Jon Chery
1598c54a8b
90 offline tests covering adapter, confidence_signal, checkov_adapter, outbox_writer, and pipeline integration. Identical CI/CD workflows for Gitea Actions (dev) and GitHub Actions (production). New --check-only mode for run_platform.sh (offline, no AWS). ---ci--- project: acdl phase: 18 milestone: v1.3 status: verify ---/ci---
126 lines
4.6 KiB
Python
126 lines
4.6 KiB
Python
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import jsonschema
|
|
import pytest
|
|
|
|
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
|
|
|
from adapters.terraform.policy.checkov_adapter import (
|
|
RULE_MAP, _to_pcr, _emit_tag_naming_skipped, adapt,
|
|
)
|
|
|
|
|
|
class TestRuleMap:
|
|
def test_secrets_rules(self):
|
|
assert RULE_MAP["CKV_AWS_41"][0] == "secrets-in-plaintext"
|
|
assert RULE_MAP["CKV_AWS_45"][0] == "secrets-in-plaintext"
|
|
|
|
def test_public_ingress_rules(self):
|
|
assert RULE_MAP["CKV_AWS_20"][0] == "public-ingress"
|
|
assert RULE_MAP["CKV_AWS_57"][0] == "public-ingress"
|
|
|
|
def test_iam_wildcard(self):
|
|
assert RULE_MAP["CKV_AWS_1"][0] == "iam-wildcard"
|
|
|
|
def test_kms(self):
|
|
assert RULE_MAP["CKV_AWS_7"][0] == "kms-key-reference"
|
|
|
|
def test_all_have_severities(self):
|
|
for rule_id, (cat, sev) in RULE_MAP.items():
|
|
assert sev in ("high", "medium", "low", "info"), f"{rule_id} has bad severity {sev}"
|
|
|
|
|
|
class TestToPcr:
|
|
def test_passed_result(self):
|
|
rec = {"check_id": "CKV_AWS_20", "check_name": "No public ingress", "file_path": "main.tf"}
|
|
pcr = _to_pcr(rec, "contract-123", "PASSED")
|
|
assert pcr["result"] == "pass"
|
|
assert pcr["contractId"] == "contract-123"
|
|
assert pcr["engine"] == "checkov"
|
|
assert pcr["ruleId"] == "CKV_AWS_20"
|
|
assert pcr["severity"] == "high"
|
|
|
|
def test_failed_result(self):
|
|
rec = {"check_id": "CKV_AWS_1", "check_name": "No wildcard IAM"}
|
|
pcr = _to_pcr(rec, "c-1", "FAILED")
|
|
assert pcr["result"] == "fail"
|
|
assert pcr["severity"] == "high"
|
|
|
|
def test_skipped_result(self):
|
|
rec = {"check_id": "UNKNOWN_RULE", "check_name": "some check"}
|
|
pcr = _to_pcr(rec, "c-1", "SKIPPED")
|
|
assert pcr["result"] == "skipped"
|
|
assert pcr["severity"] == "info"
|
|
|
|
def test_unknown_rule_defaults_to_info(self):
|
|
rec = {"check_id": "UNKNOWN_RULE", "check_name": "unknown"}
|
|
pcr = _to_pcr(rec, "c-1", "FAILED")
|
|
assert pcr["severity"] == "info"
|
|
|
|
def test_pcr_validates_against_schema(self, policy_check_result_schema):
|
|
rec = {"check_id": "CKV_AWS_20", "check_name": "test", "file_path": "main.tf",
|
|
"resource": "aws_s3_bucket.s3", "resource_address": "aws_s3_bucket.s3"}
|
|
pcr = _to_pcr(rec, "c-1", "FAILED")
|
|
jsonschema.validate(pcr, policy_check_result_schema)
|
|
|
|
|
|
class TestTagNamingSkipped:
|
|
def test_skipped_pcr(self):
|
|
pcr = _emit_tag_naming_skipped("c-1")
|
|
assert pcr["result"] == "skipped"
|
|
assert pcr["ruleId"] == "ACDL_TAG_NAMING"
|
|
assert pcr["severity"] == "info"
|
|
|
|
|
|
class TestAdapt:
|
|
def _sample_checkov_json(self):
|
|
return {
|
|
"terraform_plan": {
|
|
"results": {
|
|
"passed_checks": [
|
|
{"check_id": "CKV_AWS_20", "check_name": "no public ingress",
|
|
"file_path": "main.tf", "resource": "aws_vpc.vpc"}
|
|
],
|
|
"failed_checks": [
|
|
{"check_id": "CKV_AWS_1", "check_name": "no wildcard iam",
|
|
"file_path": "main.tf", "resource": "aws_iam_role.r"}
|
|
],
|
|
"skipped_checks": []
|
|
}
|
|
}
|
|
}
|
|
|
|
def test_adapt_returns_list(self, tmp_path):
|
|
data = self._sample_checkov_json()
|
|
f = tmp_path / "checkov.json"
|
|
f.write_text(json.dumps(data))
|
|
results = adapt(str(f), "c-1")
|
|
assert isinstance(results, list)
|
|
|
|
def test_adapt_includes_tag_naming(self, tmp_path):
|
|
data = self._sample_checkov_json()
|
|
f = tmp_path / "checkov.json"
|
|
f.write_text(json.dumps(data))
|
|
results = adapt(str(f), "c-1")
|
|
tag = [r for r in results if r["ruleId"] == "ACDL_TAG_NAMING"]
|
|
assert len(tag) == 1
|
|
assert tag[0]["result"] == "skipped"
|
|
|
|
def test_adapt_has_passed_and_failed(self, tmp_path):
|
|
data = self._sample_checkov_json()
|
|
f = tmp_path / "checkov.json"
|
|
f.write_text(json.dumps(data))
|
|
results = adapt(str(f), "c-1")
|
|
passed = [r for r in results if r["result"] == "pass"]
|
|
failed = [r for r in results if r["result"] == "fail"]
|
|
assert len(passed) >= 1
|
|
assert len(failed) >= 1
|
|
|
|
def test_adapt_empty_input(self, tmp_path):
|
|
data = {"terraform_plan": {"results": {"passed_checks": [], "failed_checks": [], "skipped_checks": []}}}
|
|
f = tmp_path / "checkov.json"
|
|
f.write_text(json.dumps(data))
|
|
results = adapt(str(f), "c-1")
|
|
assert len(results) == 1 # just the tag naming skipped |