Bash environment variable expansion not working for trivy #638
Assignees
Labels
Milestone
Comments
|
Are you sure that you have exported Tested on
|
|
I couldn't reproduce issue as well, though I'm on Linux and have no macOS to try and validate. @MaxymVlasov What confused me was that the var didn't get expanded at all and passed through unchanged, which is unexpected and looks to be what can't happen 😲 This is an excerpt from the author's message: I have no clue what might went wrong on @aaronmell end 🤷🏻 |
|
Im my case neither method worked. I tried explicitly setting it to a value with no success, |
|
Okay, so I eliminated the shells scripts as being the issue, I pulled the repo, and ran the script manually, and it worked as expected. Its only failing when I run pre-commit |
|
I was able to simplify my issue. If I run the script through python with the following commands I get the same issue If I add to the top of a script I get the correct username. I updated bash to the latest version on my mac, just to make sure that wasn't the cause, and same issue. |
> git clone [email protected]:antonbabenko/pre-commit-terraform.git
Cloning into 'pre-commit-terraform'...
remote: Enumerating objects: 2163, done.
remote: Counting objects: 100% (890/890), done.
remote: Compressing objects: 100% (269/269), done.
remote: Total 2163 (delta 810), reused 654 (delta 621), pack-reused 1273
Receiving objects: 100% (2163/2163), 626.91 KiB | 873.00 KiB/s, done.
Resolving deltas: 100% (1477/1477), done.
> cd ./pre-commit-terraform/hooks/
> vim terraform_trivy.sh # edit to not actually run trivy but to only debug
> git diff
diff --git a/hooks/terraform_trivy.sh b/hooks/terraform_trivy.sh
index fd9a320..7a4af9a 100755
--- a/hooks/terraform_trivy.sh
+++ b/hooks/terraform_trivy.sh
@@ -17,7 +17,7 @@ function main {
ARGS[i]=${ARGS[i]/__GIT_WORKING_DIR__/$(pwd)\/}
done
- common::per_dir_hook "$HOOK_ID" "${#ARGS[@]}" "${ARGS[@]}" "${FILES[@]}"
+ echo common::per_dir_hook "$HOOK_ID" "${#ARGS[@]}" "${ARGS[@]}" "${FILES[@]}"
}
#######################################################################
> # Notice the cmdline arg is wrapped into single quote to prevent var expansion for the sake of testing
> ./terraform_trivy.sh '--args=--config-policy="/Users/${USER}/PATH_TO_CUSTOM_POLICY/"'
Found ${USER} in: '--config-policy=/Users/${USER}/PATH_TO_CUSTOM_POLICY/'
After ${USER} expansion: '--config-policy=/Users/giermulnik/PATH_TO_CUSTOM_POLICY/'
common::per_dir_hook terraform_trivy 1 --config-policy=/Users/giermulnik/PATH_TO_CUSTOM_POLICY/
> # Same thing with single quotes around starting here-doc marker: prevent shell var expansion
> python3 <<'EOF'
import subprocess
result = subprocess.run(['./terraform_trivy.sh', '--args=--config-policy="/Users/${USER}/PATH_TO_CUSTOM_POLICY/"'])
EOF
Found ${USER} in: '--config-policy=/Users/${USER}/PATH_TO_CUSTOM_POLICY/'
After ${USER} expansion: '--config-policy=/Users/giermulnik/PATH_TO_CUSTOM_POLICY/'
common::per_dir_hook terraform_trivy 1 --config-policy=/Users/giermulnik/PATH_TO_CUSTOM_POLICY/I cannot reproduce on Linux 🤷🏻 |
|
@aaronmell please set repos:
- repo: https://github.com/antonbabenko/pre-commit-terraform
rev: 919a99b176f93c83e95e67a071569e75cb2698f7
hooks:
- id: terraform_trivy
args:
- --args=--config-policy="/Users/${USER}/PATH_TO_CUSTOM_POLICY/"
verbose: trueRun PCT_LOG=trace pre-commit run -aand send the full output here with Note It adds |
|
@MaxymVlasov Are you sure about single quotes |
|
@yermulnik yes, as |
Oops, my bad, I missed that single quotes don't prevent expansion when used like that. TIL =) |
|
|
So, problem with pre-commit-terraform/hooks/_common.sh Lines 121 to 149 in 919a99b To be specific - with pre-commit-terraform/hooks/_common.sh Line 131 in 919a99b That how it evaluates on @aaronmell machine To "not match" And there is how it evaluates on my machine So, the question is: Why is the next construction evaluates to "not match"? arg='--config-policy=/Users/${USER}/PATH_TO_CUSTOM_POLICY/'
if [[ "$arg" =~ .*'${'[A-Z_][A-Z0-9_]+?'}'.* ]]; then echo "match"; else echo "not match"; fi@aaronmell could you please activate |
|
From logs: Default macOS bash |
|
|
That's the weirdest stuff that I have ever seen. @aaronmell your Mac on which processor? M1, M2 or M3? |
|
@aaronmell Would you please also post the output of > shopt -p | fgrep compat
shopt -u compat31
shopt -u compat32
shopt -u compat40
shopt -u compat41
shopt -u compat42
shopt -u compat43
shopt -u compat44
> arg='--config-policy=/Users/${USER}/PATH_TO_CUSTOM_POLICY/'
> shopt -p | fgrep compat | while read _ _ SHOPT; do echo -n "$SHOPT: "; shopt -s "$SHOPT"; [[ "$arg" =~ .*'${'[A-Z_][A-Z0-9_]+?'}'.* ]] && echo match || echo not match; done
compat31: not match
compat32: match
compat40: match
compat41: match
compat42: match
compat43: match
compat44: match |
|
Confirm that Will sent PR soon |
|
If @aaronmell confirms `compat31 is set on his end, we may try and implement "fail-safe mechanism" 🤪 if [[ $BASHOPTS =~ :compat31: ]]; then
<fail as of shell option incompatibility>
else
<proceed with trivy with `--config-policy` opt>
fi |
You mean |
|
I'm running on an M2 |
Would please post the full output of |
Yes. |
Should probably just replace |
|
( |
Merged
4 tasks
MaxymVlasov
added this to the Features implementing and cleanup without breaking changes milestone
MaxymVlasov
added a commit
that referenced
this issue
Mar 12, 2024
|
This issue has been resolved in version 1.88.2 🎉 |
|
Verified the fix works. Thanks to everyone that helped! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
I have the following pre-commit
How can we reproduce it?
Running the pre-commit from above returns the following
2024-02-26T15:39:31.418-0500 FATAL filesystem scan error: scan error: unable to initialize a scanner: unable to initialize a filesystem scanner: analyzer group error: post-analyzer init error: filesystem scanner init error: policy file "/Users/${USER}/PATH_TO_CUSTOM_POLICY" not foundIf I replace ${USER} with my username it works fine
Environment information
OS:
MacOS: Latest Darwin ARM
Tools availability and versions:
.pre-commit-config.yaml:file content
- repo: https://github.com/antonbabenko/pre-commit-terraform rev: v1.88.0 hooks: - id: terraform_trivy args: - --args=--config-policy="/Users/${USER}/PATH_TO_CUSTOM_POLICY/"The text was updated successfully, but these errors were encountered: