test_check_action_pins_composite.py

"""Tests for the composite-action + local-path coverage in check_action_pins (#137).

Sibling to `tests/test_check_action_pins.py` (which is at the line-cap
edge). Covers the `parse_workflow` extensions added in #137:

- `.github/actions/<name>/action.yml` files are walked alongside workflows.
- Local-path `uses: ./...` references are skipped (not flagged as
  missing-`@`).

`test_check_action_pins.py` covers the workflow case + policy buckets;
this file covers the composite + local-path cases.
"""

from __future__ import annotations

import importlib.util
import sys
from pathlib import Path
from typing import Any
from unittest.mock import patch

REPO_ROOT = Path(__file__).resolve().parent.parent
SCRIPT_PATH = REPO_ROOT / ".github" / "scripts" / "check_action_pins.py"


def _load_script() -> Any:
    spec = importlib.util.spec_from_file_location("check_action_pins", SCRIPT_PATH)
    if spec is None or spec.loader is None:
        msg = f"Could not load script at {SCRIPT_PATH}"
        raise RuntimeError(msg)
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


cap = _load_script()


# ---------- parse_workflow on a composite-action file ----------


def test_parse_walks_composite_action_steps(tmp_path: Path) -> None:
    """`.github/actions/<name>/action.yml` files surface their `uses:` lines."""
    action_yaml = tmp_path / "action.yml"
    action_yaml.write_text(
        "name: 'fake composite'\n"
        "runs:\n"
        "  using: composite\n"
        "  steps:\n"
        "    - uses: actions/checkout@v4\n"
        "    - uses: aquasecurity/trivy-action@" + ("a" * 40) + "  # v0.36.0\n",
        encoding="utf-8",
    )
    refs = cap.parse_workflow(action_yaml)
    actions = [r.action for r in refs]
    assert actions == ["actions/checkout", "aquasecurity/trivy-action"]


def test_parse_skips_local_path_uses(tmp_path: Path) -> None:
    """`uses: ./...` references resolve in-repo and aren't third-party pins."""
    workflow = tmp_path / "fake.yml"
    workflow.write_text(
        "jobs:\n"
        "  reuse:\n"
        "    uses: ./.github/workflows/composite.yml@main\n"
        "  call-composite:\n"
        "    steps:\n"
        "      - uses: ./.github/actions/local\n"
        "      - uses: actions/checkout@v4\n",
        encoding="utf-8",
    )
    refs = cap.parse_workflow(workflow)
    actions = [r.action for r in refs]
    # Both local-path entries skipped; only the third-party one survives.
    assert actions == ["actions/checkout"]


def test_parse_skips_dotdot_local_path(tmp_path: Path) -> None:
    """`uses: ../action` (rare but legal) is also a local-path skip."""
    workflow = tmp_path / "fake.yml"
    workflow.write_text(
        "jobs:\n  j:\n    steps:\n      - uses: ../shared/action\n",
        encoding="utf-8",
    )
    assert cap.parse_workflow(workflow) == []


# ---------- _collect_yaml_files end-to-end ----------


def test_collect_includes_composite_actions(tmp_path: Path) -> None:
    """`_collect_yaml_files` walks both workflows and `.github/actions/`."""
    workflows = tmp_path / "workflows"
    workflows.mkdir()
    (workflows / "ci.yml").write_text(
        "jobs:\n  j:\n    steps:\n      - uses: actions/checkout@v4\n",
        encoding="utf-8",
    )
    actions_dir = tmp_path / "actions"
    composite = actions_dir / "publish"
    composite.mkdir(parents=True)
    (composite / "action.yml").write_text(
        "name: 'publish'\nruns:\n  using: composite\n  steps:\n"
        "    - uses: actions/setup-node@v5\n",
        encoding="utf-8",
    )
    with (
        patch.object(cap, "WORKFLOWS_DIR", workflows),
        patch.object(cap, "ACTIONS_DIR", actions_dir),
    ):
        collected = cap._collect_yaml_files()
    names = sorted(p.name for p in collected)
    assert names == ["action.yml", "ci.yml"]


def test_collect_handles_missing_actions_dir(tmp_path: Path) -> None:
    """Repo without `.github/actions/` (today's shape) still scans workflows."""
    workflows = tmp_path / "workflows"
    workflows.mkdir()
    (workflows / "ci.yml").write_text(
        "jobs:\n  j:\n    steps:\n      - uses: actions/checkout@v4\n",
        encoding="utf-8",
    )
    missing_actions = tmp_path / "no-such-dir"
    with (
        patch.object(cap, "WORKFLOWS_DIR", workflows),
        patch.object(cap, "ACTIONS_DIR", missing_actions),
    ):
        collected = cap._collect_yaml_files()
    assert [p.name for p in collected] == ["ci.yml"]


# ---------- main() end-to-end through composite + local-path ----------


def test_main_flags_violation_in_composite_action(tmp_path: Path, capsys: Any) -> None:
    """A bad pin inside a composite action's steps fails the audit."""
    workflows = tmp_path / "workflows"
    workflows.mkdir()
    (workflows / "ci.yml").write_text(
        "jobs:\n  j:\n    steps:\n      - uses: actions/checkout@v4\n",
        encoding="utf-8",
    )
    actions_dir = tmp_path / "actions"
    bad = actions_dir / "bad"
    bad.mkdir(parents=True)
    # Tag pin on a third-party action — violates third-party-sha policy.
    (bad / "action.yml").write_text(
        "name: 'bad'\nruns:\n  using: composite\n  steps:\n"
        "    - uses: aquasecurity/trivy-action@v0.36.0\n",
        encoding="utf-8",
    )
    with (
        patch.object(cap, "WORKFLOWS_DIR", workflows),
        patch.object(cap, "ACTIONS_DIR", actions_dir),
    ):
        assert cap.main() == 1
    out = capsys.readouterr().out
    assert "aquasecurity/trivy-action" in out
    assert "third-party action requires SHA pin" in out


def test_main_passes_with_clean_composite_action(tmp_path: Path, capsys: Any) -> None:
    """A clean composite action with a SHA + comment passes the audit."""
    workflows = tmp_path / "workflows"
    workflows.mkdir()
    (workflows / "ci.yml").write_text(
        "jobs:\n  j:\n    steps:\n      - uses: actions/checkout@v4\n",
        encoding="utf-8",
    )
    actions_dir = tmp_path / "actions"
    good = actions_dir / "good"
    good.mkdir(parents=True)
    (good / "action.yml").write_text(
        "name: 'good'\nruns:\n  using: composite\n  steps:\n"
        "    - uses: aquasecurity/trivy-action@" + ("a" * 40) + "  # v0.36.0\n",
        encoding="utf-8",
    )
    with (
        patch.object(cap, "WORKFLOWS_DIR", workflows),
        patch.object(cap, "ACTIONS_DIR", actions_dir),
    ):
        assert cap.main() == 0
    out = capsys.readouterr().out
    assert "Action pins audit OK" in out