
+        """Test that ignored issues are excluded from label determination."""
+        manager = LabelManager(mock_github, severity_labels)
+        mock_github.get_labels = AsyncMock(return_value=[])
+
+        results = [
+            PolicyValidationResult(
+                policy_file="policy1.json",
+                policy_name="TestPolicy1",
+                is_valid=False,
+                issues=[
+                    ValidationIssue(
+                        severity="critical",
+                        statement_index=0,
+                        issue_type="full_wildcard",
+                        message="Full wildcard detected",
+                    ),
+                    ValidationIssue(
+                        severity="error",
+                        statement_index=0,
+                        issue_type="invalid_action",
+                        message="Invalid action",
+                    ),
+                ],
+            ),
+        ]
+
+        # Filter that ignores the critical issue
+        def is_ignored(issue, file_path):
+            return issue.issue_type == "full_wildcard"
+
+        success, added, removed = await manager.manage_labels_from_results(
+            results, is_issue_ignored=is_ignored
+        )
+
+        assert success is True
+        # Only error label should be added (critical is ignored)
+        assert added == 1
+        mock_github.add_labels.assert_called_once()
+        added_labels = mock_github.add_labels.call_args[0][0]
+        assert set(added_labels) == {"iam-validity-error"}
+
+    @pytest.mark.asyncio
+    async def test_manage_labels_all_issues_ignored_removes_labels(
+        self, mock_github, severity_labels
+    ):
+        """Test that when all issues are ignored, corresponding labels are removed."""
+        manager = LabelManager(mock_github, severity_labels)
+        # Current PR has labels from previous run
+        mock_github.get_labels = AsyncMock(
+            return_value=["iam-validity-error", "security-critical"]
+        )
+
+        results = [
+            PolicyValidationResult(
+                policy_file="policy1.json",
+                policy_name="TestPolicy1",
+                is_valid=False,
+                issues=[
+                    ValidationIssue(
+                        severity="critical",
+                        statement_index=0,
+                        issue_type="full_wildcard",
+                        message="Full wildcard detected",
+                    ),
+                    ValidationIssue(
+                        severity="error",
+                        statement_index=0,
+                        issue_type="invalid_action",
+                        message="Invalid action",
+                    ),
+                ],
+            ),
+        ]
+
+        # Filter that ignores ALL issues
+        def is_ignored(issue, file_path):
+            return True
+
+        success, added, removed = await manager.manage_labels_from_results(
+            results, is_issue_ignored=is_ignored
+        )
+
+        assert success is True
+        assert added == 0
+        # Both labels should be removed since all issues are ignored
+        assert removed == 2
+        mock_github.add_labels.assert_not_called()
+        assert mock_github.remove_label.call_count == 2
+
+    @pytest.mark.asyncio
+    async def test_manage_labels_from_report_with_ignored_filter(
+        self, mock_github, severity_labels, sample_results
+    ):
+        """Test manage_labels_from_report passes the filter to manage_labels_from_results."""
+        manager = LabelManager(mock_github, severity_labels)
+        mock_github.get_labels = AsyncMock(return_value=[])
+
+        report = ValidationReport(
+            results=sample_results,
+            total_policies=2,
+            valid_policies=0,
+            invalid_policies=2,
+            total_issues=3,
+        )
+
+        # Filter that ignores critical and high issues
+        def is_ignored(issue, file_path):
+            return issue.severity in ["critical", "high"]
+
+        success, added, removed = await manager.manage_labels_from_report(
+            report, is_issue_ignored=is_ignored
+        )
+
+        assert success is True
+        # Only error label should be added (critical and high are ignored)
+        assert added == 1
+        mock_github.add_labels.assert_called_once()
+        added_labels = mock_github.add_labels.call_args[0][0]
+        assert set(added_labels) == {"iam-validity-error"}
+
+    def test_get_severities_with_filter_excludes_ignored(
+        self, mock_github, severity_labels, sample_results
+    ):
+        """Test _get_severities_in_results respects the filter."""
+        manager = LabelManager(mock_github, severity_labels)
+
+        # Filter that ignores critical issues
+        def is_ignored(issue, file_path):
+            return issue.severity == "critical"
+
+        severities = manager._get_severities_in_results(
+            sample_results, is_issue_ignored=is_ignored
+        )
+        # critical should be excluded
+        assert severities == {"error", "high"}
+
+    def test_get_severities_with_file_path_filter(self, mock_github, severity_labels):
+        """Test that the filter receives the correct file path."""
+        manager = LabelManager(mock_github, severity_labels)
+
+        results = [
+            PolicyValidationResult(
+                policy_file="policies/admin.json",
+                policy_name="AdminPolicy",
+                is_valid=False,
+                issues=[
+                    ValidationIssue(
+                        severity="critical",
+                        statement_index=0,
+                        issue_type="full_wildcard",
+                        message="Full wildcard",
+                    ),
+                ],
+            ),
+            PolicyValidationResult(
+                policy_file="policies/readonly.json",
+                policy_name="ReadOnlyPolicy",
+                is_valid=False,
+                issues=[
+                    ValidationIssue(
+                        severity="error",
+                        statement_index=0,
+                        issue_type="invalid_action",
+                        message="Invalid action",
+                    ),
+                ],
+            ),
+        ]
+
+        # Filter that ignores issues in admin.json
+        def is_ignored(issue, file_path):
+            return "admin.json" in file_path
+
+        severities = manager._get_severities_in_results(
+            results, is_issue_ignored=is_ignored
+        )
+        # critical from admin.json should be excluded
+        assert severities == {"error"}