Skip to content

Commit 4bf7b77

Browse files
davidknisedavidknise
authored
Merge pull request #84 from microsoft/dev/daknis/includeTools
Switch to includeTools input option
2 parents 5207379 + c97453f commit 4bf7b77

File tree

8 files changed

+165
-58
lines changed

8 files changed

+165
-58
lines changed

‎README.md‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,15 @@ To upload results to the Security tab of your repo, run the `github/codeql-actio
5050

5151
## Advanced
5252

53-
To configure **Container Mapping** to send to **Microsoft Defender for DevOps**, include `container-mapping` with your `tools` input option:
53+
To configure **Container Mapping** to send to **Microsoft Defender for DevOps**, include `container-mapping` as a tool:
54+
```yaml
55+
- uses: microsoft/security-devops-action@v1
56+
id: msdo
57+
with:
58+
includeTools: container-mapping
59+
```
60+
61+
This will run all the analyzers defined by the configured or defaulted policy in addition to `container-mapping`. To only run this feature, define `container-mapping` as the only `tool` to run:
5462
```yaml
5563
- uses: microsoft/security-devops-action@v1
5664
id: msdo

‎action.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,6 @@ inputs:
1313
- run
1414
- pre-job
1515
- post-job
16-
features:
17-
description: A comma separated list of features to enable. Example scanning, mapping, all. Defaults to scanning.
18-
default: scanning
1916
config:
2017
description: A file path to a .gdnconfig file.
2118
policy:
@@ -26,7 +23,9 @@ inputs:
2623
languages:
2724
description: A comma separated list of languages to analyze. Example javascript, typescript. Defaults to all.
2825
tools:
29-
description: A comma separated list of analyzer tools to run. Example bandit, binskim, eslint, templateanalyzer, terrascan, trivy.
26+
description: A comma separated list of analyzer to run. Example bandit, binskim, container-mapping, eslint, templateanalyzer, terrascan, trivy.
27+
includeTools:
28+
description: A comma separated list of analyzers to run in addition to the default set defined by the policy. Limited to container-mapping
3029
outputs:
3130
sarifFile:
3231
description: A file path to a SARIF results file.

‎lib/index.js‎

Lines changed: 23 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ function _runPreJob(command) {
6363
if (command != msdo_helpers_1.CommandType.All) {
6464
return;
6565
}
66-
if (_featureIsEnabled(msdo_helpers_1.Features.Mapping)) {
66+
if (_toolIsEnabled(msdo_helpers_1.Tools.ContainerMapping)) {
6767
yield _getExecutor(container_mapping_1.ContainerMapping).runPreJob();
6868
}
6969
});
@@ -73,7 +73,7 @@ function _runPostJob(command) {
7373
if (command != msdo_helpers_1.CommandType.All) {
7474
return;
7575
}
76-
if (_featureIsEnabled(msdo_helpers_1.Features.Mapping)) {
76+
if (_toolIsEnabled(msdo_helpers_1.Tools.ContainerMapping)) {
7777
yield _getExecutor(container_mapping_1.ContainerMapping).runPostJob();
7878
}
7979
});
@@ -87,27 +87,37 @@ function _runMain(command) {
8787
yield _runPostJob(command);
8888
}
8989
else if (command == msdo_helpers_1.CommandType.All || command == msdo_helpers_1.CommandType.Run) {
90-
if (_featureIsEnabled(msdo_helpers_1.Features.Scanning)) {
91-
yield _getExecutor(msdo_1.MicrosoftSecurityDevOps).runMain();
90+
if (_toolIsEnabledOnInput(msdo_helpers_1.Inputs.Tools, msdo_helpers_1.Tools.ContainerMapping, true)) {
91+
console.log("Scanning is not enabled. Skipping...");
9292
}
9393
else {
94-
console.log("Scanning is not enabled. Skipping...");
94+
yield _getExecutor(msdo_1.MicrosoftSecurityDevOps).runMain();
9595
}
9696
}
9797
else {
9898
throw new Error(`Invalid command type for the main task: ${command}`);
9999
}
100100
});
101101
}
102-
function _featureIsEnabled(featureName) {
102+
function _toolIsEnabled(toolName) {
103+
let enabled = false;
104+
