feat: add problog rule inference to build as code check

pyproject.toml

@@ -29,6 +29,7 @@ dependencies = [
     "jinja2 >=3.1.2,<4.0.0",
     "SQLAlchemy >=2.0.0,<3.0.0",
     "defusedxml >=0.7.1,<1.0.0",
+    "problog >=2.2.4,<3.0.0"
 ]
 keywords = []
 # https://pypi.org/classifiers/
@@ -187,6 +188,7 @@ module = [
     "gitdb.*",
     "yamale.*",
     "defusedxml.*",
+    "problog.*"
 ]
 ignore_missing_imports = true
 

src/macaron/config/defaults.ini

@@ -237,6 +237,7 @@ publisher =
     twine
     flit
     conda
+    tox
 # These are the Python interpreters that may be used to load modules.
 interpreter =
     python
@@ -250,6 +251,7 @@ build_arg =
 deploy_arg =
     publish
     upload
+    release
 [builder.pip.ci.deploy]
 github_actions = pypa/gh-action-pypi-publish
 

src/macaron/parsers/bashparser.py

@@ -1,4 +1,4 @@
-# Copyright (c) 2022 - 2022, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2022 - 2023, Oracle and/or its affiliates. All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
 
 """This module is a Python wrapper for the compiled bashparser binary.
@@ -33,6 +33,7 @@ class BashCommands(TypedDict):
     """CI service type."""
     commands: list[list[str]]
     """Parsed bash commands."""
+    workflow_info: dict
 
 
 def parse_file(file_path: str, macaron_path: str = "") -> dict:
@@ -115,6 +116,7 @@ def extract_bash_from_ci(
     bash_content: str,
     ci_file: str,
     ci_type: str,
+    workflow_info: dict,
     macaron_path: str = "",
     recursive: bool = False,
     repo_path: str = "",
@@ -152,7 +154,9 @@ def extract_bash_from_ci(
     parsed_parent = parse(bash_content)
     caller_commands = parsed_parent.get("commands", [])
     if caller_commands:
-        yield BashCommands(caller_path=ci_file, CI_path=ci_file, CI_type=ci_type, commands=caller_commands)
+        yield BashCommands(
+            caller_path=ci_file, CI_path=ci_file, CI_type=ci_type, commands=caller_commands, workflow_info=workflow_info
+        )
 
     # Parse the bash script files called from the current script.
     if recursive and repo_path:
@@ -171,4 +175,5 @@ def extract_bash_from_ci(
                     CI_path=ci_file,
                     CI_type=ci_type,
                     commands=callee_commands,
+                    workflow_info=workflow_info,
                 )

src/macaron/slsa_analyzer/build_tool/base_build_tool.py

@@ -79,6 +79,7 @@ def __init__(self, name: str) -> None:
         }
         self.build_log: list[str] = []
         self.wrapper_files: list[str] = []
+        self.project_name: str = ""
 
     def __str__(self) -> str:
         return self.name

src/macaron/slsa_analyzer/build_tool/pip.py

@@ -7,6 +7,8 @@
 """
 
 import logging
+import os
+import tomllib
 
 from macaron.config.defaults import defaults
 from macaron.dependency_analyzer import DependencyAnalyzer, NoneDependencyAnalyzer
@@ -49,6 +51,23 @@ def is_detected(self, repo_path: str) -> bool:
         """
         for file in self.build_configs:
             if file_exists(repo_path, file):
+                # Find project name value from the config file.
+                # TODO: improve this approach, support setup.py
+                file_path = os.path.join(repo_path, file)
+                if file == "pyproject.toml":
+                    try:
+                        with open(file_path, "rb") as toml_file:
+                            try:
+                                data = tomllib.load(toml_file)
+                                project = data.get("project", {})
+                                if project:
+                                    # Store the project name
+                                    self.project_name = project.get("name", "")
+                                    logger.info("Package name: %s", self.project_name)
+                            except tomllib.TOMLDecodeError:
+                                logger.debug("Failed to read the %s file: invalid toml file.", file)
+                    except FileNotFoundError:
+                        logger.debug("Failed to read the %s file.", file)
                 return True
         return False
 

src/macaron/slsa_analyzer/build_tool/poetry.py

@@ -64,8 +64,9 @@ def is_detected(self, repo_path: str) -> bool:
 
             if files_detected:
                 # If a package_lock file exists, and a config file is present, Poetry build tool is detected.
+                # TODO: package_lock_exists check removed for now so poetry # tool name is stored.
                 if package_lock_exists:
-                    return True
+                    logger.info("Lock file found.")  # return True
                 # TODO: this implementation assumes one build type, so when multiple build types are supported, this
                 # needs to be updated.
                 # Take the highest level file, if there are two at the same level, take the first in the list.
@@ -76,16 +77,17 @@ def is_detected(self, repo_path: str) -> bool:
                         try:
                             data = tomllib.load(toml_file)
                             # Check for the existence of a [tool.poetry] section.
-                            if ("tool" in data) and ("poetry" in data["tool"]):
+                            poetry_tool = data.get("tool", {}).get("poetry", {})
+                            if poetry_tool:
+                                # Store the project name
+                                self.project_name = poetry_tool.get("name")
                                 return True
                         except tomllib.TOMLDecodeError:
                             logger.error("Failed to read the %s file: invalid toml file.", conf)
-                            return False
-                    return False
                 except FileNotFoundError:
                     logger.error("Failed to read the %s file.", conf)
-                    return False
-
+                if package_lock_exists:
+                    return True
         return False
 
     def prepare_config_files(self, wrapper_path: str, build_dir: str) -> bool:

src/macaron/slsa_analyzer/checks/base_check.py

@@ -86,6 +86,7 @@ def run(self, target: AnalyzeContext, skipped_info: Optional[SkippedInfo] = None
             justification=[],
             result_type=CheckResultType.SKIPPED,
             result_tables=[],
+            confidence_score=0.0,
         )
 
         if skipped_info: