32 lines
858 B
Go
32 lines
858 B
Go
 
|
package linter
|
||
|
|
|
||
|
|
import (
|
||
|
|
"fmt"
|
||
|
|
"strings"
|
||
|
|
|
||
|
|
"git.k3nny.fr/glint/internal/model"
|
||
|
|
)
|
||
|
|
|
||
|
|
// checkInsecureRemoteInclude warns when an include: remote: entry uses plain
|
||
|
|
// HTTP (GL045). The file is still fetched and linted; the finding is a warning
|
||
|
|
// so pipelines that use HTTP for internal infra are not blocked.
|
||
|
|
func checkInsecureRemoteInclude(p *model.Pipeline) []Finding {
|
||
|
|
var findings []Finding
|
||
|
|
for _, inc := range p.Include {
|
||
|
|
m, ok := inc.(map[string]any)
|
||
|
|
if !ok {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
remote, _ := m["remote"].(string)
|
||
|
|
if strings.HasPrefix(remote, "http://") {
|
||
|
|
findings = append(findings, Finding{
|
||
|
|
Severity: Warning,
|
||
|
|
Rule: RuleInsecureRemoteInclude,
|
||
|
|
File: p.SourceFile,
|
||
|
|
Message: fmt.Sprintf("remote include %q uses plain HTTP; CI templates are fetched unencrypted — prefer HTTPS", remote),
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return findings
|
||
|
|
}
|