rsconstruct 0.9.124

Rust based fast build system
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

//! The `credentials` rule: passwords written into `container:`/`services:`.

use super::{Rule, RuleBase};
use crate::engines::actionlint::ast::{Container, Job};
use crate::engines::actionlint::yaml::go_quote;

pub struct RuleCredentials {
    base: RuleBase,
}

impl RuleCredentials {
    pub const fn new() -> Self {
        Self {
            base: RuleBase::new("credentials"),
        }
    }

    fn check_container(&mut self, where_: &str, n: &Container) {
        let Some(c) = &n.credentials else {
            return;
        };
        let Some(p) = &c.password else {
            return;
        };
        if !p.is_expression_assigned() {
            self.base.error(
                p.pos,
                format!(
                    "\"password\" section in {where_} should be specified via secrets. do not put password value directly"
                ),
            );
        }
    }
}

impl Rule for RuleCredentials {
    fn base(&mut self) -> &mut RuleBase {
        &mut self.base
    }

    fn visit_job_pre(&mut self, job: &Job) {
        if let Some(c) = &job.container {
            self.check_container("\"container\" section", c);
        }
        if let Some(s) = &job.services {
            for service in s.value.values() {
                let where_ = format!("{} service", go_quote(&service.name.value));
                self.check_container(&where_, &service.container);
            }
        }
    }
}