proofctl 0.5.4__tar.gz → 0.5.6__tar.gz

{proofctl-0.5.4/proofctl.egg-info → proofctl-0.5.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.4
+Version: 0.5.6
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.5.4 → proofctl-0.5.6}/proofctl/checkers/terraform.py

@@ -1632,12 +1632,41 @@ class TerraformChecker(HclFileChecker):
                 ))
         return out
 
+    # ── GKE Autopilot detection (0.5.6) ──────────────────────────────────
+    #
+    # GKE Autopilot is a managed-node mode where Google forces hardened
+    # defaults that cannot be overridden. Many rules in this family target
+    # `node_config` attributes that are illegal to set on Autopilot
+    # clusters — flagging them produces false positives whose suggested
+    # fix wouldn't even apply.
+    #
+    # The two helpers below let downstream rules skip themselves (or
+    # demote severity) when scanning an Autopilot cluster. The detection
+    # is whole-block string-match — adequate because the attribute name
+    # is unambiguous.
+
+    @staticmethod
+    def _is_gke_autopilot(b: HclBlock) -> bool:
+        """True iff the cluster has `enable_autopilot = true`."""
+        if b.label1 != "google_container_cluster":
+            return False
+        val = (b.attr_value("enable_autopilot") or "").strip().lower()
+        return val == "true"
+
+    @staticmethod
+    def _has_workload_identity(b: HclBlock) -> bool:
+        """True iff `workload_identity_config { … }` block is nested."""
+        return b.has_nested("workload_identity_config")
+
     def _g034(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """G-034 — GKE cluster missing explicit enable_legacy_abac = false."""
         out = []
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_container_cluster":
                 continue
+            # Autopilot: legacy ABAC is forced false and unchangeable.
+            if self._is_gke_autopilot(b):
+                continue
             val = b.attr_value("enable_legacy_abac")
             if val is None:
                 # Absent — provider default is false now, but old default was true.
@@ -1680,6 +1709,10 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot: node_config is not settable and Autopilot forces
+            # disable-legacy-endpoints = "true" by default. Skip.
+            if b.label1 == "google_container_cluster" and self._is_gke_autopilot(b):
+                continue
             # Heuristic: require disable-legacy-endpoints = "true" anywhere in the block.
             if not b.contains(r'disable-legacy-endpoints\s*=\s*"true"'):
                 out.append(self._f(
@@ -1699,6 +1732,10 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot: shielded VM is forced on and node_config is not
+            # settable. The suggested fix would even fail provider validation.
+            if b.label1 == "google_container_cluster" and self._is_gke_autopilot(b):
+                continue
             has_block = b.contains(r'shielded_instance_config\s*\{')
             has_secure = b.contains(r'enable_secure_boot\s*=\s*true')
             has_integrity = b.contains(r'enable_integrity_monitoring\s*=\s*true')
@@ -1716,14 +1753,23 @@ class TerraformChecker(HclFileChecker):
 
     def _g038(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """G-038 — GKE cluster without release_channel pinned to STABLE/REGULAR/RAPID."""
-        _channel_re = re.compile(r'channel\s*=\s*"(STABLE|REGULAR|RAPID)"')
+        _channel_literal_re = re.compile(r'channel\s*=\s*"(STABLE|REGULAR|RAPID)"')
+        # `channel = var.something` is also a valid pin — the value comes
+        # from a typed variable, not a hardcoded mistake. Recognise it.
+        _channel_var_re = re.compile(r'channel\s*=\s*var\.[a-zA-Z_][a-zA-Z0-9_]*')
+        # `channel = local.something` similarly.
+        _channel_local_re = re.compile(r'channel\s*=\s*local\.[a-zA-Z_][a-zA-Z0-9_]*')
         out = []
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_container_cluster":
                 continue
             body = "\n".join(b.raw_lines)
             has_block = bool(re.search(r'release_channel\s*\{', body))
-            has_channel = bool(_channel_re.search(body))
+            has_channel = (
+                bool(_channel_literal_re.search(body))
+                or bool(_channel_var_re.search(body))
+                or bool(_channel_local_re.search(body))
+            )
             if not has_block or not has_channel:
                 out.append(self._f(
                     path, b.start_line,
@@ -1747,10 +1793,16 @@ class TerraformChecker(HclFileChecker):
                 continue
             val = (b.attr_value("enable_shielded_nodes") or "").strip().lower()
             if val != "true":
+                # Autopilot: shielded nodes are forced on regardless. The
+                # explicit attribute remains useful as documentation — demote
+                # severity to INFO so the gate doesn't fail prod CI on it.
+                severity = (
+                    Severity.INFO if self._is_gke_autopilot(b) else Severity.WARNING
+                )
                 out.append(self._f(
                     path, b.attr_line("enable_shielded_nodes") or b.start_line,
                     "PROOFCTL-TF-G040", "GKE shielded nodes not enabled",
-                    Severity.WARNING,
+                    severity,
                     f'Cluster "{b.label2}" has enable_shielded_nodes not set to true',
                     hint="Set enable_shielded_nodes = true on the cluster.",
                     authority="CIS GKE Benchmark 6.5.5",
@@ -1765,6 +1817,17 @@ class TerraformChecker(HclFileChecker):
         for b in blocks:
             if b.kind != "resource" or b.label1 not in ("google_container_cluster", "google_container_node_pool"):
                 continue
+            # Autopilot + Workload Identity: workloads get GCP API access via
+            # Workload Identity bindings to GSAs, not via the node SA. The
+            # node SA is mostly inert. Skip the warning when the cluster is
+            # Autopilot AND has workload_identity_config — that's the
+            # recommended Autopilot security model.
+            if (
+                b.label1 == "google_container_cluster"
+                and self._is_gke_autopilot(b)
+                and self._has_workload_identity(b)
+            ):
+                continue
             body = "\n".join(b.raw_lines)
             uses_default = bool(_default_sa_re.search(body))
             # Absence of any service_account inside node_config also implies default SA.

{proofctl-0.5.4 → proofctl-0.5.6/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.5.4
+Version: 0.5.6
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT

{proofctl-0.5.4 → proofctl-0.5.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.5.4"
+version = "0.5.6"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }