Skip to content

Commit b713701

Browse files
Merge pull request #2551 from vamshi-stepsecurity/bug/wild-card-for-action
update wildcard function
2 parents 789ba82 + c1b538e commit b713701

File tree

4 files changed

+91
-4
lines changed

4 files changed

+91
-4
lines changed

remediation/workflow/pin/pinactions.go

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ import (
55
"fmt"
66
"log"
77
"os"
8-
"path/filepath"
98
"regexp"
109
"strings"
1110

@@ -261,8 +260,15 @@ func getSemanticVersion(client *github.Client, owner, repo, tagOrBranch, commitS
261260
// Function to check if an action matches any pattern in the list
262261
func ActionExists(actionName string, patterns []string) bool {
263262
for _, pattern := range patterns {
264-
// Use filepath.Match to match the pattern
265-
matched, err := filepath.Match(pattern, actionName)
263+
// Convert glob pattern to regex for path matching
264+
// Replace * with [^/]* to match within a path segment
265+
// Replace **/ with .* to match across path segments
266+
regexPattern := strings.ReplaceAll(pattern, "**", "§§")
267+
regexPattern = strings.ReplaceAll(regexPattern, "*", "[^/]*")
268+
regexPattern = strings.ReplaceAll(regexPattern, "§§", ".*")
269+
regexPattern = "^" + regexPattern + "($|/)"
270+
271+
matched, err := regexp.MatchString(regexPattern, actionName)
266272
if err != nil {
267273
// Handle invalid patterns
268274
fmt.Printf("Error matching pattern: %v\n", err)

remediation/workflow/pin/pinactions_test.go

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -308,7 +308,7 @@ func TestPinActions(t *testing.T) {
308308
{fileName: "actionwithcomment.yml", wantUpdated: true, pinToImmutable: true},
309309
{fileName: "repeatedactionwithcomment.yml", wantUpdated: true, pinToImmutable: true},
310310
{fileName: "immutableaction-1.yml", wantUpdated: true, pinToImmutable: true},
311-
{fileName: "exemptaction.yml", wantUpdated: true, exemptedActions: []string{"actions/checkout", "rohith/*"}, pinToImmutable: true},
311+
{fileName: "exemptaction.yml", wantUpdated: true, exemptedActions: []string{"actions/checkout", "rohith/*", "praveen/*", "aman-*/*", "*/seperate*"}, pinToImmutable: true},
312312
{fileName: "donotpintoimmutable.yml", wantUpdated: true, pinToImmutable: false},
313313
{fileName: "invertedcommas.yml", wantUpdated: true, pinToImmutable: false},
314314
{fileName: "pinusingmap.yml", wantUpdated: true, pinToImmutable: true},
@@ -374,3 +374,36 @@ func Test_isAbsolute(t *testing.T) {
374374
})
375375
}
376376
}
377+
378+
func TestActionExists(t *testing.T) {
379+
result := ActionExists("actions/checkout", []string{"actions/checkout"})
380+
t.Log(result)
381+
if !result {
382+
t.Errorf("ActionExists returned false for actions/checkout")
383+
}
384+
385+
result = ActionExists("actions/checkout", []string{"actions/*"})
386+
t.Log(result)
387+
if !result {
388+
t.Errorf("ActionExists returned false for actions/checkout")
389+
}
390+
391+
result = ActionExists("actions/checkout/something", []string{"actions/*"})
392+
t.Log(result)
393+
if !result {
394+
t.Errorf("ActionExists returned true for actions/checkout/something")
395+
}
396+
397+
result = ActionExists("step-security/checkout/something", []string{"step-*/*"})
398+
t.Log(result)
399+
if !result {
400+
t.Errorf("ActionExists returned true for actions/checkout/something")
401+
}
402+
403+
result = ActionExists("step-security/checkout-release/something", []string{"*/checkout-*"})
404+
t.Log(result)
405+
if !result {
406+
t.Errorf("ActionExists returned true for actions/checkout/something")
407+
}
408+
409+
}

testfiles/pinactions/input/exemptaction.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,30 @@ jobs:
3838
- name: publish on version change
3939
id: publish_nuget
4040
uses: rohith/publish-nuget@v2
41+
with:
42+
PROJECT_FILE_PATH: Core/Core.csproj
43+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
44+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
45+
46+
- name: publish on version change 2
47+
id: publish_nuget
48+
uses: praveen/publish-nuget/to-version@v2
49+
with:
50+
PROJECT_FILE_PATH: Core/Core.csproj
51+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
52+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
53+
54+
- name: publish on version change 3
55+
id: publish_nuget
56+
uses: aman-action/move/to-main@v2
57+
with:
58+
PROJECT_FILE_PATH: Core/Core.csproj
59+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
60+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
61+
62+
- name: publish on version change 2
63+
id: publish_nuget
64+
uses: smith/seperate/from-version@v2
4165
with:
4266
PROJECT_FILE_PATH: Core/Core.csproj
4367
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}

testfiles/pinactions/output/exemptaction.yml

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,30 @@ jobs:
3838
- name: publish on version change
3939
id: publish_nuget
4040
uses: rohith/publish-nuget@v2
41+
with:
42+
PROJECT_FILE_PATH: Core/Core.csproj
43+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
44+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
45+
46+
- name: publish on version change 2
47+
id: publish_nuget
48+
uses: praveen/publish-nuget/to-version@v2
49+
with:
50+
PROJECT_FILE_PATH: Core/Core.csproj
51+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
52+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
53+
54+
- name: publish on version change 3
55+
id: publish_nuget
56+
uses: aman-action/move/to-main@v2
57+
with:
58+
PROJECT_FILE_PATH: Core/Core.csproj
59+
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}
60+
NUGET_SOURCE: https://nuget.pkg.github.com/OWNER/index.json
61+
62+
- name: publish on version change 2
63+
id: publish_nuget
64+
uses: smith/seperate/from-version@v2
4165
with:
4266
PROJECT_FILE_PATH: Core/Core.csproj
4367
NUGET_KEY: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)