chore(COD-7117): add IaC prescan optimisation

src/index.ts

@@ -14,7 +14,6 @@ import {
   getModifiedFiles,
   getOptionalEnvVariable,
   readMarkdownFile,
-  shouldRunIaCScanner,
   generateCacheKey,
 } from './util'
 
@@ -53,13 +52,7 @@ async function runAnalysis() {
     }
   }
 
-  // Skip the IaC scan if there no IaC-related files have been modified in the PR
-  let enableIacRunning = true
-  if (modifiedFiles && target == 'new') {
-    if (!shouldRunIaCScanner(modifiedFiles)) {
-      enableIacRunning = false
-    }
-  }
+  const enableIacRunning = true
 
   // Create scan-results directory
   const resultsPath = path.join(process.cwd(), 'scan-results')

src/util.ts

@@ -68,6 +68,14 @@ export async function callCommand(command: string, ...args: string[]) {
   }
 }
 
+export async function tryCallCommand(command: string, ...args: string[]): Promise<boolean> {
+  const child = spawn(command, args, { stdio: 'ignore' })
+  const exitCode = await new Promise((resolve, _) => {
+    child.on('close', resolve)
+  })
+  return exitCode === 0
+}
+
 export function getRequiredEnvVariable(name: string) {
   const value = process.env[name]
   if (!value) {
@@ -127,36 +135,6 @@ export async function getModifiedFiles(): Promise<string | undefined> {
   }
 }
 
-export function shouldRunIaCScanner(modifiedFiles: string): boolean {
-  const iacFileExtensions = ['.tf', '.hcl', '.yaml', '.yml', '.json']
-  const nonIaCFilenames = [
-    'package.json',
-    'package-lock.json',
-    'tsconfig.json',
-    'tsconfig.build.json',
-    'tslint.json',
-    'jest.config.json',
-    '.eslintrc.json',
-    '.prettierrc.json',
-    '.prettierrc.yaml',
-    '.prettierrc.yml',
-    'renovate.json',
-    'lerna.json',
-    'bower.json',
-    'composer.json',
-    'composer.lock',
-    'Pipfile.lock',
-    'cargo.lock',
-  ]
-  return modifiedFiles.split(',').some((file) => {
-    const filename = file.split('/').pop() || ''
-    if (nonIaCFilenames.includes(filename.toLowerCase())) {
-      return false
-    }
-    return iacFileExtensions.some((ext) => file.endsWith(ext))
-  })
-}
-
 // runCodesec - Docker-based scanner using codesec:latest image
 //
 // Modes:
@@ -261,13 +239,16 @@ export async function runCodesec(
     if (runIac) {
       const iacDir = path.join(reportsDir, 'iac')
       mkdirSync(iacDir, { recursive: true })
-      await callCommand(
+      const copied = await tryCallCommand(
         'docker',
         'container',
         'cp',
         `${containerName}:/tmp/scan-results/iac/iac-${scanTarget || 'scan'}.json`,
         path.join(iacDir, `iac-${scanTarget || 'scan'}.json`)
       )
+      if (!copied) {
+        info('IaC results not produced — scanner likely skipped IaC')
+      }
     }
 
     // Cleanup container