KEH-1159 | Archive Tool Linting

concourse/ci.yml

@@ -1,12 +1,16 @@
 ---
+# Kics linting thinks that the "password" and "github_access_token" keys are secrets, but they are not.
+# These instances are ignored appropriately.
+
 resources:
   - name: resource-repo
     type: git
     icon: github
     source:
       uri: https://github.com/ONS-Innovation/github-repository-archive-script
       username: ((github_access_token))
-      password: x-oauth-basic
+      # kics-scan ignore-line
+      password: x-oauth-basic # checkov:skip=CKV_SECRET_6:Checkov thinks this is a secret, but it is not
       branch: ((branch))
 
 jobs:
@@ -59,6 +63,7 @@ jobs:
             - name: resource-repo
           params:
             secrets: ((sdp_((env))_github_repo_archive_secrets))
+            # kics-scan ignore-line
             github_access_token: ((github_access_token))
           run:
             path: sh

concourse/scripts/assume_role.sh

@@ -6,8 +6,8 @@ set -euo pipefail
 aws sts assume-role --output text \
     --role-arn "${aws_role_arn}" \
     --role-session-name concourse-pipeline-run \
-    --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \
-    | awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
+    --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" |
+    awk -F '\t' '{print $1 > ("AccessKeyId")}{print $2 > ("SecretAccessKey")}{print $3 > ("SessionToken")}'
 
 # shellcheck disable=SC3040,SC2154
 AWS_ACCESS_KEY_ID="$(cat AccessKeyId)"

concourse/scripts/terraform_infra.sh

@@ -41,17 +41,17 @@ terraform init -backend-config=env/"${env}"/backend-"${env}".tfbackend -reconfig
 
 # shellcheck disable=SC2154
 terraform apply \
--var "aws_account_id=$aws_account_id" \
--var "aws_access_key_id=$aws_access_key_id" \
--var "aws_secret_access_key=$aws_secret_access_key" \
--var "aws_secret_name=$aws_secret_name" \
--var "env_name=$env_name" \
--var "lambda_version=${tag}" \
--var "lambda_name=$lambda_name" \
--var "lambda_arch=$lambda_arch" \
--var "lambda_timeout=$lambda_timeout" \
--var "github_app_client_id=$github_app_client_id" \
--var "github_org=$github_org" \
--var "lambda_memory=$lambda_memory" \
--var "schedule=$schedule" \
--auto-approve
+    -var "aws_account_id=$aws_account_id" \
+    -var "aws_access_key_id=$aws_access_key_id" \
+    -var "aws_secret_access_key=$aws_secret_access_key" \
+    -var "aws_secret_name=$aws_secret_name" \
+    -var "env_name=$env_name" \
+    -var "lambda_version=${tag}" \
+    -var "lambda_name=$lambda_name" \
+    -var "lambda_arch=$lambda_arch" \
+    -var "lambda_timeout=$lambda_timeout" \
+    -var "github_app_client_id=$github_app_client_id" \
+    -var "github_org=$github_org" \
+    -var "lambda_memory=$lambda_memory" \
+    -var "schedule=$schedule" \
+    -auto-approve