enabled = _toolIsEnabledOnInput(msdo_helpers_1.Inputs.Tools, toolName, false);
105+
if (!enabled) {
106+
enabled = _toolIsEnabledOnInput(msdo_helpers_1.Inputs.IncludeTools, toolName, false);
107+
}
108+
return enabled;
109+
}
110+
function _toolIsEnabledOnInput(inputName, toolName, isOnlyTool = false) {
103111
let enabled = false;
104-
let featuresString = core.getInput(msdo_helpers_1.Inputs.Features);
105-
if (!common.isNullOrWhiteSpace(featuresString)) {
106-
let features = featuresString.split(',').map(item => item.trim());
107-
const toolIndex = features.indexOf(featureName);
108-
enabled = toolIndex > -1;
109-
if (!enabled) {
110-
enabled = features.indexOf(msdo_helpers_1.Features.All) > -1;
112+
let toolsString = core.getInput(inputName);
113+
if (!common.isNullOrWhiteSpace(toolsString)) {
114+
let tools = toolsString.split(',');
115+
if (isOnlyTool && tools.length > 1) {
116+
enabled = false;
117+
}
118+
else {
119+
const toolIndex = tools.indexOf(toolName);
120+
enabled = toolIndex > -1;
111121
}
112122
}
113123
return enabled;

‎lib/msdo-helpers.js‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
33
return (mod && mod.__esModule) ? mod : { "default": mod };
44
};
55
Object.defineProperty(exports, "__esModule", { value: true });
6-
exports.writeToOutStream = exports.getEncodedContent = exports.encode = exports.Constants = exports.Features = exports.CommandType = exports.RunnerType = exports.Inputs = void 0;
6+
exports.writeToOutStream = exports.getEncodedContent = exports.encode = exports.Constants = exports.Tools = exports.CommandType = exports.RunnerType = exports.Inputs = void 0;
77
const os_1 = __importDefault(require("os"));
88
var Inputs;
99
(function (Inputs) {
1010
Inputs["Command"] = "command";
11-
Inputs["Features"] = "features";
11+
Inputs["Config"] = "config";
12+
Inputs["Policy"] = "policy";
13+
Inputs["Categories"] = "categories";
14+
Inputs["Languages"] = "languages";
15+
Inputs["Tools"] = "tools";
16+
Inputs["IncludeTools"] = "includeTools";
1217
})(Inputs || (exports.Inputs = Inputs = {}));
1318
var RunnerType;
1419
(function (RunnerType) {
@@ -23,12 +28,16 @@ var CommandType;
2328
CommandType["PostJob"] = "post-job";
2429
CommandType["Run"] = "run";
2530
})(CommandType || (exports.CommandType = CommandType = {}));
26-
var Features;
27-
(function (Features) {
28-
Features["All"] = "all";
29-
Features["Scanning"] = "scanning";
30-
Features["Mapping"] = "mapping";
31-
})(Features || (exports.Features = Features = {}));
31+
var Tools;
32+
(function (Tools) {
33+
Tools["Bandit"] = "bandit";
34+
Tools["Binskim"] = "binskim";
35+
Tools["ContainerMapping"] = "container-mapping";
36+
Tools["ESLint"] = "eslint";
37+
Tools["TemplateAnalyzer"] = "templateanalyzer";
38+
Tools["Terrascan"] = "terrascan";
39+
Tools["Trivy"] = "trivy";
40+
})(Tools || (exports.Tools = Tools = {}));
3241
var Constants;
3342
(function (Constants) {
3443
Constants["Unknown"] = "unknown";

‎lib/msdo.js‎

Lines changed: 28 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
3434
Object.defineProperty(exports, "__esModule", { value: true });
3535
exports.MicrosoftSecurityDevOps = void 0;
3636
const core = __importStar(require("@actions/core"));
37+
const msdo_helpers_1 = require("./msdo-helpers");
3738
const client = __importStar(require("@microsoft/security-devops-actions-toolkit/msdo-client"));
3839
const common = __importStar(require("@microsoft/security-devops-actions-toolkit/msdo-common"));
3940
class MicrosoftSecurityDevOps {
@@ -86,13 +87,37 @@ class MicrosoftSecurityDevOps {
8687
}
8788
}
8889
let toolsString = core.getInput('tools');
90+
let includedTools = [];
8991
if (!common.isNullOrWhiteSpace(toolsString)) {
9092
let tools = toolsString.split(',');
91-
args.push('--tool');
9293
for (let i = 0; i < tools.length; i++) {
9394
let tool = tools[i];
94-
if (!common.isNullOrWhiteSpace(tool)) {
95-
args.push(tool.trim());
95+
