Skip to content

Commit cada804

Browse files
temblekingtembleking
committed
refactor: move ActionInputs to a class
1 parent 55113c7 commit cada804

File tree

8 files changed

+439
-339
lines changed

8 files changed

+439
-339
lines changed

‎dist/index.js

Lines changed: 194 additions & 132 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎dist/index.js.map

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎index.ts

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
import * as core from '@actions/core';
22
import fs from 'fs';
33
import { generateSARIFReport } from './src/sarif';
4-
import { cliScannerName, cliScannerResult, cliScannerURL, composeFlags, executeScan, numericPriorityForSeverity, pullScanner, ScanExecutionResult, vmMode } from './src/scanner';
5-
import { ActionInputs, defaultSecureEndpoint, parseActionInputs, printOptions, validateInput } from './src/action';
4+
import { cliScannerName, cliScannerResult, cliScannerURL, executeScan, numericPriorityForSeverity, pullScanner, ScanExecutionResult, vmMode } from './src/scanner';
5+
import { ActionInputs, defaultSecureEndpoint } from './src/action';
66
import { generateSummary } from './src/summary';
77
import { Report } from './src/report';
88

@@ -20,10 +20,9 @@ function writeReport(reportData: string) {
2020
export async function run() {
2121

2222
try {
23-
let opts = parseActionInputs();
24-
validateInput(opts)
25-
printOptions(opts);
26-
let scanFlags = composeFlags(opts); // FIXME(fede) this also modifies the opts.cliScannerURL, which is something we don't want
23+
let opts = ActionInputs.parseActionInputs();
24+
opts.printOptions();
25+
let scanFlags = opts.composeFlags();
2726

2827
let scanResult: ScanExecutionResult;
2928
// Download CLI Scanner from 'cliScannerURL'
@@ -35,7 +34,8 @@ export async function run() {
3534
retCode = scanResult.ReturnCode;
3635
if (retCode == 0 || retCode == 1) {
3736
// Transform Scan Results to other formats such as SARIF
38-
if (opts.mode && opts.mode == vmMode) {
37+
38+
if (opts.mode == vmMode) {
3939
await processScanResult(scanResult, opts);
4040
}
4141
} else {
@@ -103,11 +103,8 @@ export async function processScanResult(result: ScanExecutionResult, opts: Actio
103103
}
104104

105105
export {
106-
parseActionInputs,
107-
validateInput,
108106
cliScannerURL,
109107
defaultSecureEndpoint,
110-
composeFlags,
111108
pullScanner,
112109
cliScannerName,
113110
executeScan,

‎src/action.ts

Lines changed: 211 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
11
import * as core from '@actions/core';
2-
import { cliScannerURL, iacMode, vmMode } from './scanner';
2+
import { cliScannerResult, cliScannerURL, ComposeFlags, iacMode, scannerURLForVersion, vmMode } from './scanner';
33

44
export const defaultSecureEndpoint = "https://secure.sysdig.com/"
55

6-
export interface ActionInputs {
6+
interface ActionInputParameters {
77
cliScannerURL: string;
88
cliScannerVersion: string;
99
registryUser: string;
@@ -29,89 +29,240 @@ export interface ActionInputs {
2929
iacScanPath: string;
3030
}
3131

