72 lines
2.2 KiB
Python
72 lines
2.2 KiB
Python
"""Check Ansible tasks for missing no_log on secret-handling tasks.
|
|
|
|
Thin wrapper around :mod:`devx.tools.ansible_checks.no_log` for
|
|
backward compatibility. The check logic lives in the subpackage; this
|
|
module preserves the CLI entry point and re-exports the internal
|
|
helpers so existing tests and imports continue to work.
|
|
|
|
Usage::
|
|
|
|
python -m devx.tools.check_ansible_no_log
|
|
python -m devx.tools.check_ansible_no_log --path ansible/roles/my_role
|
|
python -m devx.tools.check_ansible_no_log --ansible-dir ansible/roles
|
|
|
|
Exit code 0 if all secret-handling tasks have no_log, 1 otherwise.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
import click
|
|
|
|
from devx.tools.ansible_checks.no_log import (
|
|
NON_VALUE_KEYS, # noqa: F401
|
|
SECRET_PATTERNS, # noqa: F401 — re-exported for backward compat
|
|
TASK_VALUE_KEYS, # noqa: F401
|
|
_check_task, # noqa: F401
|
|
_contains_secret, # noqa: F401
|
|
_has_no_log, # noqa: F401
|
|
check_directory, # noqa: F401
|
|
check_no_log, # noqa: F401
|
|
)
|
|
|
|
REPO_ROOT = Path.cwd()
|
|
DEFAULT_ANSIBLE_DIR = REPO_ROOT / "ansible"
|
|
|
|
|
|
@click.command()
|
|
@click.option(
|
|
"--path",
|
|
type=click.Path(exists=True, path_type=Path),
|
|
help="Check a specific file or directory (default: ansible/).",
|
|
)
|
|
@click.option(
|
|
"--ansible-dir",
|
|
type=click.Path(exists=True, path_type=Path),
|
|
default=None,
|
|
help="Override the default ansible directory (default: ansible/).",
|
|
)
|
|
def main(path: Path | None, ansible_dir: Path | None) -> None:
|
|
"""Check that Ansible tasks handling secrets have no_log set."""
|
|
target = path or ansible_dir or DEFAULT_ANSIBLE_DIR
|
|
if not target.is_dir():
|
|
click.echo(f"Error: {target} is not a directory", err=True)
|
|
sys.exit(2)
|
|
|
|
violations = check_no_log(target)
|
|
|
|
if violations:
|
|
click.echo(f"Found {len(violations)} task(s) handling secrets without no_log:\n")
|
|
for v in violations:
|
|
click.echo(f" {v}")
|
|
click.echo(f"\nTotal: {len(violations)} violation(s).")
|
|
sys.exit(1)
|
|
|
|
click.echo(f"[check-ansible-no-log] All secret-handling tasks have no_log. ({target})")
|
|
|
|
|
|
if __name__ == "__main__": # pragma: no cover
|
|
main()
|