From 559b35f60f9118e4aa2da08a2f20a2f3ff22bb53 Mon Sep 17 00:00:00 2001
From: "Andoni A." <14891798+andoniaf@users.noreply.github.com>
Date: Thu, 6 Nov 2025 18:20:55 +0100
Subject: [PATCH] fix(github_actions): resolve CodeQL warnings for return type
 mismatches

Fixed two CodeQL static analysis warnings:
1. _extract_workflow_file_from_location: Changed return type from str to str | None to match actual behavior where None is returned in error cases
2. _clone_repository: Added unreachable return statement after sys.exit(1) to satisfy static analysis requirements

All tests pass after these changes.
---
 .../github_actions/github_actions_provider.py | 20 ++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/prowler/providers/github_actions/github_actions_provider.py b/prowler/providers/github_actions/github_actions_provider.py
index 91f856f6a3..9662a7c941 100644
--- a/prowler/providers/github_actions/github_actions_provider.py
+++ b/prowler/providers/github_actions/github_actions_provider.py
@@ -126,7 +126,9 @@ class GithubActionsProvider(Provider):
         """GitHub Actions provider doesn't need a session since it uses zizmor directly"""
         return None
 
-    def _should_exclude_workflow(self, workflow_file: str, exclude_patterns: list[str]) -> bool:
+    def _should_exclude_workflow(
+        self, workflow_file: str, exclude_patterns: list[str]
+    ) -> bool:
         """
         Check if a workflow file should be excluded based on exclude patterns.
 
@@ -146,23 +148,28 @@ class GithubActionsProvider(Provider):
 
         # Get just the filename from the path
         from os.path import basename
+
         filename = basename(workflow_file)
 
         # Check if the pattern matches either the full path or just the filename
         for pattern in exclude_patterns:
             # Try matching against full path first
             if fnmatch(workflow_file, pattern):
-                logger.debug(f"Excluding workflow {workflow_file} (matches full path pattern: {pattern})")
+                logger.debug(
+                    f"Excluding workflow {workflow_file} (matches full path pattern: {pattern})"
+                )
                 return True
 
             # Also try matching against just the filename for convenience
             if fnmatch(filename, pattern):
-                logger.debug(f"Excluding workflow {workflow_file} (matches filename pattern: {pattern})")
+                logger.debug(
+                    f"Excluding workflow {workflow_file} (matches filename pattern: {pattern})"
+                )
                 return True
 
         return False
 
-    def _extract_workflow_file_from_location(self, location: dict) -> str:
+    def _extract_workflow_file_from_location(self, location: dict) -> str | None:
         """
         Extract the workflow file path from a location object.
         Supports zizmor v1.x+ JSON format.
@@ -355,6 +362,7 @@ class GithubActionsProvider(Provider):
                 f"{error.__class__.__name__}:{error.__traceback__.tb_lineno} -- {error}"
             )
             sys.exit(1)
+            return ""  # Unreachable, but satisfies static analysis
 
     def run(self) -> List[CheckReportGithubAction]:
         temp_dir = None
@@ -470,7 +478,9 @@ class GithubActionsProvider(Provider):
                         )
                         if workflow_file:
                             # Check if this workflow should be excluded
-                            if self._should_exclude_workflow(workflow_file, exclude_workflows):
+                            if self._should_exclude_workflow(
+                                workflow_file, exclude_workflows
+                            ):
                                 continue
 
                             report = self._process_zizmor_finding(