32-
export function parseActionInputs() : ActionInputs {
33-
return {
34-
cliScannerURL: core.getInput('cli-scanner-url') || cliScannerURL,
35-
cliScannerVersion: core.getInput('cli-scanner-version'),
36-
registryUser: core.getInput('registry-user'),
37-
registryPassword: core.getInput('registry-password'),
38-
stopOnFailedPolicyEval: core.getInput('stop-on-failed-policy-eval') == 'true',
39-
stopOnProcessingError: core.getInput('stop-on-processing-error') == 'true',
40-
standalone: core.getInput('standalone') == 'true',
41-
dbPath: core.getInput('db-path'),
42-
skipUpload: core.getInput('skip-upload') == 'true',
43-
skipSummary: core.getInput('skip-summary') == 'true',
44-
usePolicies: core.getInput('use-policies'),
45-
overridePullString: core.getInput('override-pullstring'),
46-
imageTag: core.getInput('image-tag'),
47-
sysdigSecureToken: core.getInput('sysdig-secure-token'),
48-
sysdigSecureURL: core.getInput('sysdig-secure-url') || defaultSecureEndpoint,
49-
sysdigSkipTLS: core.getInput('sysdig-skip-tls') == 'true',
50-
severityAtLeast: core.getInput('severity-at-least') || undefined,
51-
groupByPackage: core.getInput('group-by-package') == 'true',
52-
extraParameters: core.getInput('extra-parameters'),
53-
mode: core.getInput('mode') || vmMode,
54-
recursive: core.getInput('recursive') == 'true',
55-
minimumSeverity: core.getInput('minimum-severity'),
56-
iacScanPath: core.getInput('iac-scan-path') || './'
32+
export class ActionInputs {
33+
private readonly _params: ActionInputParameters;
34+
public get params(): ActionInputParameters {
35+
return this._params;
36+
}
37+
private constructor(params: ActionInputParameters) {
38+
ActionInputs.validateInputs(params);
39+
this._params = params;
5740
}
58-
}
5941

60-
export function validateInput(opts: ActionInputs) {
61-
if (!opts.standalone && !opts.sysdigSecureToken) {
62-
core.setFailed("Sysdig Secure Token is required for standard execution, please set your token or remove the standalone input.");
63-
throw new Error("Sysdig Secure Token is required for standard execution, please set your token or remove the standalone input.");
42+
static from(any: any): ActionInputs {
43+
return new ActionInputs(any as ActionInputParameters);
6444
}
6545

66-
if (opts.mode && opts.mode == vmMode && !opts.imageTag) {
67-
core.setFailed("image-tag is required for VM mode.");
68-
throw new Error("image-tag is required for VM mode.");
46+
static fromJSON(jsonContents: string): ActionInputs {
47+
return ActionInputs.from(JSON.parse(jsonContents))
6948
}
7049

71-
if (opts.mode && opts.mode == iacMode && opts.iacScanPath == "") {
72-
core.setFailed("iac-scan-path can't be empty, please specify the path you want to scan your manifest resources.");
73-
throw new Error("iac-scan-path can't be empty, please specify the path you want to scan your manifest resources.");
50+
static parseActionInputs(): ActionInputs {
51+
return ActionInputs.overridingParsedActionInputs({});
7452
}
75-
}
7653

77-
export function printOptions(opts: ActionInputs) {
78-
if (opts.standalone) {
79-
core.info(`[!] Running in Standalone Mode.`);
54+
static overridingParsedActionInputs(overrides: { [key: string]: any }) {
55+
56+
const params: ActionInputParameters = {
57+
cliScannerURL: core.getInput('cli-scanner-url') || cliScannerURL,
58+
cliScannerVersion: core.getInput('cli-scanner-version'),
59+
registryUser: core.getInput('registry-user'),
60+
registryPassword: core.getInput('registry-password'),
61+
stopOnFailedPolicyEval: core.getInput('stop-on-failed-policy-eval') == 'true',
62+
stopOnProcessingError: core.getInput('stop-on-processing-error') == 'true',
63+
standalone: core.getInput('standalone') == 'true',
64+
dbPath: core.getInput('db-path'),
65+
skipUpload: core.getInput('skip-upload') == 'true',
66+
skipSummary: core.getInput('skip-summary') == 'true',
67+
usePolicies: core.getInput('use-policies'),
68+
overridePullString: core.getInput('override-pullstring'),
69+
imageTag: core.getInput('image-tag'),
70+
sysdigSecureToken: core.getInput('sysdig-secure-token'),
71+
sysdigSecureURL: core.getInput('sysdig-secure-url') || defaultSecureEndpoint,
72+
sysdigSkipTLS: core.getInput('sysdig-skip-tls') == 'true',
73+
severityAtLeast: core.getInput('severity-at-least') || undefined,
74+
groupByPackage: core.getInput('group-by-package') == 'true',
75+
extraParameters: core.getInput('extra-parameters'),
76+
mode: core.getInput('mode') || vmMode,
77+
recursive: core.getInput('recursive') == 'true',
78+
minimumSeverity: core.getInput('minimum-severity'),
79+
iacScanPath: core.getInput('iac-scan-path') || './',
80+
};
81+
82+
const overridenParams = {
83+
...params,
84+
...overrides,
85+
};
86+
87+
88+
return ActionInputs.from(overridenParams);
8089
}
8190

