Skip to content

Commit

Permalink
fix: examples/compose - a deny rule was incorrectly implemented (#841)
Browse files Browse the repository at this point in the history
The conversion to a number of the version string evaluated to a boolean.
Subsequently the boolean was compared to a number, which always resulted in
a failure to comply to that rule.

This PR fixes the conversion error so that the comparison now works as expected.
This PR also adds some tests to prevent regression.

Signed-off-by: Dennis Geurts <github@dennisg.nl>
  • Loading branch information
dennisg authored Jul 8, 2023
1 parent ea57007 commit a6c6055
Show file tree
Hide file tree
Showing 3 changed files with 21 additions and 3 deletions.
12 changes: 12 additions & 0 deletions acceptance.bats
Original file line number Diff line number Diff line change
Expand Up @@ -378,6 +378,18 @@ EOF"
[[ "$output" =~ "No images tagged latest" ]]
}

@test "Can validate a docker-compose file that does not conform to the policy" {
run ./conftest test -p examples/compose/policy examples/compose/docker-compose.yml --no-color
[ "$status" -eq 1 ]
[[ "$output" =~ "2 tests, 0 passed, 0 warnings, 2 failures, 0 exceptions" ]]
}

@test "Can validate a docker-compose file that conforms to the policy" {
run ./conftest test -p examples/compose/policy examples/compose/docker-compose-valid.yml --no-color
[ "$status" -eq 0 ]
[[ "$output" =~ "2 tests, 2 passed, 0 warnings, 0 failures, 0 exceptions" ]]
}

@test "The number of tests run is accurate" {
run ./conftest test -p examples/kubernetes/policy examples/kubernetes/service.yaml --no-color
[ "$status" -eq 0 ]
Expand Down
8 changes: 8 additions & 0 deletions examples/compose/docker-compose-valid.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
version: '3.5'
services:
web:
build: .
ports:
- "5000:5000"
redis:
image: "redis:some-hash"
4 changes: 1 addition & 3 deletions examples/compose/policy/deny.rego
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
package main

version {
to_number(input.version)
}
version := to_number(input.version)

deny[msg] {
endswith(input.services[_].image, ":latest")
Expand Down

0 comments on commit a6c6055

Please sign in to comment.