Merge branch 'main' into Handle-string-credentials

danadoherty639 · web-flow · commit f486ec2f2964 · 2025-03-05T09:35:38.000Z
diff --git a/.github/workflows/custom_acceptance.yml b/.github/workflows/custom_acceptance.yml
@@ -39,7 +39,7 @@ jobs:
     steps:
 
       - name: "checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@v4"
 
       - name: "export environment"
         run: |
diff --git a/.github/workflows/labeller.yml b/.github/workflows/labeller.yml
diff --git a/.github/workflows/mend.yml b/.github/workflows/mend.yml
@@ -1,10 +1,9 @@
 name: "mend"
 
 on:
-  pull_request_target:
-    types:
-      - opened
-      - synchronize
+  pull_request:
+    branches:
+      - "main"
   schedule:
     - cron: "0 0 * * *"
   workflow_dispatch:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@v4"
         with:
           ref: "${{ github.ref }}"
           clean: true
diff --git a/.github/workflows/release_prep.yml b/.github/workflows/release_prep.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
 
       - name: "Checkout"
-        uses: "actions/checkout@v3"
+        uses: "actions/checkout@v4"
         with:
           ref: 'release-prep'
           fetch-depth: 0
diff --git a/.pdkignore b/.pdkignore
@@ -29,6 +29,7 @@
 /.fixtures.yml
 /Gemfile
 /.gitattributes
+/.github/
 /.gitignore
 /.pdkignore
 /.puppet-lint.rc
diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
@@ -138,10 +138,10 @@ RSpec/MultipleDescribes:
 RSpec/MultipleExpectations:
   Max: 15
 
-# Offense count: 107
+# Offense count: 109
 # Configuration parameters: AllowSubject.
 RSpec/MultipleMemoizedHelpers:
-  Max: 17
+  Max: 19
 
 # Offense count: 55
 # Configuration parameters: AllowedGroups.
diff --git a/.vscode/extensions.json b/.vscode/extensions.json
@@ -1,6 +1,6 @@
 {
   "recommendations": [
     "puppet.puppet-vscode",
-    "rebornix.Ruby"
+    "Shopify.ruby-lsp"
   ]
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,42 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org).
 
+## [v1.2.2](https://github.com/puppetlabs/ruby-pwsh/tree/v1.2.2) - 2024-09-25
+
+[Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v1.2.1...v1.2.2)
+
+### Fixed
+
+- (CAT-2061) Fix empty string nullification [#346](https://github.com/puppetlabs/ruby-pwsh/pull/346) ([david22swan](https://github.com/david22swan))
+
+## [v1.2.1](https://github.com/puppetlabs/ruby-pwsh/tree/v1.2.1) - 2024-09-20
+
+[Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v1.2.0...v1.2.1)
+
+### Added
+
+- AlmaLinux 8/9 added to metadata.json [#338](https://github.com/puppetlabs/ruby-pwsh/pull/338) ([alex501212](https://github.com/alex501212))
+
+### Fixed
+
+- Revert "Fix empty string nullification" [#342](https://github.com/puppetlabs/ruby-pwsh/pull/342) ([jordanbreen28](https://github.com/jordanbreen28))
+- (maint) - Fix incorrect test for file_path [#335](https://github.com/puppetlabs/ruby-pwsh/pull/335) ([jordanbreen28](https://github.com/jordanbreen28))
+- (CAT-1991) - Skip missing dirs invalid_dir method [#334](https://github.com/puppetlabs/ruby-pwsh/pull/334) ([jordanbreen28](https://github.com/jordanbreen28))
+
+## [v1.2.0](https://github.com/puppetlabs/ruby-pwsh/tree/v1.2.0) - 2024-08-15
+
+[Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v1.1.1...v1.2.0)
+
+### Added
+
+- (CAT-1869) - Add configurable dsc_timeout [#319](https://github.com/puppetlabs/ruby-pwsh/pull/319) ([jordanbreen28](https://github.com/jordanbreen28))
+- Add support for unit testing via Unix OS [#309](https://github.com/puppetlabs/ruby-pwsh/pull/309) ([chambersmp](https://github.com/chambersmp))
+
+### Fixed
+
+- (bug) - Fix dsc timeout matcher [#331](https://github.com/puppetlabs/ruby-pwsh/pull/331) ([jordanbreen28](https://github.com/jordanbreen28))
+- Fix empty string nullification [#292](https://github.com/puppetlabs/ruby-pwsh/pull/292) ([Clebam](https://github.com/Clebam))
+
 ## [v1.1.1](https://github.com/puppetlabs/ruby-pwsh/tree/v1.1.1) - 2024-02-21
 