82-
if (opts.sysdigSecureURL) {
83-
core.info('Sysdig Secure URL: ' + opts.sysdigSecureURL);
91+
get cliScannerURL(): string {
92+
return this.params.cliScannerURL
8493
}
8594

86-
if (opts.registryUser && opts.registryPassword) {
87-
core.info(`Using specified Registry credentials.`);
95+
get mode() {
96+
return this.params.mode || vmMode;
8897
}
8998

90-
core.info(`Stop on Failed Policy Evaluation: ${opts.stopOnFailedPolicyEval}`);
99+
get stopOnProcessingError() {
100+
return this.params.stopOnProcessingError
101+
}
91102

92-
core.info(`Stop on Processing Error: ${opts.stopOnProcessingError}`);
103+
get standalone() {
104+
return this.params.standalone
105+
}
93106

94-
if (opts.skipUpload) {
95-
core.info(`Skipping scan results upload to Sysdig Secure...`);
107+
get stopOnFailedPolicyEval() {
108+
return this.params.stopOnFailedPolicyEval
96109
}
97110

98-
if (opts.dbPath) {
99-
core.info(`DB Path: ${opts.dbPath}`);
111+
get skipSummary() {
112+
return this.params.skipSummary
100113
}
101114

102-
core.info(`Sysdig skip TLS: ${opts.sysdigSkipTLS}`);
115+
get groupByPackage(): boolean {
116+
return this.params.groupByPackage
117+
}
103118

104-
if (opts.severityAtLeast) {
105-
core.info(`Severity level: ${opts.severityAtLeast}`);
119+
get severityAtLeast() {
120+
return this.params.severityAtLeast
106121
}
107122

108-
core.info('Analyzing image: ' + opts.imageTag);
123+
get imageTag() {
124+
return this.params.imageTag
125+
}
109126

110-
if (opts.overridePullString) {
111-
core.info(` * Image PullString will be overwritten as ${opts.overridePullString}`);
127+
get overridePullString() {
128+
return this.params.overridePullString
112129
}
113130

