|
1 | 1 | #!/bin/sh |
2 | 2 |
|
| 3 | +# Checks if `string` contains `substring`. |
| 4 | +# |
| 5 | +# Arguments: |
| 6 | +# String to check. |
| 7 | +# |
| 8 | +# Returns: |
| 9 | +# 0 if `string` contains `substring`, otherwise 1. |
| 10 | +contains() { |
| 11 | + case "$1" in |
| 12 | + *$2*) return 0 ;; |
| 13 | + *) return 1 ;; |
| 14 | + esac |
| 15 | +} |
| 16 | + |
3 | 17 | set -e |
4 | 18 |
|
5 | | -# Declear ks client |
| 19 | +# Kubescape uses the client name to make a request for checking for updates |
6 | 20 | export KS_CLIENT="github_actions" |
7 | 21 |
|
8 | | -if [ ! -z "$INPUT_FRAMEWORKS" ] && [ ! -z "$INPUT_CONTROLS" ]; then |
9 | | -echo "Framework and Control is specified. Please specify either one of them or neither" |
10 | | -exit 1 |
| 22 | +if [ -n "${INPUT_FRAMEWORKS}" ] && [ -n "${INPUT_CONTROLS}" ]; then |
| 23 | + echo "Framework and Control is specified. Please specify either one of them or neither" |
| 24 | + exit 1 |
11 | 25 | fi |
12 | 26 |
|
13 | 27 | # Split the controls by comma and concatenate with quotes around each control |
14 | | -if [ ! -z "$INPUT_CONTROLS" ]; then |
15 | | - CONTROLS="" |
| 28 | +if [ -n "${INPUT_CONTROLS}" ]; then |
| 29 | + controls="" |
16 | 30 | set -f; IFS=',' |
17 | | - set -- $INPUT_CONTROLS |
| 31 | + set -- "${INPUT_CONTROLS}" |
18 | 32 | set +f; unset IFS |
19 | 33 | for control in "$@" |
20 | 34 | do |
21 | | - control=$(echo $control | xargs) # Remove leading/trailing whitespaces |
22 | | - CONTROLS="$CONTROLS\"$control\"," |
| 35 | + control=$(echo "${control}" | xargs) # Remove leading/trailing whitespaces |
| 36 | + controls="${controls}\"${control}\"," |
23 | 37 | done |
24 | | - CONTROLS=$(echo "${CONTROLS%?}") |
| 38 | + controls=$(echo "${controls%?}") |
| 39 | +fi |
| 40 | + |
| 41 | +frameworks_cmd=$([ -n "${INPUT_FRAMEWORKS}" ] && echo "framework ${INPUT_FRAMEWORKS}" || echo "") |
| 42 | +controls_cmd=$([ -n "${INPUT_CONTROLS}" ] && echo control "${controls}" || echo "") |
| 43 | + |
| 44 | +files=$([ -n "${INPUT_FILES}" ] && echo "${INPUT_FILES}" || echo .) |
| 45 | + |
| 46 | +output_formats="${INPUT_FORMAT}" |
| 47 | +have_json_format="false" |
| 48 | +if [ -n "${output_formats}" ] && contains "${output_formats}" "json"; then |
| 49 | + have_json_format="true" |
25 | 50 | fi |
26 | 51 |
|
27 | | -# Subcommands |
28 | | -ARTIFACTS_PATH="/home/ks/.kubescape" |
29 | | -FRAMEWORKS_CMD=$([ ! -z "$INPUT_FRAMEWORKS" ] && echo "framework $INPUT_FRAMEWORKS" || echo "") |
30 | | -CONTROLS_CMD=$([ ! -z "$INPUT_CONTROLS" ] && echo control $CONTROLS || echo "") |
| 52 | +should_fix_files="false" |
| 53 | +if [ "${INPUT_FIXFILES}" = "true" ]; then |
| 54 | + should_fix_files="true" |
| 55 | +fi |
| 56 | + |
| 57 | +# If a user requested Kubescape to fix their files, but forgot to ask for JSON |
| 58 | +# output, do it for them |
| 59 | +if [ "${should_fix_files}" = "true" ] && [ "${have_json_format}" != "true" ]; then |
| 60 | + output_formats="${output_formats},json" |
| 61 | +fi |
31 | 62 |