 [Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v1.1.0...v1.1.1)
@@ -39,6 +75,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 [Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v0.11.0...v1.0.0)
 
 ### Changed
+
 - (maint) - Drop Support for Debian 8/9 [#227](https://github.com/puppetlabs/ruby-pwsh/pull/227) ([jordanbreen28](https://github.com/jordanbreen28))
 - (maint) -  Drop Support for Ubuntu 16.04 [#226](https://github.com/puppetlabs/ruby-pwsh/pull/226) ([jordanbreen28](https://github.com/jordanbreen28))
 - (maint) - Drop Support for Fedora 30&31 [#225](https://github.com/puppetlabs/ruby-pwsh/pull/225) ([jordanbreen28](https://github.com/jordanbreen28))
@@ -67,6 +104,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) a
 [Full Changelog](https://github.com/puppetlabs/ruby-pwsh/compare/v0.10.3...v0.11.0.rc.1)
 
 ### Changed
+
 - (CONT-867) Ruby 3 / Puppet 8 Support [#208](https://github.com/puppetlabs/ruby-pwsh/pull/208) ([chelnak](https://github.com/chelnak))
 
 ## [v0.10.3](https://github.com/puppetlabs/ruby-pwsh/tree/v0.10.3) - 2022-12-19
diff --git a/Gemfile b/Gemfile
@@ -20,26 +20,29 @@ group :development do
   gem "json", '= 2.6.1',                         require: false if Gem::Requirement.create(['>= 3.1.0', '< 3.1.3']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "json", '= 2.6.3',                         require: false if Gem::Requirement.create(['>= 3.2.0', '< 4.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
   gem "racc", '~> 1.4.0',                        require: false if Gem::Requirement.create(['>= 2.7.0', '< 3.0.0']).satisfied_by?(Gem::Version.new(RUBY_VERSION.dup))
+  gem "deep_merge", '~> 1.0',                    require: false
   gem "voxpupuli-puppet-lint-plugins", '~> 5.0', require: false
   gem "facterdb", '~> 1.18',                     require: false
-  gem "metadata-json-lint", '~> 3.0',            require: false
-  gem "puppetlabs_spec_helper", '~> 6.0',        require: false
-  gem "rspec-puppet-facts", '~> 2.0',            require: false
+  gem "metadata-json-lint", '~> 4.0',            require: false
+  gem "rspec-puppet-facts", '~> 3.0',            require: false
   gem "dependency_checker", '~> 1.0.0',          require: false
-  gem "parallel_tests", '= 3.12.1',              require: false
+  gem "parallel_tests", '3.13.0',              require: false
   gem "pry", '~> 0.10',                          require: false
+  gem "simplecov-console", '~> 0.9',             require: false
   gem "puppet-debugger", '~> 1.0',               require: false
   gem "rubocop", '~> 1.50.0',                    require: false
-  gem "rubocop-performance", '= 1.16.0',         require: false
+  gem "rubocop-performance", '1.22.1',         require: false
   gem "rubocop-rspec", '= 2.19.0',               require: false
-  gem "puppet-strings", '~> 4.0',                require: false
   gem "rb-readline", '= 0.5.5',                  require: false, platforms: [:mswin, :mingw, :x64_mingw]
-  gem 'simplecov', '~> 0.21.0',                  require: false
-  gem 'simplecov-console', '~> 0.9.0',           require: false
+end
+group :development, :release_prep do
+  gem "puppet-strings", '~> 4.0',         require: false
+  gem "puppetlabs_spec_helper", '~> 8.0', require: false
 end
 group :system_tests do
-  gem "puppet_litmus", '~> 1.0', require: false, platforms: [:ruby, :x64_mingw]
-  gem "serverspec", '~> 2.41',   require: false
+  gem "puppet_litmus", '~> 1.0',   require: false, platforms: [:ruby, :x64_mingw]
+  gem "CFPropertyList", '< 3.0.7', require: false, platforms: [:mswin, :mingw, :x64_mingw]
+  gem "serverspec", '~> 2.41',     require: false
 end
 
