Compare commits

...

12 Commits

Author SHA1 Message Date
Hugo P.Brito
6a34ba051c test: rename timeline models test to avoid import clash
- Rename the timeline lib test module to keep pytest collection stable
- Avoid basename collisions after removing test package init files
2026-04-07 09:48:39 +01:00
Hugo P.Brito
e7b915d6d3 merge: sync test init cleanup branch with master
- Keep the test init guard workflow in this PR
- Drop unrelated Entra and M365 noise from the diff
- Allow the checks_folder fixtures in the guard script and tests
2026-04-06 15:34:28 +01:00
Hugo P.Brito
167bcca67d chore: remove __init__.py from test directories
- delete test package markers across the repository
- add a guard script and PR workflow to block regressions
- preserve custom check folder fixtures with neutral placeholder files
2026-04-06 13:46:00 +01:00
Hugo P.Brito
0debfba4e8 Revert "fix(m365): ignore policies without insider risk conditions"
This reverts commit e5fd366ea9.
2026-03-27 12:33:53 +00:00
Hugo P.Brito
e5fd366ea9 fix(m365): ignore policies without insider risk conditions 2026-03-27 12:32:07 +00:00
Hugo P.Brito
d218e87209 fix(m365): align insider risk status messages with O365 check 2026-03-27 12:26:10 +00:00
Hugo P.Brito
58d2ba81c4 refactor(m365): restore original insider risk check name 2026-03-27 12:18:41 +00:00
Hugo P.Brito
f55839797c fix(m365): set ResourceType to NotDefined 2026-03-27 12:15:00 +00:00
Hugo P.Brito
a40b6dd51b merge: resolve conflicts with master 2026-03-27 11:31:44 +00:00
Hugo P.Brito
a6cba5af58 refactor(m365): rename insider risk check to Purview variant 2026-03-27 10:31:30 +00:00
Hugo P.Brito
c71abf0c59 merge: resolve conflicts with master 2026-03-27 10:29:23 +00:00
HugoPBrito
dccfcf2848 feat(m365): add entra_conditional_access_policy_block_elevated_insider_risk security check
Add new security check entra_conditional_access_policy_block_elevated_insider_risk for m365 provider.
Includes check implementation, metadata, and unit tests.
2026-03-03 13:05:00 +01:00
163 changed files with 163 additions and 1 deletions

View File

@@ -0,0 +1,33 @@
name: 'Tools: Check Test Init Files'
on:
pull_request:
branches:
- 'master'
- 'v5.*'
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
check-test-init-files:
if: github.repository == 'prowler-cloud/prowler'
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
contents: read
steps:
- name: Harden the runner (Audit all outbound calls)
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- name: Check for __init__.py files in test directories
run: python3 scripts/check_test_init_files.py .

View File

View File

@@ -0,0 +1,62 @@
#!/usr/bin/env python3
"""Fail when __init__.py files are present inside test directories."""
from __future__ import annotations
import sys
from argparse import ArgumentParser
from pathlib import Path
EXCLUDED_TEST_INIT_ROOTS = {
Path("tests/lib/check/fixtures/checks_folder"),
}
def is_test_init_file(path: Path) -> bool:
"""Return True when the file is a test __init__.py."""
return path.name == "__init__.py" and "tests" in path.parts
def is_excluded_test_init_file(path: Path, root: Path) -> bool:
"""Return True when the file belongs to an allowed fixture directory."""
relative_path = path.relative_to(root)
return any(
relative_path.is_relative_to(excluded) for excluded in EXCLUDED_TEST_INIT_ROOTS
)
def find_test_init_files(root: Path) -> list[Path]:
"""Return sorted __init__.py files found under test directories."""
return sorted(
path
for path in root.rglob("__init__.py")
if is_test_init_file(path) and not is_excluded_test_init_file(path, root)
)
def main(argv: list[str] | None = None) -> int:
parser = ArgumentParser(description=__doc__)
parser.add_argument(
"root",
nargs="?",
default=".",
help="Repository root to scan. Defaults to the current directory.",
)
args = parser.parse_args(argv)
root = Path(args.root).resolve()
matches = find_test_init_files(root)
if not matches:
print("No __init__.py files found in test directories.")
return 0
print("Remove __init__.py files from test directories:")
for path in matches:
print(path.relative_to(root))
return 1
if __name__ == "__main__":
sys.exit(main())

View File

View File

@@ -0,0 +1,68 @@
from importlib.util import module_from_spec, spec_from_file_location
from pathlib import Path
SCRIPT_PATH = (
Path(__file__).resolve().parents[2] / "scripts" / "check_test_init_files.py"
)
def load_guard_module():
spec = spec_from_file_location("check_test_init_files", SCRIPT_PATH)
assert spec is not None
assert spec.loader is not None
module = module_from_spec(spec)
spec.loader.exec_module(module)
return module
def test_find_test_init_files_detects_only_test_directories(tmp_path):
guard = load_guard_module()
(tmp_path / "tests" / "providers" / "aws").mkdir(parents=True)
(tmp_path / "tests" / "providers" / "aws" / "__init__.py").write_text("")
(tmp_path / "api" / "tests" / "performance").mkdir(parents=True)
(tmp_path / "api" / "tests" / "performance" / "__init__.py").write_text("")
(tmp_path / "prowler" / "providers" / "aws").mkdir(parents=True)
(tmp_path / "prowler" / "providers" / "aws" / "__init__.py").write_text("")
(
tmp_path / "tests" / "lib" / "check" / "fixtures" / "checks_folder" / "check11"
).mkdir(parents=True)
(
tmp_path
/ "tests"
/ "lib"
/ "check"
/ "fixtures"
/ "checks_folder"
/ "check11"
/ "__init__.py"
).write_text("")
matches = guard.find_test_init_files(tmp_path)
assert [path.relative_to(tmp_path) for path in matches] == [
Path("api/tests/performance/__init__.py"),
Path("tests/providers/aws/__init__.py"),
]
def test_main_returns_error_when_test_init_files_exist(tmp_path, capsys):
guard = load_guard_module()
(tmp_path / "tests" / "config").mkdir(parents=True)
(tmp_path / "tests" / "config" / "__init__.py").write_text("")
assert guard.main([str(tmp_path)]) == 1
captured = capsys.readouterr()
assert "Remove __init__.py files from test directories" in captured.out
assert "tests/config/__init__.py" in captured.out
def test_repository_has_no_test_init_files():
guard = load_guard_module()
repo_root = Path(__file__).resolve().parents[2]
assert guard.find_test_init_files(repo_root) == []

View File

@@ -1 +0,0 @@
# OCI Provider Tests

Some files were not shown because too many files have changed in this diff Show More