feat(github): add graph to GitHub Actions

[gruebel]

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

Description

• added some boilerplate to the ObjectRunner to make it easier to add graphs to other runners
• added a graph to GitHub Actions with jobs and steps as resource_types and edges between them
• added an example for a simple attribute and a connection YAML check
• added one regular graph check CKV2_GHA_1 which ensures the user doesn't give write-all permission on the top-level

ex.

-d [path to test file] --framework github_actions --external-checks-dir checkov/tests/github_actions/checks/extra_yaml_checks -c CKV2_GHA_CUSTOM_1

       _               _              
   ___| |__   ___  ___| | _______   __
  / __| '_ \ / _ \/ __| |/ / _ \ \ / /
 | (__| | | |  __/ (__|   < (_) \ V / 
  \___|_| |_|\___|\___|_|\_\___/ \_/  
                                      
By bridgecrew.io | version: 2.1.270 

github_actions scan results:

Passed checks: 1, Failed checks: 1, Skipped checks: 0

Check: CKV2_GHA_CUSTOM_1: "Ensure job permissions don't contain contents write access"
	PASSED for resource: jobs.spelling
	File: /.github/workflows/pr-test.yml:9-33
Check: CKV2_GHA_CUSTOM_1: "Ensure job permissions don't contain contents write access"
	FAILED for resource: jobs.update
	File: /.github/workflows/pr-test.yml:59-80

		59 |     name: Update PR
		60 |     permissions:
		61 |       contents: write
		62 |       pull-requests: write
		63 |     runs-on: ubuntu-latest
		64 |     if: ${{
		65 |         github.event_name == 'issue_comment' &&
		66 |         github.event.issue.pull_request &&
		67 |         contains(github.event.comment.body, '@check-spelling-bot apply')
		68 |       }}
		69 |     concurrency:
		70 |       group: spelling-update-${{ github.event.issue.number }}
		71 |       cancel-in-progress: false
		72 |     steps:
		73 |     - name: apply spelling updates
		74 |       uses: check-spelling/[email protected]
		75 |       with:
		76 |         experimental_apply_changes_via_bot: 1
		77 |         checkout: true
		78 |         ssh_key: "${{ secrets.CHECK_SPELLING }}"

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have added tests that prove my feature, policy, or fix is effective and works
• New and existing tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules

[nimrodkor]

This is really great. I think we should add at least 1 or 2 checks and verify they are packaged correctly in checkov. WDYT?

[gruebel]

This is really great. I think we should add at least 1 or 2 checks and verify they are packaged correctly in checkov. WDYT?

tought about it, but had no good idea, which were unique for a graph check, but I will add something simple 😄

[tronxd]

🥇

[Eliran-Turgeman]

Is that compatible with the resource ids already generated for steps with the python checks? I think that the format for step resources should be 'jobs.<job_name>.steps.<step_name>'

[gruebel]

the name field is optional and you can name all your steps the same, so if we use this in Python checks, we probably should reconsider it. only the order is relevant at the end.

[Eliran-Turgeman]

Very cool 🔥
Had only one comment regarding the resource ids