fix: copilot issues

Signed-off-by: Gustavo Carvalho <gustavo.carvalho@container-solutions.com>

Author: gusfcarvalho

main.go

@@ -44,6 +44,7 @@ const (
 	nonComplianceMessageField   = "non_compliance_message"
 	custodianWatchInterval      = 30 * time.Second
 	custodianOutputTailBytes    = 4096
+	custodianLogTailMaxSections = 5
 )
 
 var lookPath = exec.LookPath
@@ -1116,12 +1117,18 @@ func processSocketInodes(pid int) (map[string]bool, error) {
 	fdDir := filepath.Join("/proc", strconv.Itoa(pid), "fd")
 	entries, err := os.ReadDir(fdDir)
 	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) || errors.Is(err, os.ErrNotExist) {
+			return map[string]bool{}, nil
+		}
 		return nil, err
 	}
 	inodes := map[string]bool{}
 	for _, entry := range entries {
 		target, err := os.Readlink(filepath.Join(fdDir, entry.Name()))
 		if err != nil {
+			if errors.Is(err, fs.ErrNotExist) || errors.Is(err, os.ErrNotExist) {
+				continue
+			}
 			continue
 		}
 		if strings.HasPrefix(target, "socket:[") && strings.HasSuffix(target, "]") {
@@ -1255,8 +1262,13 @@ func readCustodianLogArtifactsForPaths(logPaths []string, maxBytes int) ([]strin
 		return nil, "", nil
 	}
 
-	sections := make([]string, 0, len(logPaths))
-	for _, logPath := range logPaths {
+	sections := make([]string, 0, min(len(logPaths), custodianLogTailMaxSections))
+	for i, logPath := range logPaths {
+		if i >= custodianLogTailMaxSections {
+			remaining := len(logPaths) - custodianLogTailMaxSections
+			sections = append(sections, fmt.Sprintf("custodian log tail truncated: %d additional custodian-run.log file(s) omitted", remaining))
+			break
+		}
 		content, err := readFileTail(logPath, maxBytes)
 		if err != nil {
 			return logPaths, "", fmt.Errorf("failed to read custodian log %s: %w", logPath, err)
@@ -2828,16 +2840,18 @@ func awsResourceExplorerURLWithReason(payload *StandardizedResourcePayload) (str
 		return "", reason
 	}
 
+	partition := awsPartitionFromARN(resourceARN)
 	region := awsRegionFromARN(resourceARN)
-	if region == "" && payload.Resource.Region != "" && payload.Resource.Region != "global" {
+	if region == "" && payload.Resource.Region != "" && payload.Resource.Region != "global" && awsPartitionForRegion(payload.Resource.Region) == partition {
 		region = payload.Resource.Region
 	}
 	if region == "" {
-		region = "us-east-1"
+		region = awsDefaultConsoleRegionForPartition(partition)
 	}
 
 	query := "id:" + resourceARN
-	return "https://console.aws.amazon.com/resource-explorer/home?region=" + url.QueryEscape(region) + "#/search?query=" + url.QueryEscape(query), ""
+	consoleDomain := awsConsoleDomainForPartition(partition)
+	return "https://" + consoleDomain + "/resource-explorer/home?region=" + url.QueryEscape(region) + "#/search?query=" + url.QueryEscape(query), ""
 }
 
 func awsResourceExplorerResourceARN(payload *StandardizedResourcePayload) (string, string) {
@@ -2880,6 +2894,28 @@ func awsPartitionFromARN(arnValue string) string {
 	return ""
 }
 
+func awsConsoleDomainForPartition(partition string) string {
+	switch partition {
+	case "aws-cn":
+		return "console.amazonaws.cn"
+	case "aws-us-gov":
+		return "console.amazonaws-us-gov.com"
+	default:
+		return "console.aws.amazon.com"
+	}
+}
+
+func awsDefaultConsoleRegionForPartition(partition string) string {
+	switch partition {
+	case "aws-cn":
+		return "cn-north-1"
+	case "aws-us-gov":
+		return "us-gov-west-1"
+	default:
+		return "us-east-1"
+	}
+}
+
 func awsPartitionForRegion(region string) string {
 	region = strings.TrimSpace(strings.ToLower(region))
 	switch {

main_test.go

@@ -883,6 +883,32 @@ exit 3
 		}
 	})
 
