Add test coverage for GitHub Actions YAML 1.2 anchor support #362
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Add comprehensive unit tests for YAML 1.2 anchors in GitHub Actions workflows - Add test fixtures demonstrating anchor usage: - anchors_env.yml: environment variable reuse - anchors_job.yml: complete job configuration reuse - anchors_multiple.yml: multiple anchor references - Update scanner tests to verify anchor workflows are parsed correctly - Update inventory tests to include new dependencies from anchor fixtures Tests confirm gopkg.in/yaml.v3 already supports YAML anchors. Next step: migrate to goccy/go-yaml for better YAML 1.2 compliance and active maintenance.
fproulx-boostsecurity
changed the title
Talgarr
reviewed
Oct 24, 2025
Collaborator
Talgarr
left a comment
Talgarr
left a comment
There was a problem hiding this comment.
I would add a workflow to test-data with anchors as a sanity check that it doesn't break the detection rules.
…etection rules - Fix unit tests to actually verify anchors are used and values are inherited - "simple anchor and alias" test now verifies both jobs parse correctly - "anchor for steps configuration" test now uses the anchor in second job - "anchor for env variables" test now verifies both jobs' env vars - "complex nested anchor" test now verifies permissions inheritance/override - Add integration test to ensure detection rules work with YAML anchors - Created anchors_with_vulnerability.yml with intentional injection flaw - Verified rules detect vulnerabilities in both anchor definition and usage - Added expected findings to TestFindings for the new test fixture All PR feedback from Talgarr has been addressed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>
SUSTAPLE117
approved these changes
Oct 27, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Overview
Add comprehensive test coverage to validate that poutine correctly parses GitHub Actions workflows using YAML 1.2 anchors, a feature announced by GitHub in September 2025.
Changes
Test Fixtures
Added three workflow files demonstrating common anchor usage patterns:
anchors_env.yml: Environment variable reuse across jobsanchors_job.yml: Complete job configuration reuseanchors_multiple.yml: Multiple anchor references in a single workflowUnit Tests
TestGithubActionsWorkflowWithAnchors: 7 sub-tests validating anchor parsing in models layerTestGithubWorkflowsWithAnchors: Integration test validating end-to-end workflow scanningTestGithubWorkflowsandTestPurlsto include new fixturesKey Finding
Testing confirms that
gopkg.in/yaml.v3already supports YAML anchors without any code changes. All anchor patterns parse correctly and workflow analysis works as expected.Future Consideration
While the current parser (
gopkg.in/yaml.v3) works well, it is deprecated and no longer maintained. A future PR may consider migrating togithub.com/goccy/go-yamlfor:However, this migration is not urgent since the current implementation already handles the anchor feature correctly.
Testing
Coverage maintained: models (82.1%), scanner (74.0%)
References