let toolTrimmed = tool.trim();
96+
if (!common.isNullOrWhiteSpace(tool)
97+
&& tool != msdo_helpers_1.Tools.ContainerMapping
98+
&& includedTools.indexOf(toolTrimmed) == -1) {
99+
args.push(toolTrimmed);
100+
if (includedTools.length == 0) {
101+
args.push('--tool');
102+
}
103+
includedTools.push(toolTrimmed);
104+
}
105+
}
106+
}
107+
let includeToolsString = core.getInput('includeTools');
108+
if (!common.isNullOrWhiteSpace(includeToolsString)) {
109+
let includeTools = includeToolsString.split(',');
110+
for (let i = 0; i < includeTools.length; i++) {
111+
let includeTool = includeTools[i];
112+
let toolTrimmed = includeTool.trim();
113+
if (!common.isNullOrWhiteSpace(includeTool)
114+
&& includeTool != msdo_helpers_1.Tools.ContainerMapping
115+
&& includedTools.indexOf(toolTrimmed) == -1) {
116+
args.push(toolTrimmed);
117+
if (includedTools.length == 0) {
118+
args.push('--tool');
119+
}
120+
includedTools.push(toolTrimmed);
96121
}
97122
}
98123
}

‎src/index.ts‎

Lines changed: 39 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
import * as core from '@actions/core';
22
import { MicrosoftSecurityDevOps } from './msdo';
3-
import { CommandType, Features, Inputs, RunnerType } from './msdo-helpers';
3+
import { CommandType, Inputs, RunnerType, Tools } from './msdo-helpers';
44
import { IMicrosoftSecurityDevOps, IMicrosoftSecurityDevOpsFactory } from './msdo-interface';
55
import { ContainerMapping } from './container-mapping';
66
import * as common from '@microsoft/security-devops-actions-toolkit/msdo-common';
@@ -33,7 +33,7 @@ async function _runPreJob(command: CommandType) {
3333
return;
3434
}
3535
// if explicit PreJob, will run in main
36-
if (_featureIsEnabled(Features.Mapping)) {
36+
if (_toolIsEnabled(Tools.ContainerMapping)) {
3737
await _getExecutor(ContainerMapping).runPreJob();
3838
}
3939
}
@@ -43,7 +43,7 @@ async function _runPostJob(command: CommandType) {
4343
return;
4444
}
4545
// if explicit PostJob, will run in main
46-
if (_featureIsEnabled(Features.Mapping)) {
46+
if (_toolIsEnabled(Tools.ContainerMapping)) {
4747
await _getExecutor(ContainerMapping).runPostJob();
4848
}
4949
}
@@ -57,30 +57,52 @@ async function _runMain(command: CommandType) {
5757
await _runPostJob(command);
5858
} else if (command == CommandType.All || command == CommandType.Run) {
5959
// Run main
60-
if (_featureIsEnabled(Features.Scanning)) {
61-
await _getExecutor(MicrosoftSecurityDevOps).runMain();
62-
} else {
60+
// If container-mapping is the only enabled tool, then skip scanning
61+
if (_toolIsEnabledOnInput(Inputs.Tools, Tools.ContainerMapping, true)) {
6362
console.log("Scanning is not enabled. Skipping...");
63+
} else {
64+
await _getExecutor(MicrosoftSecurityDevOps).runMain();
6465
}
6566
} else {
6667
throw new Error(`Invalid command type for the main task: ${command}`);
6768
}
6869
}
6970

7071
/**
71-
* Returns true if the feature is enabled in the inputs.
72-
* @param featureName - The name of the feature.
73-
* @returns True if the feature is enabled in the inputs.
72+
* Returns true if the tool is enabled on either the tools or includeTools inputs.
73+
* @param toolName - The name of the tool.
74+
* @returns True if the tool is enabled in the inputs.
75+
*/
76+
function _toolIsEnabled(toolName: string): boolean {
77+
let enabled: boolean = false;
78+
79+
enabled = _toolIsEnabledOnInput(Inputs.Tools, toolName, false);
80+
81+
if (!enabled) {
82+
// See if the tool is in includeTools
83+
enabled = _toolIsEnabledOnInput(Inputs.IncludeTools, toolName, false);
84+
}
85+
86+
return enabled;
87+
}
88+
89+
/**
90+
* Returns true if the tool is enabled on the specified input.
91+
* @param inputName The action input name to check for the list of tools. Values tools or includeTools.
92+
* @param toolName The name of the tool to look for.
93+
* @param isOnlyTool Return true only if it is the only tool.