+	t.Run("limits custodian log artifact tails", func(t *testing.T) {
+		root := t.TempDir()
+		logPaths := make([]string, 0, custodianLogTailMaxSections+2)
+		for i := 0; i < custodianLogTailMaxSections+2; i++ {
+			logPath := filepath.Join(root, fmt.Sprintf("log-%02d", i), "custodian-run.log")
+			if err := os.MkdirAll(filepath.Dir(logPath), 0o755); err != nil {
+				t.Fatalf("failed to create log dir: %v", err)
+			}
+			if err := os.WriteFile(logPath, []byte(fmt.Sprintf("log detail %02d", i)), 0o600); err != nil {
+				t.Fatalf("failed to write log: %v", err)
+			}
+			logPaths = append(logPaths, logPath)
+		}
+
+		_, logTail, err := readCustodianLogArtifactsForPaths(logPaths, custodianOutputTailBytes)
+		if err != nil {
+			t.Fatalf("unexpected log tail error: %v", err)
+		}
+		if got := strings.Count(logTail, "custodian log tail from"); got != custodianLogTailMaxSections {
+			t.Fatalf("expected %d log sections, got %d in:\n%s", custodianLogTailMaxSections, got, logTail)
+		}
+		if !strings.Contains(logTail, "2 additional custodian-run.log file(s) omitted") {
+			t.Fatalf("expected truncation marker, got:\n%s", logTail)
+		}
+	})
+
 	t.Run("does not read custodian log artifacts on success by default", func(t *testing.T) {
 		script := `#!/bin/sh
 set -eu
@@ -973,6 +999,16 @@ printf '[]' > "$out/test-policy/resources.json"
 		}
 	})
 
+	t.Run("treats missing proc fd directory as empty socket snapshot", func(t *testing.T) {
+		inodes, err := processSocketInodes(-1)
+		if err != nil {
+			t.Fatalf("expected missing process fd directory to be non-fatal, got %v", err)
+		}
+		if len(inodes) != 0 {
+			t.Fatalf("expected no socket inodes for missing process, got %#v", inodes)
+		}
+	})
+
 	t.Run("strips plugin-only policy fields before custodian execution", func(t *testing.T) {
 		script := `#!/bin/sh
 set -eu
@@ -1828,7 +1864,7 @@ func TestAWSResourceExplorerURL(t *testing.T) {
 					Region:   "cn-north-1",
 				},
 			},
-			want:     "https://console.aws.amazon.com/resource-explorer/home?region=cn-north-1#/search?query=id%3Aarn%3Aaws-cn%3As3%3A%3A%3Aexample-bucket",
+			want:     "https://console.amazonaws.cn/resource-explorer/home?region=cn-north-1#/search?query=id%3Aarn%3Aaws-cn%3As3%3A%3A%3Aexample-bucket",
 			wantLink: true,
 		},
 		{
@@ -1841,7 +1877,7 @@ func TestAWSResourceExplorerURL(t *testing.T) {
 					Region:   "us-gov-west-1",
 				},
 			},
-			want:     "https://console.aws.amazon.com/resource-explorer/home?region=us-gov-west-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
+			want:     "https://console.amazonaws-us-gov.com/resource-explorer/home?region=us-gov-west-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
 			wantLink: true,
 		},
 		{
@@ -1855,7 +1891,7 @@ func TestAWSResourceExplorerURL(t *testing.T) {
 					Region:    "us-east-1",
 				},
 			},
-			want:     "https://console.aws.amazon.com/resource-explorer/home?region=us-east-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
+			want:     "https://console.amazonaws-us-gov.com/resource-explorer/home?region=us-gov-west-1#/search?query=id%3Aarn%3Aaws-us-gov%3As3%3A%3A%3Aexample-bucket",
 			wantLink: true,
 		},
 		{