Parse GitHub Action exclusion from rule def (#1934)

In the PR remediation that replaces tags for checksums, we need a way to
pass in an exclusion list from the user input in the profile.

This implements that by parsing an `exclude` key from the `def` section
of the rule.

internal/engine/actions/remediate/pull_request/pull_request.go

@@ -183,6 +183,7 @@ func (r *Remediator) Do(
 		prCfg: r.prCfg,
 		ghCli: r.ghCli,
 		bfs:   ingested.Fs,
+		def:   params.GetRule().Def.AsMap(),
 	})
 	if err != nil {
 		return nil, fmt.Errorf("cannot get modification: %w", err)

internal/engine/actions/remediate/pull_request/pull_request_test.go

@@ -174,6 +174,23 @@ func createTestRemArgs() *remediateArgs {
 	}
 }
 
+func createTestRemArgsWithExcludes() *remediateArgs {
+	return &remediateArgs{
+		remAction: interfaces.ActionOptOn,
+		ent: &pb.Repository{
+			Owner: repoOwner,
+			Name:  repoName,
+		},
+		pol: map[string]any{
+			"exclude": []any{"actions/setup-go@v5"},
+		},
+		params: map[string]any{
+			// explicitly test non-default branch
+			"branch": "dependabot/gomod",
+		},
+	}
+}
+
 func happyPathMockSetup(mockGitHub *mock_ghclient.MockGitHub) {
 	// no pull requst so far
 	mockGitHub.EXPECT().
@@ -468,6 +485,31 @@ func TestPullRequestRemediate(t *testing.T) {
 
 				resolveActionMockSetup(t, mockGitHub, "repos/actions/checkout/git/refs/tags/v4", checkoutV4Ref)
 
+				mockGitHub.EXPECT().
+					CreatePullRequest(
+						gomock.Any(),
+						repoOwner, repoName,
+						frizbeeCommitTitle, frizbeePrBodyWithExcludes,
+						refFromBranch(branchBaseName(frizbeeCommitTitle)), dflBranchTo).
+					Return(nil, nil)
+			},
+		},
+		{
+			name: "resolve tags using frizbee with excludes from rule",
+			newRemArgs: &newPullRequestRemediateArgs{
+				prRem:      frizbeePrRem(),
+				pbuild:     testGithubProviderBuilder(),
+				actionType: TestActionTypeValid,
+			},
+			remArgs:   createTestRemArgsWithExcludes(),
+			repoSetup: defaultMockRepoSetup,
+			mockSetup: func(t *testing.T, mockGitHub *mock_ghclient.MockGitHub) {
+				t.Helper()
+
+				happyPathMockSetup(mockGitHub)
+
+				resolveActionMockSetup(t, mockGitHub, "repos/actions/checkout/git/refs/tags/v4", checkoutV4Ref)
+
 				mockGitHub.EXPECT().
 					CreatePullRequest(
 						gomock.Any(),

internal/engine/actions/remediate/pull_request/types_actions_replace_tags.go

@@ -44,7 +44,9 @@ func newFrizbeeTagResolveModification(
 	params *modificationConstructorParams,
 ) (fsModifier, error) {
 	exclude := []string{}
-	if ex := params.prCfg.GetActionsReplaceTagsWithSha().GetExclude(); ex != nil {
+	if ex := parseExcludeFromDef(params.def); ex != nil {
+		exclude = ex
+	} else if ex := params.prCfg.GetActionsReplaceTagsWithSha().GetExclude(); ex != nil {
 		exclude = ex
 	}
 	return &frizbeeTagResolveModification{
@@ -99,3 +101,31 @@ func (ftr *frizbeeTagResolveModification) modifyFs() ([]*fsEntry, error) {
 	}
 	return ftr.entries, nil
 }
+
+func parseExcludeFromDef(def map[string]any) []string {
+	if def == nil {
+		return nil
+	}
+
+	exclude, ok := def["exclude"]
+	if !ok {
+		return nil
+	}
+
+	excludeSlice, ok := exclude.([]interface{})
+	if !ok {
+		return nil
+	}
+
+	excludeStrings := []string{}
+	for _, ex := range excludeSlice {
+		excludeStr, ok := ex.(string)
+		if !ok {
+			return nil
+		}
+
+		excludeStrings = append(excludeStrings, excludeStr)
+	}
+
+	return excludeStrings
+}

internal/engine/actions/remediate/pull_request/types_registry.go

@@ -37,6 +37,7 @@ type modificationConstructorParams struct {
 	prCfg *pb.RuleType_Definition_Remediate_PullRequestRemediation
 	ghCli v1.GitHub
 	bfs   billy.Filesystem
+	def   map[string]any
 }
 
 type modificationConstructor func(*modificationConstructorParams) (fsModifier, error)