fix(azure): Remove redundant file path from resource name in azure pipelines

checkov/azure_pipelines/runner.py

@@ -1,13 +1,11 @@
 from __future__ import annotations
 
-import os
 from typing import TYPE_CHECKING, Any, Dict, List
 
 from checkov.azure_pipelines.checks.registry import registry
 from checkov.common.output.report import CheckType
 from checkov.yaml_doc.runner import Runner as YamlRunner
 from checkov.common.util.consts import START_LINE, END_LINE
-from pathlib import Path
 
 
 if TYPE_CHECKING:
@@ -36,15 +34,12 @@ def is_workflow_file(self, file_path: str) -> bool:
         return file_path.endswith(('azure-pipelines.yml', 'azure-pipelines.yaml'))
 
     def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
-                     definitions: dict[str, Any] | None = None, root_folder: str | Path | None = None) -> str:
-        relative_file_path = f"/{os.path.relpath(file_path, root_folder)}"
+                     definitions: dict[str, Any] | None = None) -> str:
         if not self.definitions or not isinstance(self.definitions, dict):
-            return relative_file_path
+            return key
         start_line, end_line = self.get_start_and_end_lines(key)
         resource_name = generate_resource_key_recursive(start_line, end_line, self.definitions[file_path])
-        if not resource_name:
-            return relative_file_path
-        return f"{relative_file_path}:{resource_name}"
+        return resource_name if resource_name else key
 
 
 def generate_resource_key_recursive(start_line: int, end_line: int,

checkov/common/runners/object_runner.py

@@ -210,7 +210,7 @@ def add_python_check_results(
                         file_line_range=[start, end + 1],
                         resource=self.get_resource(
                             file_path, key, check.supported_entities,  # type:ignore[arg-type]  # key is str not BaseCheck
-                            root_folder=root_folder),
+                        ),
                         evaluations=None,
                         check_class=check.__class__.__module__,
                         file_abs_path=os.path.abspath(file_path),
@@ -286,7 +286,7 @@ def included_paths(self) -> Iterable[str]:
         return []
 
     def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
-                     definitions: dict[str, Any] | None = None, root_folder: str | Path | None = None) -> str:
+                     definitions: dict[str, Any] | None = None) -> str:
         return f"{file_path}.{key}"
 
     @abstractmethod

checkov/github_actions/runner.py

@@ -20,7 +20,6 @@
 from checkov.common.util.type_forcers import force_dict
 from checkov.github_actions.checks.registry import registry
 from checkov.yaml_doc.runner import Runner as YamlRunner
-from pathlib import Path
 
 if TYPE_CHECKING:
     from checkov.common.checks.base_check_registry import BaseCheckRegistry
@@ -70,7 +69,7 @@ def included_paths(self) -> Iterable[str]:
         return [".github"]
 
     def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
-                     definitions: dict[str, Any] | None = None, root_folder: str | Path | None = None) -> str:
+                     definitions: dict[str, Any] | None = None) -> str:
         if not definitions:
             return key
 

checkov/gitlab_ci/runner.py

@@ -14,7 +14,6 @@
 from checkov.gitlab_ci.checks.registry import registry
 from checkov.gitlab_ci.image_referencer.manager import GitlabCiImageReferencerManager
 from checkov.yaml_doc.runner import Runner as YamlRunner
-from pathlib import Path
 
 if TYPE_CHECKING:
     from checkov.common.checks.base_check_registry import BaseCheckRegistry
@@ -49,7 +48,7 @@ def included_paths(self) -> Iterable[str]:
         return (".gitlab-ci.yml", ".gitlab-ci.yaml")
 
     def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
-                     definitions: dict[str, Any] | None = None, root_folder: str | Path | None = None) -> str:
+                     definitions: dict[str, Any] | None = None) -> str:
         start_line, end_line = self.get_start_and_end_lines(key)
         file_config = force_dict(self.definitions[file_path])
         if not file_config:

checkov/openapi/runner.py

@@ -92,7 +92,7 @@ def is_valid(self, conf: dict[str, Any] | list[dict[str, Any]] | None) -> bool:
             return False
 
     def get_resource(self, file_path: str, key: str, supported_entities: Iterable[str],
-                     definitions: dict[str, Any] | None = None, root_folder: str | Path | None = None) -> str:
+                     definitions: dict[str, Any] | None = None) -> str:
         return ",".join(supported_entities)
 