 puppet_version = ENV['PUPPET_GEM_VERSION']
diff --git a/README.md b/README.md
@@ -85,6 +85,11 @@ The following platforms are supported:
 - OSX
 - RedHat
 - Ubuntu
+- AlmaLinux
+
+## Limitations
+
+- When PowerShell [Script Block Logging](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.4#enabling-script-block-logging) is enabled, data marked as sensitive in your manifest may appear in these logs as plain text. It is **highly recommended**, by both Puppet and Microsoft, that you also enable [Protected Event Logging](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.4#protected-event-logging) alongside this to encrypt the logs to protect this information.
 
 ## License
 
diff --git a/lib/puppet/provider/dsc_base_provider/dsc_base_provider.rb b/lib/puppet/provider/dsc_base_provider/dsc_base_provider.rb
@@ -15,6 +15,7 @@ def initialize
     @cached_query_results = []
     @cached_test_results = []
     @logon_failures = []
+    @timeout = nil # default timeout, ps_manager.execute is expecting nil by default..
     super
   end
 
@@ -251,18 +252,22 @@ def invoke_dsc_resource(context, name_hash, props, method)
       context.err('Logon credentials are invalid')
       return nil
     end
+    specify_dsc_timeout(name_hash)
     resource = invocable_resource(props, context, method)
     script_content = ps_script_content(resource)
+    context.debug("Invoke-DSC Timeout: #{@timeout} milliseconds") if @timeout
     context.debug("Script:\n #{redact_secrets(script_content)}")
-    output = ps_manager.execute(remove_secret_identifiers(script_content))[:stdout]
+    output = ps_manager.execute(remove_secret_identifiers(script_content), @timeout)
 
-    if output.nil?
-      context.err('Nothing returned')
+    if output[:stdout].nil?
+      message = 'Nothing returned.'
+      message += " #{output[:errormessage]}" if output[:errormessage]&.match?(/PowerShell module timeout \(\d+ ms\) exceeded while executing/)
+      context.err(message)
       return nil
     end
 
     begin
-      data = JSON.parse(output)
+      data = JSON.parse(output[:stdout])
     rescue StandardError => e
       context.err(e)
       return nil
@@ -295,6 +300,18 @@ def invoke_dsc_resource(context, name_hash, props, method)
     data
   end
 
+  # Sets the @timeout instance variable.
+  # @param name_hash [Hash] the hash of namevars to be passed as properties to `Invoke-DscResource`
+  # The @timeout variable is set to the value of name_hash[:dsc_timeout] in milliseconds
+  # If name_hash[:dsc_timeout] is nil, @timeout is not changed.
+  # If @timeout is already set to a value other than nil,
+  # it is changed only if it's different from name_hash[:dsc_timeout]..
+  def specify_dsc_timeout(name_hash)
+    return unless name_hash[:dsc_timeout] && (@timeout.nil? || @timeout != name_hash[:dsc_timeout])
+
+    @timeout = name_hash[:dsc_timeout] * 1000
+  end
+
   # Retries Invoke-DscResource when returned error matches error regex supplied as param.
   # @param context [Object] the Puppet runtime context to operate in and send feedback to
   # @param max_retry_count [Int] max number of times to retry Invoke-DscResource
@@ -665,16 +682,16 @@ def mandatory_set_attributes(context)
     context.type.attributes.select { |_attribute, properties| properties[:mandatory_for_set] }.keys
   end
 
