iamleot/conftest-policies

Collection of personal conftest policies

conftest-policies

This repository contains personal conftest policies that are used to check code and try to reach as much as possible a good level of DRY (don't repeat yourself).

NOTE: "personal" here means that some of them could be opinionated, some of them could be also possibly wrong in several possible contexts, beware!

Packages

Each collection of packages has its own documentation:

• data.github.actions.workflows.*
• data.github.dependabot.*
• data.venom.*
• data.terraform.aws.*

Documentation can be (re)generated by running make docs target.

Testing

When adding/deleting/modifying policies the following make targets should be run:

make check-fmt
make lint
make test

...to ensure that policies are properly formatted, linted and tested.

conftest-policies's Issues

`github.actions.workflows.name` triggers false positives since commit 35314ce23f7676b95fae18f73f9577aff2f0da03 (`some ... in` used for iterations)

Since commit 35314ce a regression was likely introduced and when analyzing properly written GitHub Actions workflows github.actions.workflows.name is triggered.

A possible reproducer is against the .github/workflows of this repository at commit 35314ce:

$ conftest test --all-namespaces --policy ./policy/github .github/workflows
FAIL - .github/workflows/conftest.yml - github.actions.workflows.name - Job `{"name": "Check and validate Conftest Rego policies", "runs-on": "ubuntu-latest", "steps": [{"name": "Checkout code", "uses": "actions/checkout@v3"}, {"name": "Install conftest", "run": "mkdir -p \"${HOME}/.local/bin\"\ncurl -sL \"https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz\" | tar xzf - -C \"${HOME}/.local/bin\" conftest\n"}, {"name": "Checking Rego formatting style", "run": "make check-fmt\n"}, {"name": "Unit testing conftest policies", "run": "make test\n"}]}` should have a `name` key
FAIL - .github/workflows/mdformat.yml - github.actions.workflows.name - Job `{"name": "Check Markdown formatting via mdformat", "runs-on": "ubuntu-latest", "steps": [{"name": "Checkout code", "uses": "actions/checkout@v3"}, {"name": "Install mdformat", "run": "pip install mdformat\n"}, {"name": "Check Markdown formatting via mdformat", "run": "mdformat --check .\n"}]}` should have a `name` key
FAIL - .github/workflows/actionlint.yml - github.actions.workflows.name - Job `{"name": "Check GitHub Actions workflows", "runs-on": "ubuntu-latest", "steps": [{"name": "Checkout code", "uses": "actions/checkout@v3"}, {"name": "Check GitHub Actions workflows", "uses": "docker://rhysd/actionlint:latest", "with": {"args": "-color"}}]}` should have a `name` key
FAIL - .github/workflows/conftest-self.yml - github.actions.workflows.name - Job `{"name": "Validate via personal conftest policies", "runs-on": "ubuntu-latest", "steps": [{"name": "Checkout code", "uses": "actions/checkout@v3"}, {"env": {"CONFTEST_POLICIES": "git::https://github.com/iamleot/conftest-policies.git//policy/github"}, "name": "Validate via personal conftest policies", "uses": "docker://openpolicyagent/conftest:latest", "with": {"args": "test --all-namespaces --update \"${{ env.CONFTEST_POLICIES }}\" .github/workflows"}}]}` should have a `name` key

48 tests, 44 passed, 0 warnings, 4 failures, 0 exceptions

Write testcase(s) to trigger that issue and fix it.