Merge pull request #2534 from vamshi-stepsecurity/cp-fix-replace-action

fix: handle replaceable GitHub Actions with folder path references

Author: varunsh-coder

knowledge-base/actions/angular/dev-infra/github-actions/commit-message-based-labels/action-security.yml

@@ -0,0 +1,2 @@
+name: 'Pull Request Labeling' # angular/dev-infra/github-actions/pull-request-labeling
+# GITHUB_TOKEN not used

knowledge-base/actions/angular/dev-infra/github-actions/pull-request-labeling/action-security.yml

@@ -32,7 +32,7 @@ func getMajorVersion(version string) string {
 
 func GetLatestRelease(ownerRepo string) (string, error) {
 	splitOnSlash := strings.Split(ownerRepo, "/")
-	if len(splitOnSlash) != 2 {
+	if len(splitOnSlash) < 2 {
 		return "", fmt.Errorf("invalid owner/repo format: %s", ownerRepo)
 	}
 	owner := splitOnSlash[0]

remediation/workflow/maintainedactions/getlatestrelease.go

@@ -81,7 +81,7 @@ func ReplaceActions(inputYaml string, customerMaintainedActions map[string]strin
 			if newAction, ok := actionMap[actionName]; ok {
 				latestVersion, err := GetLatestRelease(newAction)
 				if err != nil {
-					return "", updated, fmt.Errorf("unable to get latest release: %v", err)
+					return inputYaml, updated, fmt.Errorf("unable to get latest release: %v", err)
 				}
 				replacements = append(replacements, replacement{
 					jobName:        jobName,

remediation/workflow/maintainedactions/maintainedActions.go

@@ -493,5 +493,14 @@
       },
       "score": 10,
       "image": "https://avatars.githubusercontent.com/u/88700172?v=4"
+    },
+    {
+      "name": "step-security/actions-cache/restore",
+      "description": "GitHub Action to restore cache",
+      "forkedFrom": {
+        "name": "tespkg/actions-cache/restore"
+      },
+      "score": 10,
+      "image": "https://avatars.githubusercontent.com/u/88700172?v=4"
     }
 ]

remediation/workflow/maintainedactions/maintainedActions.json

@@ -41,6 +41,14 @@ func TestReplaceActions(t *testing.T) {
 			"created_at": "2023-01-01T00:00:00Z"
 		}`))
 
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/step-security/actions-cache/releases/latest",
+		httpmock.NewStringResponder(200, `{
+				"tag_name": "v1.0.0",
+				"name": "v1.0.0",
+				"body": "Release notes",
+				"created_at": "2023-01-01T00:00:00Z"
+			}`))
+
 	tests := []struct {
 		name        string
 		inputFile   string

remediation/workflow/maintainedactions/maintainedactions_test.go

@@ -133,6 +133,7 @@ func SecureWorkflow(queryStringParams map[string]string, inputYaml string, svc d
 	if replaceMaintainedActions {
 		secureWorkflowReponse.FinalOutput, replacedMaintainedActions, err = maintainedactions.ReplaceActions(secureWorkflowReponse.FinalOutput, maintainedActionsMap)
 		if err != nil {
+			log.Printf("Error replacing maintained actions: %v", err)
 			secureWorkflowReponse.HasErrors = true
 		}
 	}

remediation/workflow/secureworkflow.go

@@ -186,6 +186,28 @@ func TestSecureWorkflow(t *testing.T) {
 			}
 		]`))
 
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/step-security/actions-cache/commits/v1",
+		httpmock.NewStringResponder(200, `d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0a1b2c3`))
+
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/step-security/actions-cache/git/matching-refs/tags/v1.",
+		httpmock.NewStringResponder(200, `[
+			{
+				"ref": "refs/tags/v1.0.0",
+				"object": {
+					"sha": "d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0a1b2c3",
+					"type": "commit"
+				}
+			}
+		]`))
+
+	httpmock.RegisterResponder("GET", "https://api.github.com/repos/step-security/actions-cache/releases/latest",
+		httpmock.NewStringResponder(200, `{
+			"tag_name": "v1.0.0",
+			"name": "v1.0.0",
+			"body": "Release notes",
+			"created_at": "2023-01-01T00:00:00Z"
+		}`))
+
 	tests := []struct {
 		fileName                   string
 		wantPinnedActions          bool
@@ -244,7 +266,6 @@ func TestSecureWorkflow(t *testing.T) {
 				t.Errorf("unable to load the file %s", err)
 			}
 			output, err = SecureWorkflow(queryParams, string(input), &mockDynamoDBClient{}, []string{}, false, actionMap)
-
 		} else {
 			output, err = SecureWorkflow(queryParams, string(input), &mockDynamoDBClient{})
 		}
@@ -275,6 +296,10 @@ func TestSecureWorkflow(t *testing.T) {
 			t.Errorf("test failed %s did not match expected PinnedActions value. Expected:%v Actual:%v", test.fileName, test.wantPinnedActions, output.PinnedActions)
 		}
 
+		if output.AddedMaintainedActions != test.wantAddedMaintainedActions {
+			t.Errorf("test failed %s did not match expected AddedMaintainedActions value. Expected:%v Actual:%v", test.fileName, test.wantAddedMaintainedActions, output.AddedMaintainedActions)
+		}
+
 	}
 }
 

remediation/workflow/secureworkflow_test.go

@@ -14,4 +14,10 @@ jobs:
           do_not_skip: '["release"]'
       - uses: chetan/git-restore-mtime-action@v1
         with:
-          pattern: '**/*'
+          pattern: '**/*'
+      - uses: tespkg/actions-cache/restore@v1
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-

testfiles/maintainedActions/input/oneJob.yml

@@ -14,4 +14,10 @@ jobs:
           do_not_skip: '["release"]'
       - uses: step-security/git-restore-mtime-action@v2
         with:
-          pattern: '**/*'
+          pattern: '**/*'
+      - uses: step-security/actions-cache/restore@v1
+        with:
+          path: ~/.npm
+          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-node-