|
32 | | -# Files to scan |
33 | | -FILES=$([ ! -z "$INPUT_FILES" ] && echo "$INPUT_FILES" || echo .) |
| 63 | +output_file=$([ -n "${INPUT_OUTPUTFILE}" ] && echo "${INPUT_OUTPUTFILE}" || echo "results") |
34 | 64 |
|
35 | | -# Output file name |
36 | | -OUTPUT_FILE=$([ ! -z "$INPUT_OUTPUTFILE" ] && echo "$INPUT_OUTPUTFILE" || echo "results.out") |
| 65 | +account_opt=$([ -n "${INPUT_ACCOUNT}" ] && echo --account "${INPUT_ACCOUNT}" || echo "") |
37 | 66 |
|
38 | | -# Command-line options |
39 | | -ACCOUNT_OPT=$([ ! -z "$INPUT_ACCOUNT" ] && echo --account $INPUT_ACCOUNT || echo "") |
| 67 | +# If account ID is empty, we load artifacts from the local path, otherwise we |
| 68 | +# load from the cloud (this will enable custom framework support) |
| 69 | +artifacts_path="/home/ks/.kubescape" |
| 70 | +artifacts_opt=$([ -n "${INPUT_ACCOUNT}" ] && echo "" || echo --use-artifacts-from "${artifacts_path}") |
40 | 71 |
|
41 | | -# If account ID is empty, we load artifacts from the local path, otherwise we load from the cloud (this will enable custom framework support) |
42 | | -ARTIFACTS=$([ ! -z "$INPUT_ACCOUNT" ] && echo "" || echo --use-artifacts-from $ARTIFACTS_PATH) |
| 72 | +fail_threshold_opt=$([ -n "${INPUT_FAILEDTHRESHOLD}" ] && echo --fail-threshold "${INPUT_FAILEDTHRESHOLD}" || echo "") |
43 | 73 |
|
44 | | -FAIL_THRESHOLD_OPT=$([ ! -z "$INPUT_FAILEDTHRESHOLD" ] && echo --fail-threshold $INPUT_FAILEDTHRESHOLD || echo "") |
45 | | -SEVERITY_THRESHOLD_OPT=$([ ! -z "$INPUT_SEVERITYTHRESHOLD" ] && echo --severity-threshold $INPUT_SEVERITYTHRESHOLD || echo "") |
| 74 | +# When a user requests to fix files, the action should not fail because the |
| 75 | +# results exceed severity. This is subject to change in the future. |
| 76 | +severity_threshold_opt=$(\ |
| 77 | + [ -n "${INPUT_SEVERITYTHRESHOLD}" ] \ |
| 78 | + && [ "${should_fix_files}" = "false" ] \ |
| 79 | + && echo --severity-threshold "${INPUT_SEVERITYTHRESHOLD}" \ |
| 80 | + || echo "" \ |
| 81 | +) |
46 | 82 |
|
47 | | -COMMAND="kubescape scan $FRAMEWORKS_CMD $CONTROLS_CMD $FILES $ACCOUNT_OPT $FAIL_THRESHOLD_OPT $SEVERITY_THRESHOLD_OPT --format $INPUT_FORMAT --output $OUTPUT_FILE $ARTIFACTS" |
| 83 | +# The `kubescape fix` subcommand requires the latest "json" format version. |
| 84 | +# Other formats ignore this flag. |
| 85 | +format_version_opt="--format-version v2" |
48 | 86 |
|
49 | | -eval $COMMAND |
| 87 | +# TODO: include artifacts_opt once https://github.com/kubescape/kubescape/issues/1040 is resolved |
| 88 | +scan_command="kubescape scan ${frameworks_cmd} ${controls_cmd} ${files} ${account_opt} ${fail_threshold_opt} ${severity_threshold_opt} --format ${output_formats} ${format_version_opt} --output ${output_file}" |
50 | 89 |
|
| 90 | +echo "${scan_command}" |
| 91 | +eval "${scan_command}" |
| 92 | + |
| 93 | +if [ "$should_fix_files" = "true" ]; then |
| 94 | + fix_command="kubescape fix --no-confirm ${output_file}.json" |
| 95 | + eval "${fix_command}" |
| 96 | +fi |
0 commit comments