-  # Parses the DSC resource type definition to retrieve the names of any attributes which are specifed as required strings
-  # This is used to ensure that any nil values are converted to empty strings to match puppets expecetd value
+  # Parses the DSC resource type definition to retrieve the names of any attributes which are specified as required strings
+  # This is used to ensure that any nil values are converted to empty strings to match puppets expeceted value
   # @param context [Object] the Puppet runtime context to operate in and send feedback to
   # @param data [Hash] the hash of properties returned from the DSC resource
   # @return [Hash] returns a data hash with any nil values converted to empty strings
   def stringify_nil_attributes(context, data)
-    nil_strings = data.select { |_name, value| value.nil? }.keys
-    string_attrs = context.type.attributes.select { |_name, properties| properties[:type] == 'String' }.keys
-    string_attrs.each do |attribute|
-      data[attribute] = '' if nil_strings.include?(attribute)
+    nil_attributes = data.select { |_name, value| value.nil? }.keys
+    nil_attributes.each do |nil_attr|
+      attribute_type = context.type.attributes[nil_attr][:type]
+      data[nil_attr] = '' if (attribute_type.start_with?('Optional[Enum[', 'Enum[') && enum_values(context, nil_attr).include?('')) || attribute_type == 'String'
     end
     data
   end
@@ -882,7 +899,7 @@ def format_ciminstance(variable_name, class_name, property_hash)
   #
   # @param resource [Hash] a hash with the information needed to run `Invoke-DscResource`
   # @return [String] A string representing the PowerShell definition of the InvokeParams hash
-  def invoke_params(resource)
+  def invoke_params(resource) # rubocop:disable Metrics/MethodLength
     params = {
       Name: resource[:dscmeta_resource_friendly_name],
       Method: resource[:dsc_invoke_method],
@@ -900,6 +917,10 @@ def invoke_params(resource)
       params[:ModuleName] = resource[:dscmeta_module_name]
     end
     resource[:parameters].each do |property_name, property_hash|
+      # ignore dsc_timeout, since it is only used to specify the powershell command timeout
+      # and timeout itself is not a parameter to the DSC resource
+      next if property_name == :dsc_timeout
+
       # strip dsc_ from the beginning of the property name declaration
       name = property_name.to_s.gsub(/^dsc_/, '').to_sym
       params[:Property][name] = case property_hash[:mof_type]
@@ -1101,6 +1122,10 @@ def remove_secret_identifiers(text)
   def ps_manager
     debug_output = Puppet::Util::Log.level == :debug
     # TODO: Allow you to specify an alternate path, either to pwsh generally or a specific pwsh path.
-    Pwsh::Manager.instance(Pwsh::Manager.powershell_path, Pwsh::Manager.powershell_args, debug: debug_output)
+    if Pwsh::Util.on_windows?
+      Pwsh::Manager.instance(Pwsh::Manager.powershell_path, Pwsh::Manager.powershell_args, debug: debug_output)
+    else
+      Pwsh::Manager.instance(Pwsh::Manager.pwsh_path, Pwsh::Manager.pwsh_args, debug: debug_output)
+    end
   end
 end
diff --git a/lib/pwsh.rb b/lib/pwsh.rb
@@ -108,7 +108,7 @@ def initialize(cmd, args = [], options = {})
       @powershell_command = cmd
       @powershell_arguments = args
 
