feat: add sarif suppressions

.changeset/calm-houses-kiss.md

@@ -0,0 +1,6 @@
+---
+"@monokle/components": minor
+"@monokle/validation": minor
+---
+
+Add SARIF baseline comparison and in source suppressions

packages/components/src/molecules/ValidationOverview/ProblemRenderer.tsx

@@ -3,7 +3,7 @@ import styled from 'styled-components';
 import {Tag, Tooltip} from 'antd';
 import {Colors} from '@/styles/Colors';
 import {ProblemNode, GroupByFilterOptionType} from './types';
-import {getFileLocation, RuleMetadata, ValidationResult} from '@monokle/validation';
+import {getFileLocation, isSuppressed, RuleMetadata, ValidationResult} from '@monokle/validation';
 import {isProblemSelected, renderSeverityIcon, uppercaseFirstLetter} from './utils';
 import {TOOLTIP_DELAY} from '@/constants';
 import {Icon, ProblemIcon, TextEllipsis} from '@/atoms';
@@ -25,6 +25,7 @@ const ProblemRenderer: React.FC<IProps> = props => {
     () => (selectedProblem ? isProblemSelected(selectedProblem, node.problem, groupByFilterValue) : false),
     [selectedProblem, node.problem, groupByFilterValue]
   );
+  const suppressed = isSuppressed(node.problem);
 
   return (
     <Row $isSelected={isSelected} $secondary={groupByFilterValue === 'group-by-rule'} onClick={onClick}>
@@ -70,7 +71,7 @@ const ProblemRenderer: React.FC<IProps> = props => {
 
           <ProblemIcon level={node.problem.level ?? 'error'} style={{fontSize: '8px', marginRight: '-8px'}} />
 
-          <ProblemText>{node.problem.message.text}</ProblemText>
+          <ProblemText $isSuppressed={suppressed}>{node.problem.message.text}</ProblemText>
 
           {node.problem.taxa?.length ? (
             <TagsContainer>
@@ -104,7 +105,9 @@ const ProblemStartLine = styled.div<{$isSelected: boolean}>`
   font-size: 13px;
 `;
 
-const ProblemText = styled.div`
+const ProblemText = styled.div<{$isSuppressed: boolean}>`
+  color: ${({$isSuppressed}) => ($isSuppressed ? Colors.grey6 : Colors.grey8)};
+  text-decoration: ${({$isSuppressed}) => ($isSuppressed ? 'line-through' : 'none')};
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;

packages/components/src/molecules/ValidationOverview/ValidationOverview.stories.args.tsx

@@ -60,6 +60,9 @@ export const MainValidationOverviewArgs: ValidationOverviewType = {
     version: '2.1.0',
     runs: [
       {
+        automationDetails: {
+          guid: '123',
+        },
         tool: {
           driver: {
             name: 'monokle',
@@ -1097,6 +1100,12 @@ export const MainValidationOverviewArgs: ValidationOverviewType = {
                 name: 'kubernetes-schema',
               },
             },
+            suppressions: [
+              {
+                kind: 'inSource',
+                status: 'accepted',
+              },
+            ],
             level: 'warning',
             message: {
               text: 'Value at /spec/ports/0/port should be integer',

packages/components/src/molecules/ValidationOverview/ValidationOverviewFilters.tsx

@@ -1,5 +1,5 @@
 import {Filter, FilterButton, FilterField, ProblemIcon} from '@/atoms';
-import {Badge, Select} from 'antd';
+import {Badge, Select, Space, Switch} from 'antd';
 import {useMemo, useState} from 'react';
 import styled from 'styled-components';
 import {DEFAULT_FILTERS_VALUE} from './constants';
@@ -43,6 +43,17 @@ const ValidationOverviewFilters: React.FC<ValidationOverviewFiltersType> = props
       }
       onToggle={() => setActive(!active)}
     >
+      <FilterField name="Suppressions">
+        <Space>
+          <Switch
+            checked={filtersValue['showSuppressed']}
+            size="small"
+            onChange={value => onFiltersChange({showSuppressed: Boolean(value)})}
+          />
+          <div>Show suppressed problems</div>
+        </Space>
+      </FilterField>
+
       <FilterField name="Tool component">
         <Select
           mode="multiple"
@@ -83,7 +94,6 @@ const ValidationOverviewFilters: React.FC<ValidationOverviewFiltersType> = props
 };
 
 // Styled Components
-
 const CountBadge = styled(Badge)`
   .ant-badge-count-sm {
     font-size: 8px;

packages/components/src/molecules/ValidationOverview/constants.tsx

@@ -1,7 +1,12 @@
 import {Icon} from '@/atoms';
 import {Colors} from '@/styles/Colors';
+import {ValidationFiltersValueType} from './types';
 
