GitGuardian / ggshield

Find and fix 400+ types of hardcoded secrets and 70+ types of infrastructure-as-code misconfigurations.
https://gitguardian.com
MIT License
1.62k stars 143 forks source link

Fix IAC scan all on subdirectories #820

Closed Paul-GitGuardian closed 8 months ago

Paul-GitGuardian commented 8 months ago

Currently, tars have two ways to be created in GGShield:

However, the all behavior introduces two issues for IAC when calling the command with a Git subdirectory as argument:

  1. File contents are not shown in the output, as the output handler looks for files relative to the git root, but is given filepaths relative to the subdir argument
  2. Only the subdir is added to the tar sent to the API, preventing from linking existing incidents properly (as their paths are relative to the git root) SCA is not impacted by these issues yet, but would be impacted by 2. when implemented.

This PR solves this issue by using the git root for all scans too as the root directory. If the scanned directory isn't a Git repository, the current behavior is maintained.

codecov-commenter commented 8 months ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Comparison is base (8eb47db) 91.96% compared to head (056864d) 92.04%. Report is 4 commits behind head on main.

:exclamation: Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #820 +/- ## ========================================== + Coverage 91.96% 92.04% +0.07% ========================================== Files 160 160 Lines 6786 6788 +2 ========================================== + Hits 6241 6248 +7 + Misses 545 540 -5 ``` | [Flag](https://app.codecov.io/gh/GitGuardian/ggshield/pull/820/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=GitGuardian) | Coverage Δ | | |---|---|---| | [unittests](https://app.codecov.io/gh/GitGuardian/ggshield/pull/820/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=GitGuardian) | `92.04% <100.00%> (+0.07%)` | :arrow_up: | Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=GitGuardian#carryforward-flags-in-the-pull-request-comment) to find out more.

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

Paul-GitGuardian commented 8 months ago

For SCA, after the fix, the output will show filepaths relative to the git repository root, instead of relative to the given directory. Is that a problem?