-      raise "Bad configuration for ENV['lib']=#{ENV['lib']} - invalid path" if Pwsh::Util.invalid_directories?(ENV['lib'])
+      warn "Bad configuration for ENV['lib']=#{ENV['lib']} - invalid path" if Pwsh::Util.invalid_directories?(ENV['lib'])
 
       if Pwsh::Util.on_windows?
         # Named pipes under Windows will automatically be mounted in \\.\pipe\...
@@ -380,7 +380,7 @@ def self.pwsh_path(additional_paths = [])
           pwsh_paths << File.join(path, 'pwsh.exe') if File.exist?(File.join(path, 'pwsh.exe'))
         end
       else
-        search_paths.split(File::PATH_SEPARATOR).each do |path|
+        search_paths.split(':').each do |path|
           pwsh_paths << File.join(path, 'pwsh') if File.exist?(File.join(path, 'pwsh'))
         end
       end
diff --git a/lib/pwsh/util.rb b/lib/pwsh/util.rb
@@ -7,28 +7,24 @@ module Util
     module_function
 
     # Verifies whether or not the current context is running on a Windows node.
+    # Implementation copied from `facets`: https://github.com/rubyworks/facets/blob/main/lib/standard/facets/rbconfig.rb
     #
     # @return [Bool] true if on windows
     def on_windows?
-      # Ruby only sets File::ALT_SEPARATOR on Windows and the Ruby standard
-      # library uses that to test what platform it's on.
-      !!File::ALT_SEPARATOR
+      host_os = RbConfig::CONFIG['host_os']
+      !!(host_os =~ /mswin|mingw/)
     end
 
-    # Verify paths specified are valid directories which exist.
-    #
-    # @return [Bool] true if any directories specified do not exist
+    # Verify paths specified are valid directories.
+    # Skips paths which do not exist.
+    # @return [Bool] true if any paths specified are not valid directories
     def invalid_directories?(path_collection)
-      invalid_paths = false
-
-      return invalid_paths if path_collection.nil? || path_collection.empty?
+      return false if path_collection.nil? || path_collection.empty?
 
-      paths = on_windows? ? path_collection.split(';') : path_collection.split(':')
-      paths.each do |path|
-        invalid_paths = true unless File.directory?(path) || path.empty?
-      end
+      delimiter = on_windows? ? ';' : ':'
+      paths = path_collection.split(delimiter)
 
-      invalid_paths
+      paths.any? { |path| !path.empty? && File.exist?(path) && !File.directory?(path) }
     end
 
     # Return a string or symbol converted to snake_case
diff --git a/lib/pwsh/version.rb b/lib/pwsh/version.rb
@@ -2,5 +2,5 @@
 
 module Pwsh
   # The version of the ruby-pwsh gem
-  VERSION = '1.1.1'
+  VERSION = '1.2.2'
 end
diff --git a/lib/templates/init.ps1 b/lib/templates/init.ps1
@@ -152,7 +152,7 @@ function Invoke-PowerShellUserCode {
     # Set any provided environment variables
     if ($AdditionalEnvironmentVariables -ne $null) {
       $AdditionalEnvironmentVariables.GetEnumerator() |
-        ForEach-Object -Process { Set-Item -Path "Env:\$($_.Name)" -Value $_.Value }
+        ForEach-Object -Process { Set-Item -Path "Env:\$($_.Name)" -Value "$($_.Value)" }
     }
 
     # We clear the commands before each new command to avoid command pollution This does not need
diff --git a/metadata.json b/metadata.json
diff --git a/spec/unit/puppet/provider/dsc_base_provider/dsc_base_provider_spec.rb b/spec/unit/puppet/provider/dsc_base_provider/dsc_base_provider_spec.rb
diff --git a/spec/unit/pwsh/util_spec.rb b/spec/unit/pwsh/util_spec.rb

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"recommendations": [`
`3`	`3`	`"puppet.puppet-vscode",`
`4`		`- "rebornix.Ruby"`
	`4`	`+ "Shopify.ruby-lsp"`
`5`	`5`	`]`
`6`	`6`	`}`