Remove line continuations in all run steps. (#2335)

Signed-off-by: Spencer Schrock <sschrock@google.com> Signed-off-by: Spencer Schrock <sschrock@google.com>
ossf · Oct 6, 2022 · 7992368 · 7992368
1 parent 4b99a3a
commit 7992368
Show file tree

Hide file tree

Showing 3 changed files with 31 additions and 2 deletions.
diff --git a/checks/fileparser/github_workflow.go b/checks/fileparser/github_workflow.go
@@ -426,8 +426,9 @@ func stepsMatch(stepToMatch *JobMatcherStep, step *actionlint.Step) bool {
 		if run == nil {
 			return false
 		}
+		withoutLineContinuations := regexp.MustCompile("\\\\(\n|\r|\r\n)").ReplaceAllString(run.Value, "")
 		r := regexp.MustCompile(stepToMatch.Run)
-		if !r.MatchString(run.Value) {
+		if !r.MatchString(withoutLineContinuations) {
 			return false
 		}
 	}

diff --git a/checks/fileparser/github_workflow_test.go b/checks/fileparser/github_workflow_test.go
@@ -938,6 +938,11 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			filename: "../testdata/.github/workflows/github-workflow-packaging-maven.yaml",
 			expected: true,
 		},
+		{
+			name:     "maven publish multi-line",
+			filename: "../testdata/.github/workflows/github-workflow-packaging-maven-multi-line.yaml",
+			expected: true,
+		},
 		{
 			name:     "gradle publish",
 			filename: "../testdata/.github/workflows/github-workflow-packaging-gradle.yaml",
@@ -1004,7 +1009,7 @@ func TestIsPackagingWorkflow(t *testing.T) {
 			}
 			workflow, errs := actionlint.Parse(content)
 			if len(errs) > 0 && workflow == nil {
-				t.Errorf("cannot parse file: %v", err)
+				t.Errorf("cannot parse file: %v", errs)
 			}
 			p := strings.Replace(tt.filename, "../testdata/", "", 1)
 

diff --git a/checks/testdata/.github/workflows/github-workflow-packaging-maven-multi-line.yaml b/checks/testdata/.github/workflows/github-workflow-packaging-maven-multi-line.yaml
@@ -0,0 +1,23 @@
+# Copyright 2022 Security Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-java@v1
+      - run: |
+          mvn \
+            clean deploy