chore: improve token support in run_macaron.sh (#780)

Signed-off-by: Trong Nhan Mai <[email protected]>

Author: Trong Nhan Mai

.gitignore

@@ -179,3 +179,4 @@ tests/slsa_analyzer/ci_service/mock_repos/**
 docs/_build
 bin/
 requirements.txt
+.macaron_env_file

scripts/dev_scripts/integration_tests.sh

@@ -398,6 +398,7 @@ run_macaron_clean $ANALYZE -purl pkg:maven/io.github.behnazh-w.demo/example-mave
 check_or_update_expected_output $COMPARE_DEPS $DEP_RESULT $DEP_EXPECTED || log_fail
 
 python ./tests/integration/run.py run \
+    --exclude-tag docker-only \
     ./tests/integration/cases/... || log_fail
 
 # Important: This should be at the end of the file

scripts/dev_scripts/integration_tests_docker.sh

@@ -60,7 +60,7 @@ rm -rf "$VIRTUAL_ENV_PATH"
 
 python ./tests/integration/run.py run \
     --macaron scripts/release_scripts/run_macaron.sh \
-    --include-tag docker \
+    --include-tag shared-docker-python \
     ./tests/integration/cases/... || log_fail
 
 if [ $RESULT_CODE -ne 0 ];

scripts/release_scripts/run_macaron.sh

@@ -259,16 +259,17 @@ function mount_file() {
     mounts+=("-v" "${file_on_host}:${file_in_container}:${mount_option}")
 }
 
-# Handle tokens.
-set +u
-echo "" > ${TOKEN_FILE}
-{
-    echo "GITHUB_TOKEN=${GITHUB_TOKEN}" >> ${TOKEN_FILE}
-    echo "MCN_GITLAB_TOKEN=${MCN_GITLAB_TOKEN}" >> ${TOKEN_FILE}
-    echo "MCN_SELF_HOSTED_GITLAB_TOKEN=${MCN_SELF_HOSTED_GITLAB_TOKEN}"
-} >> ${TOKEN_FILE}
-mount_file "macaron_env_file" ${TOKEN_FILE} ${MACARON_WORKSPACE}/${TOKEN_FILE} "rw,Z"
-set -u
+# Clean up the token file and EXIT this bash script with the given status code.
+#
+# Arguments:
+#   $1: The eventual exit status code.
+#   $2: The path to the token file.
+function clean_up_exit() {
+    status_code=$1
+    token_file_path=$2
+    rm -f "$token_file_path"
+    exit "$status_code"
+}
 
 # Parse main arguments.
 while [[ $# -gt 0 ]]; do
@@ -598,6 +599,18 @@ else
     fi
 fi
 
+# Make sure commands that need to be cleaned up exist within `set +e` so that when any of them returns a non-zero
+# status code, we don't exit right away and still run the token file cleaning up command.
+set +e
+
+# Handle tokens.
+{
+    echo "GITHUB_TOKEN=${GITHUB_TOKEN}"
+    echo "MCN_GITLAB_TOKEN=${MCN_GITLAB_TOKEN}"
+    echo "MCN_SELF_HOSTED_GITLAB_TOKEN=${MCN_SELF_HOSTED_GITLAB_TOKEN}"
+} > ${TOKEN_FILE}
+mount_file "macaron_env_file" ${TOKEN_FILE} ${MACARON_WORKSPACE}/${TOKEN_FILE} "rw,Z"
+
 # Force docker to use linux/amd64 platform in order to make docker use emulation on ARM host platforms.
 docker run \
     --platform=linux/amd64 \
@@ -612,4 +625,4 @@ docker run \
     "${entrypoint[@]}" \
     "${macaron_args[@]}"
 
-rm -f "$TOKEN_FILE"
+clean_up_exit "$?" "$TOKEN_FILE"

tests/integration/cases/apache_maven_local_repo/test.yaml

@@ -5,7 +5,7 @@ description: |
   Analyzing with local paths using local_repos_dir without dependency resolution.
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Prepare local repo directory

tests/integration/cases/apache_maven_purl_repo_path/test.yaml

@@ -5,7 +5,7 @@ description: |
   Analyze with PURL, repository path, no dependency resolution.
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Run macaron analyze
@@ -21,6 +21,12 @@ steps:
     - -d
     - 3fc399318edef0d5ba593723a24fff64291d6f9b
     - --skip-deps
+# This to check if run_macaron.sh cleans up the token file after the test case runs for the docker image.
+- name: Check the token file doesn't exist.
+  kind: shell
+  options:
+    cmd: ls .macaron_env_file
+  expect_fail: true
 - name: Run macaron verify-policy to verify passed/failed checks
   kind: verify
   options:

tests/integration/cases/apache_maven_sbom/test.yaml

@@ -5,7 +5,7 @@ description: |
   Analyzing using a CycloneDx SBOM with target repo path
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Run macaron analyze

tests/integration/cases/apache_maven_yaml_input_skip_deps/test.yaml

@@ -5,7 +5,7 @@ description: |
   Check the e2e output JSON file with config and no dependency analyzing.
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Run macaron analyze

tests/integration/cases/apache_maven_yaml_input_with_dep_resolution/test.yaml

@@ -5,7 +5,7 @@ description: |
   Check the resolved dependency output with config for cyclonedx maven plugin
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Run macaron analyze

tests/integration/cases/behnazh-w_example-maven-app/test.yaml

@@ -6,7 +6,7 @@ description: |
   Policy CLI, and VSA generation.
 
 tags:
-- docker
+- shared-docker-python
 
 steps:
 - name: Clone the repository