Add a YQ-powered remediation function #4830
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jhrozek
added a commit
to jhrozek/minder-rules-and-profiles
that referenced
this pull request
Oct 27, 2024
This PR depends on having mindersec/minder#4830 merged first as it takes the remediation function added there into effect. The remediation works as follows: - if there are any instances of pull_request target objects those are removed - else if there are any instances of pull_request strings in an array those are removed - if the resulting array of array of objects would have length 0, `workflow_dispatch` is added instead Fixes: mindersec#201
jhrozek
added a commit
to mindersec/minder-rules-and-profiles
that referenced
this pull request
Oct 27, 2024
This PR depends on having mindersec/minder#4830 merged first as it takes the remediation function added there into effect. The remediation works as follows: - if there are any instances of pull_request target objects those are removed - else if there are any instances of pull_request strings in an array those are removed - if the resulting array of array of objects would have length 0, `workflow_dispatch` is added instead Fixes: #201
jhrozek
force-pushed
the
pull_request_target_remediation
branch
from
45fb1d6 to
15e95fe
Compare
|
The tests seem to be failing with: which sounds unrelated. I can take into this tomorrow, just going to tag @blkt who was looking into skipping tests lately in case it is a known issue. |
The PR evaluator used to have typed params for every function we'd add - there's one for frizbee, one for the pull_request_content function etc. This is not great, as we tie the functions to our protobuf API and every new function requires a client release to be done or else the clients can't even add ruletypes with the new functions. Let's just use a generic `structpb.Struct` going forward. This time it is still a change that needs client support, but going forward we'll just have to change the server code to add a new function.
In order to be able to change YAML files such as github workflows safely and with minimal amount of changes, we need to add a new remediation function in addition to the put-a-content-somewhere and call-frizbee ones we have now. I chose to add one based on `libyq` which does a decent job at retaining comments and general YAML structure. Fixes: mindersec#4815
jhrozek
force-pushed
the
pull_request_target_remediation
branch
from
15e95fe to
c20ed0f
Compare
This was resolved by rebasing atop origin/main |
rdimitrov
approved these changes
Oct 29, 2024
jhrozek
added a commit
to mindersec/minder-rules-and-profiles
that referenced
this pull request
Nov 5, 2024
This PR depends on having mindersec/minder#4830 merged first as it takes the remediation function added there into effect. The remediation works as follows: - if there are any instances of pull_request target objects those are removed - else if there are any instances of pull_request strings in an array those are removed - if the resulting array of array of objects would have length 0, `workflow_dispatch` is added instead Fixes: #201
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
structpb.Structgoing forward. This time it is still a change that needs client support, but going forward we'll just have to change the server code to add a new function.libyqwhich does a decent job at retaining comments and general YAML structure.Fixes: #4815
Change Type
Testing
a mix of manual testing and unit tests. You can see one such PR created by this function here: jakubtestorg/bad-workflows@4b2863b
Review Checklist: