diff options
| -rw-r--r-- | ale_linters/terraform/checkov.vim | 41 | ||||
| -rw-r--r-- | doc/ale-supported-languages-and-tools.txt | 1 | ||||
| -rw-r--r-- | doc/ale-terraform.txt | 19 | ||||
| -rw-r--r-- | doc/ale.txt | 1 | ||||
| -rw-r--r-- | supported-tools.md | 1 | ||||
| -rw-r--r-- | test/handler/test_checkov_handler.vader | 66 | ||||
| -rw-r--r-- | test/linter/test_checkov.vader | 14 |
7 files changed, 143 insertions, 0 deletions
diff --git a/ale_linters/terraform/checkov.vim b/ale_linters/terraform/checkov.vim new file mode 100644 index 00000000..568b46e1 --- /dev/null +++ b/ale_linters/terraform/checkov.vim @@ -0,0 +1,41 @@ +" Author: Thyme-87 <thyme-87@posteo.me> +" Description: use checkov for providing warnings via ale + +call ale#Set('terraform_checkov_executable', 'checkov') +call ale#Set('terraform_checkov_options', '') + +function! ale_linters#terraform#checkov#GetExecutable(buffer) abort + return ale#Var(a:buffer, 'terraform_checkov_executable') +endfunction + +function! ale_linters#terraform#checkov#GetCommand(buffer) abort + return '%e ' . '-f %t -o json --quiet ' . ale#Var(a:buffer, 'terraform_checkov_options') +endfunction + +function! ale_linters#terraform#checkov#Handle(buffer, lines) abort + let l:output = [] + + let l:results = get(get(ale#util#FuzzyJSONDecode(a:lines, {}), 'results', []), 'failed_checks', []) + + for l:violation in l:results + call add(l:output, { + \ 'filename': l:violation['file_path'], + \ 'lnum': l:violation['file_line_range'][0], + \ 'end_lnum': l:violation['file_line_range'][1], + \ 'text': l:violation['check_name'] . ' [' . l:violation['check_id'] . ']', + \ 'detail': l:violation['check_id'] . ': ' . l:violation['check_name'] . "\n" . + \ 'For more information, see: '. l:violation['guideline'], + \ 'type': 'W', + \ }) + endfor + + return l:output +endfunction + +call ale#linter#Define('terraform', { +\ 'name': 'checkov', +\ 'output_stream': 'stdout', +\ 'executable': function('ale_linters#terraform#checkov#GetExecutable'), +\ 'command': function('ale_linters#terraform#checkov#GetCommand'), +\ 'callback': 'ale_linters#terraform#checkov#Handle', +\}) diff --git a/doc/ale-supported-languages-and-tools.txt b/doc/ale-supported-languages-and-tools.txt index df9b5dd6..f12e0c87 100644 --- a/doc/ale-supported-languages-and-tools.txt +++ b/doc/ale-supported-languages-and-tools.txt @@ -560,6 +560,7 @@ Notes: * Tcl * `nagelfar`!! * Terraform + * `checkov` * `terraform` * `terraform-fmt-fixer` * `terraform-ls` diff --git a/doc/ale-terraform.txt b/doc/ale-terraform.txt index 175bdf5c..6acf63ac 100644 --- a/doc/ale-terraform.txt +++ b/doc/ale-terraform.txt @@ -3,6 +3,25 @@ ALE Terraform Integration *ale-terraform-options* =============================================================================== +checkov *ale-terraform-checkov* + +g:ale_terraform_checkov_executable *g:ale_terraform_checkov_executable* + *b:ale_terraform_checkov_executable* + + Type: |String| + Default: `'checkov'` + + This variable can be changed to use a different executable for checkov. + + +g:ale_terraform_checkov_options *g:ale_terraform_checkov_options* + *b:ale_terraform_checkov_options* + Type: |String| + Default: `''` + + This variable can be changed to set additional options for checkov. + +=============================================================================== terraform-fmt-fixer *ale-terraform-fmt-fixer* g:ale_terraform_fmt_executable *g:ale_terraform_fmt_executable* diff --git a/doc/ale.txt b/doc/ale.txt index 0ac01305..dda7a712 100644 --- a/doc/ale.txt +++ b/doc/ale.txt @@ -3112,6 +3112,7 @@ documented in additional help files. tcl.....................................|ale-tcl-options| nagelfar..............................|ale-tcl-nagelfar| terraform...............................|ale-terraform-options| + checkov...............................|ale-terraform-checkov| terraform-fmt-fixer...................|ale-terraform-fmt-fixer| terraform.............................|ale-terraform-terraform| terraform-ls..........................|ale-terraform-terraform-ls| diff --git a/supported-tools.md b/supported-tools.md index 96063205..9e03ddbb 100644 --- a/supported-tools.md +++ b/supported-tools.md @@ -569,6 +569,7 @@ formatting. * Tcl * [nagelfar](http://nagelfar.sourceforge.net) :floppy_disk: * Terraform + * [checkov](https://github.com/bridgecrewio/checkov) * [terraform](https://github.com/hashicorp/terraform) * [terraform-fmt-fixer](https://github.com/hashicorp/terraform) * [terraform-ls](https://github.com/hashicorp/terraform-ls) diff --git a/test/handler/test_checkov_handler.vader b/test/handler/test_checkov_handler.vader new file mode 100644 index 00000000..9884113c --- /dev/null +++ b/test/handler/test_checkov_handler.vader @@ -0,0 +1,66 @@ +Before: + runtime ale_linters/terraform/checkov.vim + call ale#test#SetFilename('main.tf') + +After: + call ale#linter#Reset() + +Execute(The JSON output of checkov should be handled correctly): + AssertEqual + \ [ + \ { + \ 'filename': '/main.tf', + \ 'lnum': 22, + \ 'end_lnum': 27, + \ 'text': 'Enable VPC Flow Logs and Intranode Visibility [CKV_GCP_61]', + \ 'detail': "CKV_GCP_61: Enable VPC Flow Logs and Intranode Visibility\n" . + \ 'For more information, see: https://docs.bridgecrew.io/docs/enable-vpc-flow-logs-and-intranode-visibility', + \ 'type': 'W', + \ } + \ ], + \ ale_linters#terraform#checkov#Handle(bufnr(''), [ + \'{', + \' "check_type": "terraform",', + \' "results": {', + \' "failed_checks": [', + \' {', + \' "check_id": "CKV_GCP_61",', + \' "bc_check_id": "BC_GCP_KUBERNETES_18",', + \' "check_name": "Enable VPC Flow Logs and Intranode Visibility",', + \' "check_result": {', + \' "result": "FAILED",', + \' "evaluated_keys": [', + \' "enable_intranode_visibility"', + \' ]', + \' },', + \' "file_path": "/main.tf",', + \' "repo_file_path": "/main.tf",', + \' "file_line_range": [', + \' 22,', + \' 27', + \' ],', + \' "resource": "google_container_cluster.cluster-name",', + \' "evaluations": null,', + \' "check_class": "checkov.terraform.checks.resource.gcp.GKEEnableVPCFlowLogs",', + \' "entity_tags": null,', + \' "resource_address": null,', + \' "guideline": "https://docs.bridgecrew.io/docs/enable-vpc-flow-logs-and-intranode-visibility"', + \' }', + \' ]', + \' }', + \'}' + \ ]) + +Execute(Handle output for no findings correctly): + AssertEqual + \ [], + \ ale_linters#terraform#checkov#Handle(bufnr(''), [ + \'{', + \' "passed": 0,', + \' "failed": 0,', + \' "skipped": 0,', + \' "parsing_errors": 0,', + \' "resource_count": 0,', + \' "checkov_version": "2.0.632"', + \'}' + \]) diff --git a/test/linter/test_checkov.vader b/test/linter/test_checkov.vader new file mode 100644 index 00000000..f93d34f3 --- /dev/null +++ b/test/linter/test_checkov.vader @@ -0,0 +1,14 @@ +Before: + call ale#assert#SetUpLinterTest('terraform', 'checkov') + +After: + call ale#assert#TearDownLinterTest() + +Execute(The default command should be direct): + AssertLinter 'checkov', + \ ale#Escape('checkov') . ' -f %t -o json --quiet ' + +Execute(It should be possible to override the default command): + let b:ale_terraform_checkov_executable = '/bin/other/checkov' + AssertLinter '/bin/other/checkov', + \ ale#Escape('/bin/other/checkov') . ' -f %t -o json --quiet ' |