diff --git a/src/index.ts b/src/index.ts index 343449b4..5a06cdb9 100644 --- a/src/index.ts +++ b/src/index.ts @@ -14,7 +14,6 @@ import { getModifiedFiles, getOptionalEnvVariable, readMarkdownFile, - shouldRunIaCScanner, generateCacheKey, } from './util' @@ -53,13 +52,7 @@ async function runAnalysis() { } } - // Skip the IaC scan if there no IaC-related files have been modified in the PR - let enableIacRunning = true - if (modifiedFiles && target == 'new') { - if (!shouldRunIaCScanner(modifiedFiles)) { - enableIacRunning = false - } - } + const enableIacRunning = true // Create scan-results directory const resultsPath = path.join(process.cwd(), 'scan-results') diff --git a/src/util.ts b/src/util.ts index 4340574a..b6ef0f15 100644 --- a/src/util.ts +++ b/src/util.ts @@ -68,6 +68,14 @@ export async function callCommand(command: string, ...args: string[]) { } } +export async function tryCallCommand(command: string, ...args: string[]): Promise { + const child = spawn(command, args, { stdio: 'ignore' }) + const exitCode = await new Promise((resolve, _) => { + child.on('close', resolve) + }) + return exitCode === 0 +} + export function getRequiredEnvVariable(name: string) { const value = process.env[name] if (!value) { @@ -127,36 +135,6 @@ export async function getModifiedFiles(): Promise { } } -export function shouldRunIaCScanner(modifiedFiles: string): boolean { - const iacFileExtensions = ['.tf', '.hcl', '.yaml', '.yml', '.json'] - const nonIaCFilenames = [ - 'package.json', - 'package-lock.json', - 'tsconfig.json', - 'tsconfig.build.json', - 'tslint.json', - 'jest.config.json', - '.eslintrc.json', - '.prettierrc.json', - '.prettierrc.yaml', - '.prettierrc.yml', - 'renovate.json', - 'lerna.json', - 'bower.json', - 'composer.json', - 'composer.lock', - 'Pipfile.lock', - 'cargo.lock', - ] - return modifiedFiles.split(',').some((file) => { - const filename = file.split('/').pop() || '' - if (nonIaCFilenames.includes(filename.toLowerCase())) { - return false - } - return iacFileExtensions.some((ext) => file.endsWith(ext)) - }) -} - // runCodesec - Docker-based scanner using codesec:latest image // // Modes: @@ -261,13 +239,16 @@ export async function runCodesec( if (runIac) { const iacDir = path.join(reportsDir, 'iac') mkdirSync(iacDir, { recursive: true }) - await callCommand( + const copied = await tryCallCommand( 'docker', 'container', 'cp', `${containerName}:/tmp/scan-results/iac/iac-${scanTarget || 'scan'}.json`, path.join(iacDir, `iac-${scanTarget || 'scan'}.json`) ) + if (!copied) { + info('IaC results not produced — scanner likely skipped IaC') + } } // Cleanup container