Don't error on workflow parse failure in Binary-Artifacts (#2170)

checks/raw/binary_artifact.go

@@ -222,8 +222,9 @@ func checkWorkflowValidatesGradleWrapper(path string, content []byte, args ...in
 	}
 
 	action, errs := actionlint.Parse(content)
-	if len(errs) > 0 {
-		return true, errs[0]
+	if len(errs) > 0 || action == nil {
+		// Parse fail, so not this file.
+		return true, nil
 	}
 
 	for _, j := range action.Jobs {
@@ -249,7 +250,7 @@ func checkWorkflowValidatesGradleWrapper(path string, content []byte, args ...in
 				}
 				// OK! This is it.
 				*validatingWorkflowFile = filepath.Base(path)
-				return true, nil
+				return false, nil
 			}
 		}
 	}

checks/raw/binary_artifact_test.go

@@ -99,8 +99,8 @@ func TestBinaryArtifacts(t *testing.T) {
 			files: [][]string{
 				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
 				{
-					"../testdata/binaryartifacts/workflows/nonverify.yml",
-					"../testdata/binaryartifacts/workflows/verify.yml",
+					"../testdata/binaryartifacts/workflows/nonverify.yaml",
+					"../testdata/binaryartifacts/workflows/verify.yaml",
 				},
 			},
 			successfulWorkflowRuns: []clients.WorkflowRun{
@@ -124,7 +124,7 @@ func TestBinaryArtifacts(t *testing.T) {
 			err:  nil,
 			files: [][]string{
 				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
-				{"../testdata/binaryartifacts/workflows/nonverify.yml"},
+				{"../testdata/binaryartifacts/workflows/nonverify.yaml"},
 			},
 			getFileContentCount: 2,
 			expect:              1,
@@ -134,7 +134,7 @@ func TestBinaryArtifacts(t *testing.T) {
 			err:  nil,
 			files: [][]string{
 				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
-				{"../testdata/binaryartifacts/workflows/verify.yml"},
+				{"../testdata/binaryartifacts/workflows/verify.yaml"},
 			},
 			successfulWorkflowRuns: []clients.WorkflowRun{
 				{
@@ -158,13 +158,51 @@ func TestBinaryArtifacts(t *testing.T) {
 			files: [][]string{
 				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
 				{
-					"../testdata/binaryartifacts/workflows/nonverify.yml",
-					"../testdata/binaryartifacts/workflows/verify-outdated-action.yml",
+					"../testdata/binaryartifacts/workflows/nonverify.yaml",
+					"../testdata/binaryartifacts/workflows/verify-outdated-action.yaml",
 				},
 			},
 			getFileContentCount: 3,
 			expect:              1,
 		},
+		{
+			name: "gradle-wrapper.jar with no verification action due to bad workflow",
+			err:  nil,
+			files: [][]string{
+				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
+				{
+					"../testdata/binaryartifacts/workflows/invalid.yaml",
+				},
+			},
+			getFileContentCount: 2,
+			expect:              1,
+		},
+		{
+			name: "gradle-wrapper.jar with verification and bad workflow",
+			err:  nil,
+			files: [][]string{
+				{"../testdata/binaryartifacts/jars/gradle-wrapper.jar"},
+				{
+					"../testdata/binaryartifacts/workflows/invalid.yaml",
+					"../testdata/binaryartifacts/workflows/verify.yaml",
+				},
+			},
+			successfulWorkflowRuns: []clients.WorkflowRun{
+				{
+					HeadSHA: strptr("sha-a"),
+				},
+			},
+			commits: []clients.Commit{
+				{
+					SHA: "sha-a",
+				},
+				{
+					SHA: "sha-old",
+				},
+			},
+			getFileContentCount: 3,
+			expect:              0,
+		},
 	}
 	for _, tt := range tests {
 		tt := tt // Re-initializing variable so it is not changed while executing the closure below

checks/testdata/binaryartifacts/workflows/invalid.yaml

@@ -0,0 +1,12 @@
+name: "Workflow with no on property"
+
+jobs:
+  validation:
+    name: "Build"
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-go@v3
+        with:
+          go-version: '1.18.3' # The Go version to download (if necessary) and use.
+      - run: go run main.go