-export const DEFAULT_FILTERS_VALUE = {'tool-component': undefined, type: undefined};
+export const DEFAULT_FILTERS_VALUE: ValidationFiltersValueType = {
+  showSuppressed: true,
+  'tool-component': undefined,
+  type: undefined,
+};
 
 export const iconMap: Record<string, JSX.Element> = {
   'kubernetes-schema': <Icon name="validation-k8s-schema" style={{fontSize: '13px', color: Colors.grey8}} />,

packages/components/src/molecules/ValidationOverview/types.ts

@@ -34,6 +34,7 @@ export type ValidationOverviewFiltersType = {
 export type ValidationFiltersValueType = {
   'tool-component'?: string[];
   type?: 'error' | 'warning';
+  showSuppressed?: boolean;
 };
 
 export type ProblemsType = {

packages/components/src/molecules/ValidationOverview/utils.tsx

@@ -9,6 +9,7 @@ import {
   ValidationResult,
 } from '@monokle/validation';
 import {ProblemsType, GroupByFilterOptionType, ValidationFiltersValueType, ValidationListNode} from './types';
+import {isSuppressed} from '@monokle/validation';
 
 export const selectProblemsByRule = (
   validationResponse: ValidationResponse,
@@ -103,19 +104,23 @@ export const filterProblems = (
   filters: ValidationFiltersValueType,
   securityFrameworkFilter: string
 ) => {
+  const suppressionFilter = filters.showSuppressed ? () => true : (problem: ValidationResult) => !isSuppressed(problem);
+
   return Object.fromEntries(
     Object.entries(problems || {})
       .map(([filePath, validationResults]) => {
-        let filteredValidationResults = validationResults.filter(
-          el =>
-            (filters['type'] ? el.level === filters['type'] : true) &&
-            (filters['tool-component']?.length
-              ? filters['tool-component'].includes(el.rule.toolComponent.name)
-              : true) &&
-            (securityFrameworkFilter !== 'all'
-              ? el.taxa?.find(t => t.toolComponent.name === securityFrameworkFilter)
-              : true)
-        );
+        let filteredValidationResults = validationResults
+          .filter(suppressionFilter)
+          .filter(
+            el =>
+              (filters['type'] ? el.level === filters['type'] : true) &&
+              (filters['tool-component']?.length
+                ? filters['tool-component'].includes(el.rule.toolComponent.name)
+                : true) &&
+              (securityFrameworkFilter !== 'all'
+                ? el.taxa?.find(t => t.toolComponent.name === securityFrameworkFilter)
+                : true)
+          );
 
         if (filteredValidationResults.length > 0) {
           return [filePath, filteredValidationResults];

packages/validation/src/MonokleValidator.ts

@@ -3,7 +3,7 @@ import difference from 'lodash/difference.js';
 import uniqueId from 'lodash/uniqueId.js';
 import isEqual from 'react-fast-compare';
 import {ResourceParser} from './common/resourceParser.js';
-import type {BaseLineState, Tool, ValidationResponse, ValidationResult, ValidationRun} from './common/sarif.js';
+import type {Tool, ValidationResponse, ValidationResult, ValidationRun} from './common/sarif.js';
 import type {CustomSchema, Incremental, Plugin, Resource} from './common/types.js';
 import {Config, PluginMap} from './config/parse.js';
 import {CIS_TAXONOMY} from './taxonomies/cis.js';
@@ -14,24 +14,28 @@ import {extractSchema, findDefaultVersion} from './utils/customResourceDefinitio
 import {PluginLoadError} from './utils/error.js';
 import invariant from './utils/invariant.js';
 import {isDefined} from './utils/isDefined.js';
+import {AnnotationSuppressor, Suppressor} from './sarif/suppressions/index.js';
+import {SuppressEngine} from './sarif/suppressions/engine.js';
 
 export type PluginLoader = (name: string, settings?: Record<string, any>) => Promise<Plugin>;
-export type CustomPluginLoader = (name: string, parser: ResourceParser) => Promise<Plugin>;
+export type CustomPluginLoader = (name: string, parser: ResourceParser, suppressor?: Suppressor) => Promise<Plugin>;
 
-export function createMonokleValidator(loader: PluginLoader, fallback?: PluginMap) {
-  return new MonokleValidator(loader, fallback);
+export function createMonokleValidator(loader: PluginLoader, suppressors?: Suppressor[], fallback?: PluginMap) {
+  return new MonokleValidator(loader, suppressors, fallback);
 }
 
 /**
  * The plugins that will be loaded by default.
  */
 const DEFAULT_PLUGIN_MAP = {
-  'open-policy-agent': true,
-  'resource-links': true,
-  'yaml-syntax': true,
   'kubernetes-schema': true,
+  'yaml-syntax': true,
+  'pod-security-standards': true,
+  'resource-links': true,
 };
 
+const DEFAULT_SUPPRESSORS = [new AnnotationSuppressor()];
+
 type ValidateParams = {
   /**
    * The resources that will be validated.
@@ -83,9 +87,15 @@ export class MonokleValidator implements Validator {
   _plugins: Plugin[] = [];
   _failedPlugins: string[] = [];
   _customSchemas: Set<string> = new Set();
+  private _suppressor: SuppressEngine;
 