114-
if (opts.skipSummary) {
115-
core.info("This run will NOT generate a SUMMARY.");
131+
private static validateInputs(params: ActionInputParameters) {
132+
if (!params.standalone && !params.sysdigSecureToken) {
133+
core.setFailed("Sysdig Secure Token is required for standard execution, please set your token or remove the standalone input.");
134+
throw new Error("Sysdig Secure Token is required for standard execution, please set your token or remove the standalone input.");
135+
}
136+
137+
if (params.mode && params.mode == vmMode && !params.imageTag) {
138+
core.setFailed("image-tag is required for VM mode.");
139+
throw new Error("image-tag is required for VM mode.");
140+
}
141+
142+
if (params.mode && params.mode == iacMode && params.iacScanPath == "") {
143+
core.setFailed("iac-scan-path can't be empty, please specify the path you want to scan your manifest resources.");
144+
throw new Error("iac-scan-path can't be empty, please specify the path you want to scan your manifest resources.");
145+
}
146+
}
147+
148+
// FIXME(fede) this also modifies the opts.cliScannerURL, which is something we don't want
149+
public composeFlags(): ComposeFlags {
150+
if (this.params.cliScannerVersion && this.params.cliScannerURL == cliScannerURL) {
151+
this.params.cliScannerURL = scannerURLForVersion(this.params.cliScannerVersion)
152+
}
153+
154+
let envvars: { [key: string]: string } = {}
155+
envvars['SECURE_API_TOKEN'] = this.params.sysdigSecureToken || "";
156+
157+
let flags = ""
158+
159+
if (this.params.registryUser) {
160+
envvars['REGISTRY_USER'] = this.params.registryUser;
161+
}
162+
163+
if (this.params.registryPassword) {
164+
envvars['REGISTRY_PASSWORD'] = this.params.registryPassword;
165+
}
166+
167+
if (this.params.standalone) {
168+
flags += " --standalone";
169+
}
170+
171+
if (this.params.sysdigSecureURL) {
172+
flags += ` --apiurl ${this.params.sysdigSecureURL}`;
173+
}
174+
175+
if (this.params.dbPath) {
176+
flags += ` --dbpath=${this.params.dbPath}`;
177+
}
178+
179+
if (this.params.skipUpload) {
180+
flags += ' --skipupload';
181+
}
182+
183+
if (this.params.usePolicies) {
184+
flags += ` --policy=${this.params.usePolicies}`;
185+
}
186+
187+
if (this.params.sysdigSkipTLS) {
188+
flags += ` --skiptlsverify`;
189+
}
190+
191+
if (this.params.overridePullString) {
192+
flags += ` --override-pullstring=${this.params.overridePullString}`;
193+
}
194+
195+
if (this.params.extraParameters) {
196+
flags += ` ${this.params.extraParameters}`;
197+
}
198+
199+
if (this.params.mode && this.params.mode == iacMode) {
200+
flags += ` --iac`;
201+
}
202+
203+
if (this.params.recursive && this.params.mode == iacMode) {
204+
flags += ` -r`;
205+
}
206+
207+
if (this.params.minimumSeverity && this.params.mode == iacMode) {
208+
flags += ` -f=${this.params.minimumSeverity}`;
209+
}
210+
211+
if (this.params.mode && this.params.mode == vmMode) {
212+
flags += ` --json-scan-result=${cliScannerResult}`
213+
flags += ` ${this.params.imageTag}`;
214+
}
215+
216+
if (this.params.mode && this.params.mode == iacMode) {
217+
flags += ` ${this.params.iacScanPath}`;
218+
}
219+
220+
return {
221+
envvars: envvars,
222+
flags: flags
223+
}
224+
}
225+
226+
public printOptions() {
227+
if (this.params.standalone) {
228+
core.info(`[!] Running in Standalone Mode.`);
229+
}
230+
231+
if (this.params.sysdigSecureURL) {
232+
core.info('Sysdig Secure URL: ' + this.params.sysdigSecureURL);
233+
}
234+
235+
if (this.params.registryUser && this.params.registryPassword) {
236+
core.info(`Using specified Registry credentials.`);
237+
}
238+
239+
core.info(`Stop on Failed Policy Evaluation: ${this.params.stopOnFailedPolicyEval}`);
240+
241+
core.info(`Stop on Processing Error: ${this.params.stopOnProcessingError}`);
242+
243+
if (this.params.skipUpload) {
244+
core.info(`Skipping scan results upload to Sysdig Secure...`);
245+
}
246+
247+
if (this.params.dbPath) {
248+
core.info(`DB Path: ${this.params.dbPath}`);
249+
}
250+
251+
core.info(`Sysdig skip TLS: ${this.params.sysdigSkipTLS}`);
252+
253+
if (this.params.severityAtLeast) {
254+
core.info(`Severity level: ${this.params.severityAtLeast}`);
255+
}
256+
257+
core.info('Analyzing image: ' + this.params.imageTag);
258+
259+
if (this.params.overridePullString) {
260+
core.info(` * Image PullString will be overwritten as ${this.params.overridePullString}`);
261+
}
262+
263+
if (this.params.skipSummary) {
264+
core.info("This run will NOT generate a SUMMARY.");
265+
}
116266
}
117267
}
268+

‎src/report.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ export interface Metadata {
3737
size: number
3838
os: string
3939
architecture: string
40-
labels?: {[key: string]: string}
40+
labels?: { [key: string]: string }
4141
layersCount: number
4242
createdAt: string
4343
}
@@ -77,7 +77,7 @@ export interface Vuln {
7777
exploitable: boolean
7878
fixedInVersion?: string
7979
publishDateByVendor: PublishDateByVendor
80-
annotations?: {[key: string]: string}
80+
annotations?: { [key: string]: string }
8181
acceptedRisks?: AcceptedRisk[]
8282
}
8383

@@ -126,7 +126,7 @@ export interface Vulns {
126126
negligible?: number
127127
}
128128

129-
export interface RunningVulns {}
129+
export interface RunningVulns { }
130130

131131
export interface BaseImage {
132132
pullstrings: string[]

0 commit comments

Comments
 (0)