     def load_file(self, filename: str | Path) -> str:

tests/azure_pipelines/checks/jobs/test_ContainerDigest.py

@@ -16,12 +16,12 @@ def test_examples():
     summary = report.get_summary()
 
     passing_resources = {
-        f"/azure-pipelines.yml:stages[0](ExampleDisplayName).jobs[1](PassDigestDisplayName)",
+        f"stages[0](ExampleDisplayName).jobs[1](PassDigestDisplayName)",
     }
 
     failing_resources = {
-        f"/azure-pipelines.yml:jobs[0](FailTag)",
-        f"/azure-pipelines.yml:stages[0](ExampleDisplayName).jobs[0](FailNoTag)",
+        f"jobs[0](FailTag)",
+        f"stages[0](ExampleDisplayName).jobs[0](FailNoTag)",
     }
 
     passed_check_resources = {c.resource for c in report.passed_checks}

tests/azure_pipelines/checks/jobs/test_ContainerLatestTag.py

@@ -16,13 +16,13 @@ def test_examples():
     summary = report.get_summary()
 
     passing_resources = {
-        f"/azure-pipelines.yml:jobs[1](PassTag)",
-        f"/azure-pipelines.yml:stages[0](Example).jobs[1](PassDigest)",
+        f"jobs[1](PassTag)",
+        f"stages[0](Example).jobs[1](PassDigest)",
     }
 
     failing_resources = {
-        f"/azure-pipelines.yml:jobs[0](FailLatestTag)",
-        f"/azure-pipelines.yml:stages[0](Example).jobs[0](FailNoTag)",
+        f"jobs[0](FailLatestTag)",
+        f"stages[0](Example).jobs[0](FailNoTag)",
     }
 
     passed_check_resources = {c.resource for c in report.passed_checks}

tests/azure_pipelines/checks/jobs/test_SetSecretVariable.py

@@ -16,15 +16,15 @@ def test_examples():
     summary = report.get_summary()
 
     passing_resources = {
-        f"/azure-pipelines.yml:jobs[1](PassSetNormalVariable).steps[0]",
-        f"/azure-pipelines.yml:jobs[1](PassSetNormalVariable).steps[1]",
-        f"/azure-pipelines.yml:stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[0]",
-        f"/azure-pipelines.yml:stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[1]",
+        f"jobs[1](PassSetNormalVariable).steps[0]",
+        f"jobs[1](PassSetNormalVariable).steps[1]",
+        f"stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[0]",
+        f"stages[0](Example).jobs[0](PassSetNoSecretVariable).steps[1]",
     }
 
     failing_resources = {
-        f"/azure-pipelines.yml:jobs[0](FailSetSecretVariable).steps[0](setSecretVariableStep)",
-        f"/azure-pipelines.yml:jobs[0](FailSetSecretVariable).steps[1]",
+        f"jobs[0](FailSetSecretVariable).steps[0](setSecretVariableStep)",
+        f"jobs[0](FailSetSecretVariable).steps[1]",
     }
 
     passed_check_resources = {c.resource for c in report.passed_checks}

tests/azure_pipelines/test_resource_names.py

@@ -6,19 +6,17 @@
     "key,file_path,expected_key",
     [
         ('jobs.jobs.CKV_AZUREPIPELINES_1[32:39]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml',
-         '/azure-pipelines.yml:jobs[0](FailTag)'),
+         'jobs[0](FailTag)'),
         ('stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_1[14:22]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml',
-         '/azure-pipelines.yml:stages[0](Example).jobs[0](FailNoTagDisplayName)'),
+         'stages[0](Example).jobs[0](FailNoTagDisplayName)'),
         ('stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_1[22:29]', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml',
-         '/azure-pipelines.yml:stages[0](Example).jobs[1](PassDigest)'),
-        ('stages[].jobs[].stages[].jobs[].CKV_AZUREPIPELINES_1', '/checkov/tests/azure_pipelines/resources/azure-pipelines.yml',
-         '/azure-pipelines.yml')
+         'stages[0](Example).jobs[1](PassDigest)')
     ],
 )
 def test_get_resource(key, file_path, expected_key, definitions, supported_entities):
     runner = Runner()
     runner.definitions = definitions
-    new_key = runner.get_resource(file_path, key, [], definitions, '/checkov/tests/azure_pipelines/resources')
+    new_key = runner.get_resource(file_path, key, [], definitions)
 
     assert new_key == expected_key