-  constructor(loader: PluginLoader, fallback: PluginMap = DEFAULT_PLUGIN_MAP) {
+  constructor(
+    loader: PluginLoader,
+    suppressors: Suppressor[] = DEFAULT_SUPPRESSORS,
+    fallback: PluginMap = DEFAULT_PLUGIN_MAP
+  ) {
     this._loader = loader;
+    this._suppressor = new SuppressEngine(suppressors);
     this._fallback = {plugins: fallback};
     this._config = this._fallback;
   }
@@ -291,7 +301,9 @@ export class MonokleValidator implements Validator {
 
     this.preprocessCustomResourceDefinitions(resources);
 
-    const allRuns = await Promise.allSettled(validators.map(v => v.validate(resources, incremental)));
+    new SuppressEngine().preload();
+
+    const allRuns = await Promise.allSettled(validators.map(v => v.validate(resources, {incremental})));
     throwIfAborted(loadAbortSignal, externalAbortSignal);
 
     const results = allRuns
@@ -321,6 +333,11 @@ export class MonokleValidator implements Validator {
       this.compareWithBaseline(result, baseline);
     }
 
+    await this._suppressor.suppress(result, resources, {
+      noInSourceSuppressions: this._config?.settings?.noInSourceSuppressions,
+      noExternalSuppressions: this._config?.settings?.noExternalSuppressions,
+    });
+
     return result;
   }
 

packages/validation/src/__tests__/sarif/fingerprint.test.ts

@@ -18,7 +18,7 @@ it('should have fingerprints & baseline', async () => {
     },
   });
 
-  const files = await readDirectory('./src/__tests__/sarif/assets');
+  const files = await readDirectory('./src/__tests__/resources/basic-deployment');
   const resourceBad = extractK8sResources(files);
   const badResponse = await validator.validate({resources: resourceBad});
 
@@ -44,12 +44,6 @@ it('should have fingerprints & baseline', async () => {
     baseline: badResponse,
   });
 
-  editedResponse.runs.forEach(r =>
-    r.results.forEach(result => {
-      console.error(result.ruleId, result.fingerprints?.['monokleHash/v1']);
-    })
-  );
-
   const run = editedResponse.runs[0];
   expect(run.baselineGuid).toBeDefined();
   const unchangedCount = run.results.reduce((sum, r) => sum + (r.baselineState === 'unchanged' ? 1 : 0), 0);

packages/validation/src/__tests__/sarif/suppression.test.ts

@@ -0,0 +1,83 @@
+import 'isomorphic-fetch';
+import {expect, it} from 'vitest';
+import {createDefaultMonokleValidator} from '../../index.js';
+
+import {PRACTICES_ALL_DISABLED, extractK8sResources, readDirectory} from '../testUtils.js';
+import {FakeSuppressor} from '../../sarif/suppressions/plugins/FakeSuppressor.js';
+import YAML from 'yaml';
+import {set} from 'lodash';
+
+it('supports suppress requests', async () => {
+  const suppressor = new FakeSuppressor();
+  const validator = createDefaultMonokleValidator(undefined, undefined, [suppressor]);
+
+  await validator.preload({
+    plugins: {
+      practices: true,
+    },
+    rules: {
+      ...PRACTICES_ALL_DISABLED,
+      'practices/no-latest-image': 'err',
+    },
+  });
+
+  // Given a problem
+  const files = await readDirectory('./src/__tests__/resources/basic-deployment');
+  const badResponse = await validator.validate({
+    resources: extractK8sResources(files),
+  });
+  const problemCount = badResponse.runs[0].results.length;
+  expect(problemCount).toBe(1);
+
+  // When it is suppressed
+  suppressor.addSuppressionRequest(badResponse.runs[0].results[0]);
+
+  // Then the next validate response will mark the suppress request
+  const editedResponse = await validator.validate({
+    resources: extractK8sResources(files),
+  });
+
+  editedResponse.runs.forEach(r =>
+    r.results.forEach(result => {
+      console.error(result.ruleId, result.suppressions);
+    })
+  );
+
+  const problem = editedResponse.runs[0].results[0];
+  expect(problem.suppressions?.length).toBe(1);
+});
+
+it('in-line annotation suppressions by default', async () => {
+  const validator = createDefaultMonokleValidator();
+
+  await validator.preload({
+    plugins: {
+      practices: true,
+    },
+    rules: {
+      ...PRACTICES_ALL_DISABLED,
+      'practices/no-latest-image': 'err',
+    },
+  });
+
+  // Given a problem
+  const files = await readDirectory('./src/__tests__/resources/basic-deployment');
+  const badResponse = await validator.validate({
+    resources: extractK8sResources(files),
+  });
+  const problemCount = badResponse.runs[0].results.length;
+  expect(problemCount).toBe(1);
+
+  // When an annotation is added
+  const content = YAML.parse(files[0].content);
+  set(content, 'metadata.annotations["monokle.io/suppress.kbp.no-latest-image"]', true);
+  files[0].content = YAML.stringify(content);
+
+  // Then the next validate response will mark the suppress request
+  const editedResponse = await validator.validate({
+    resources: extractK8sResources(files),
+  });
+
+  const problem = editedResponse.runs[0].results[0];
+  expect(problem.suppressions?.length).toBe(1);
+});