⭐️ inventory template support

apps/cnquery/cmd/root.go

@@ -214,16 +214,12 @@ func getCobraScanConfig(cmd *cobra.Command, runtime *providers.Runtime, cliRes *
 	config.DisplayUsedConfig()
 
 	props := viper.GetStringMapString("props")
-	annotations := viper.GetStringMapString("annotation")
 
 	// merge the config and the user-provided annotations with the latter having precedence
 	optAnnotations := opts.Annotations
 	if optAnnotations == nil {
 		optAnnotations = map[string]string{}
 	}
-	for k, v := range annotations {
-		optAnnotations[k] = v
-	}
 
 	assetName := viper.GetString("asset-name")
 	if assetName != "" && cliRes.Asset != nil {

apps/cnquery/cmd/scan.go

@@ -31,6 +31,8 @@ func init() {
 	_ = scanCmd.Flags().String("platform-id", "", "Select a specific target asset by providing its platform ID.")
 
 	_ = scanCmd.Flags().String("inventory-file", "", "Set the path to the inventory file.")
+	_ = scanCmd.Flags().String("inventory-template", "", "Set the path to the inventory template.")
+	_ = scanCmd.Flags().MarkHidden("inventory-template")
 
 	_ = scanCmd.Flags().Bool("inventory-format-ansible", false, "Set the inventory format to Ansible.")
 	// "inventory-ansible" is deprecated, use "inventory-format-ansible" instead
@@ -89,6 +91,7 @@ To manually configure a query pack, use this:
 
 		_ = viper.BindPFlag("platform-id", cmd.Flags().Lookup("platform-id"))
 		_ = viper.BindPFlag("inventory-file", cmd.Flags().Lookup("inventory-file"))
+		_ = viper.BindPFlag("inventory-template", cmd.Flags().Lookup("inventory-template"))
 		_ = viper.BindPFlag("inventory-ansible", cmd.Flags().Lookup("inventory-ansible"))
 		_ = viper.BindPFlag("inventory-domainlist", cmd.Flags().Lookup("inventory-domainlist"))
 		_ = viper.BindPFlag("querypack-bundle", cmd.Flags().Lookup("querypack-bundle"))
@@ -97,15 +100,15 @@ To manually configure a query pack, use this:
 		_ = viper.BindPFlag("trace-id", cmd.Flags().Lookup("trace-id"))
 		_ = viper.BindPFlag("category", cmd.Flags().Lookup("category"))
 
-		_ = viper.BindPFlag("annotations", cmd.Flags().Lookup("annotations"))
-		_ = viper.BindPFlag("props", cmd.Flags().Lookup("props"))
-
 		// for all assets
 		_ = viper.BindPFlag("incognito", cmd.Flags().Lookup("incognito"))
 		_ = viper.BindPFlag("insecure", cmd.Flags().Lookup("insecure"))
 		_ = viper.BindPFlag("querypacks", cmd.Flags().Lookup("querypack"))
 		_ = viper.BindPFlag("sudo.active", cmd.Flags().Lookup("sudo"))
 		_ = viper.BindPFlag("record", cmd.Flags().Lookup("record"))
+		// NOTE: we may "annotation" to "annotations" to align it with the internal config struct
+		_ = viper.BindPFlag("annotations", cmd.Flags().Lookup("annotation"))
+		_ = viper.BindPFlag("props", cmd.Flags().Lookup("props"))
 
 		_ = viper.BindPFlag("output", cmd.Flags().Lookup("output"))
 		_ = viper.BindPFlag("json", cmd.Flags().Lookup("json"))

cli/inventoryloader/inventory.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"os"
 	"runtime"
+	"text/template"
 
 	"github.com/cockroachdb/errors"
 	"github.com/rs/zerolog/log"
@@ -52,32 +53,68 @@ func loadDataPipe() ([]byte, bool) {
 	return nil, false
 }
 
+func renderTemplate(data []byte) ([]byte, error) {
+	type InventoryTemplateVariables struct{}
+	conf := InventoryTemplateVariables{}
+
+	// allows users to access environment variables in templates
+	funcMap := template.FuncMap{
+		"getenv": func(varName string) string { return os.Getenv(varName) },
+	}
+
+	tmpl, err := template.New("inventory-template").Funcs(funcMap).Parse(string(data))
+	if err != nil {
+		return nil, errors.Wrap(err, "could not parse inventory template")
+	}
+	buf := &bytes.Buffer{}
+	err = tmpl.Execute(buf, conf)
+	return buf.Bytes(), err
+}
+
 // Parse uses the viper flags for `--inventory-file` to load the inventory
+// - if `--inventory-file` is set to "-" it will read from stdin
+// - if `--inventory-template` is set it injects environment variables into the inventory before execution
 func Parse() (*inventory.Inventory, error) {
+	var data []byte
+	var err error
+
+	// a pre-rendered inventory file has always precedence over the inventory template
 	inventoryFilePath := viper.GetString("inventory-file")
+	inventoryTemplate := viper.GetString("inventory-template")
 
 	// check in an inventory file was provided
-	if inventoryFilePath == "" {
+	if inventoryFilePath == "" && inventoryTemplate == "" {
 		return inventory.New(), nil
 	}
 
-	var data []byte
-	var err error
-
-	// for we just read the data from the input file
-	if inventoryFilePath != "-" {
-		log.Info().Str("inventory-file", inventoryFilePath).Msg("load inventory")
-		data, err = os.ReadFile(inventoryFilePath)
-		if err != nil {
-			return nil, err
-		}
-	} else {
+	if inventoryFilePath == "-" {
+		// read data from stdin
 		log.Info().Msg("load inventory from piped input")
 		var ok bool
 		data, ok = loadDataPipe()
 		if !ok {
 			return nil, errors.New("could not read inventory from piped input")
 		}
+	} else if inventoryFilePath != "" {
+		// read the data from the input file
+		log.Info().Str("inventory-file", inventoryFilePath).Msg("load inventory")
+		data, err = os.ReadFile(inventoryFilePath)
+		if err != nil {
+			return nil, err
+		}
+	} else if inventoryTemplate != "" {
+		// render inventory template first, then continue with generated inventory file
+		log.Info().Str("inventory-template", inventoryTemplate).Msg("load inventory template")
+		templateData, err := os.ReadFile(inventoryTemplate)
+		if err != nil {
+			return nil, err
+		}
+		data, err = renderTemplate(templateData)
+		if err != nil {
+			return nil, err
+		}
+	} else {
+		return nil, errors.New("no inventory file or template provided")
 	}
 
 	// force detection

cli/inventoryloader/inventory_test.go

@@ -0,0 +1,35 @@
+// Copyright (c) Mondoo, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package inventoryloader
+
+import (
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"os"
+	"testing"
+)
+
+func TestInventoryTemplate(t *testing.T) {
+	os.Setenv("MY_APPLICATION", "app1")
+	os.Setenv("OPERATING_ENVIRONMENT", "dev")
+	inventoryTemplate := `
+spec:
+  assets:
+    - name: Scenario TF {{ getenv "OPERATING_ENVIRONMENT" }}
+      connections:
+        - type: terraform-hcl
+          options:
+            ignore-dot-terraform: "false"
+            path: okta.tf
+      annotations:
+        Application: {{ getenv "MY_APPLICATION" }}
+        OperatingEnv: {{ getenv "OPERATING_ENVIRONMENT" }}
+`
+
+	data, err := renderTemplate([]byte(inventoryTemplate))
+	require.NoError(t, err)
+
+	assert.Contains(t, string(data), "Application: app1")
+	assert.Contains(t, string(data), "Scenario TF dev")
+}