Skip to content

fix(scan): check for required commands before scanning #39

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joeymussalli wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(scan): check for required commands before scanning #39

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 23 additions & 0 deletions scan/trustabl-scan.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,29 @@ JSON_FILE="${JSON_FILE:-trustabl.json}"
RISK_THRESHOLD="${RISK_SCORE_THRESHOLD:-0}"
SEV_THRESHOLD="${SEVERITY_THRESHOLD:-none}"
BRANCH_INPUT="${BRANCH:-}"

# ---- preflight: required commands ----
# The CodePipeline buildspec's install phase ends in `|| true` and hides its
# output, and the CodeCatalyst workflow installs nothing at all, so a build
# image can reach this point missing a dependency with nothing having said so.
# Naming the missing tool here beats the alternative: the first symptom is
# otherwise a downstream guard blaming the scan result for a missing binary.
#
# `git` is deliberately not required — every call is guarded, and without it
# the script degrades to BR=unknown and REPO=$TARGET. `tr` and `seq` are left
# out because they ship in coreutils alongside `head`.
MISSING=""
for _cmd in curl jq tar awk grep head uname; do
command -v "$_cmd" >/dev/null 2>&1 || MISSING="$MISSING $_cmd"
done
if [ -n "$MISSING" ]; then
echo "Missing required command(s):$MISSING"
echo "Install them on the build image before scanning; the CodeBuild image"
echo "aws/codebuild/standard:7.0 ships all of them."
exit 2
fi
unset _cmd MISSING

[ "${DEBUG:-false}" = "true" ] && set -x

set -e
Expand Down