94+
* @returns True if the tool is enabled on the specified input.
7495
*/
75-
function _featureIsEnabled(featureName: string) {
96+
function _toolIsEnabledOnInput(inputName: string, toolName: string, isOnlyTool: boolean = false) {
7697
let enabled: boolean = false;
77-
let featuresString: string = core.getInput(Inputs.Features);
78-
if (!common.isNullOrWhiteSpace(featuresString)) {
79-
let features = featuresString.split(',').map(item => item.trim());
80-
const toolIndex = features.indexOf(featureName);
81-
enabled = toolIndex > -1;
82-
if (!enabled) {
83-
enabled = features.indexOf(Features.All) > -1;
98+
let toolsString: string = core.getInput(inputName);
99+
if (!common.isNullOrWhiteSpace(toolsString)) {
100+
let tools = toolsString.split(',');
101+
if (isOnlyTool && tools.length > 1) {
102+
enabled = false;
103+
} else {
104+
const toolIndex = tools.indexOf(toolName);
105+
enabled = toolIndex > -1;
84106
}
85107
}
86108
return enabled;

‎src/msdo-helpers.ts‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
import os from 'os';
22
import { Writable } from "stream";
33

4-
54
/**
65
* Enum for the possible inputs for the task (specified in action.yml)
76
*/
87
export enum Inputs {
98
Command = 'command',
10-
Features = 'features'
9+
Config = 'config',
10+
Policy = 'policy',
11+
Categories = 'categories',
12+
Languages = 'languages',
13+
Tools = 'tools',
14+
IncludeTools = 'includeTools'
1115
}
1216

1317
/**
@@ -29,13 +33,17 @@ export enum CommandType {
2933
Run = 'run'
3034
}
3135

32-
/**
33-
* Enum for the possible values for the Inputs.Features (specified in action.yml)
34-
*/
35-
export enum Features {
36-
All = 'all',
37-
Scanning = 'scanning',
38-
Mapping = 'mapping'
36+
/*
37+
* Enum for the possible values for the Inputs.Tools (specified in action.yml)
38+
*/
39+
export enum Tools {
40+
Bandit = 'bandit',
41+
Binskim = 'binskim',
42+
ContainerMapping = 'container-mapping',
43+
ESLint = 'eslint',
44+
TemplateAnalyzer = 'templateanalyzer',
45+
Terrascan = 'terrascan',
46+
Trivy = 'trivy'
3947
}
4048

4149
/**

‎src/msdo.ts‎

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
import * as core from '@actions/core';
22
import { IMicrosoftSecurityDevOps } from './msdo-interface';
3+
import { Tools } from './msdo-helpers';
34
import * as client from '@microsoft/security-devops-actions-toolkit/msdo-client';
45
import * as common from '@microsoft/security-devops-actions-toolkit/msdo-common';
56

@@ -65,13 +66,38 @@ export class MicrosoftSecurityDevOps implements IMicrosoftSecurityDevOps {
6566
}
6667

6768
let toolsString: string = core.getInput('tools');
69+
let includedTools = [];
6870
if (!common.isNullOrWhiteSpace(toolsString)) {
6971
let tools = toolsString.split(',');
70-
args.push('--tool');
7172
for (let i = 0; i < tools.length; i++) {
7273
let tool = tools[i];
73-
if (!common.isNullOrWhiteSpace(tool)) {
74-
args.push(tool.trim());
74+
let toolTrimmed = tool.trim();
75+
if (!common.isNullOrWhiteSpace(tool)
76+
&& tool != Tools.ContainerMapping
77+
&& includedTools.indexOf(toolTrimmed) == -1) {
78+
args.push(toolTrimmed);
79+
if (includedTools.length == 0) {
80+
args.push('--tool');
81+
}
82+
includedTools.push(toolTrimmed);
83+
}
84+
}
85+
}
86+
87+
let includeToolsString: string = core.getInput('includeTools');
88+
if (!common.isNullOrWhiteSpace(includeToolsString)) {
89+
let includeTools = includeToolsString.split(',');
90+
for (let i = 0; i < includeTools.length; i++) {
91+
let includeTool = includeTools[i];
92+
let toolTrimmed = includeTool.trim();
93+
if (!common.isNullOrWhiteSpace(includeTool)
94+
&& includeTool != Tools.ContainerMapping
95+
&& includedTools.indexOf(toolTrimmed) == -1) {
96+
args.push(toolTrimmed);
97+
if (includedTools.length == 0) {
98+
args.push('--tool');
99+
}
100+
includedTools.push(toolTrimmed);
75101
}
76102
}
77103
}

0 commit comments

Comments
 (0)