feat: extend static analysis and compute confidence scores for deploy commands

[behnazh-w]

This PR extends and makes changes to the static analysis of CI configurations in Macaron with the high-level goal of finding build and deploy commands more accurately. To achieve that, some of the abstractions had to be replaced to allow writing customized analyses, such as detecting build language setup in a GitHub Actions workflow or detecting reachable secrets. The list of extensions and changes are as follows:

• Replaces BashCommands which consisted of build tool commands collected after analyzing GitHub Actions and passed to checks with BuildToolCommand. With this PR BuildToolCommand are created by each build tool instead, and can be detected by calling a build tool API as part of the check. This delegation of analysis to each build tool allows to customize them per build tool. Moreover, now each build tool has direct access to the parsed AST of GitHub Actions and bash scripts, which opens opportunities to add new analyses more easily.
• The build related checks are refactored and simplified to use BuildToolCommand.
• The callgraph analysis, which needs to be implemented for each CI service, is extended with new node types for GitHub Actions. The callgraph plays the role of Intermediate Representation and is available to all checks.
• The mcn_build_script_1 check does not depend on any checks and always runs by default based on a customer request.
• The mcn_build_as_code_1 check now reports deploy commands with confidence scores. The confidence scores are computed based on additional facts collected from GitHub Actions, such as the CI event, reachable secrets, and name of the workflows.
• New analysis is added to resolve the value of expression variables, which is used for other analysis, such as reachable secrets and build language detection.
• New abstractions are added to model third-party GitHub Actions. This feature is used to collect data about build Language setup.
• Fixes this parsing issue: Error when parsing the bash script in reactor/reactor-core's GitHub Action workflow #107
• Changes the check result log level to debug mode.

[tromai]

I think I have put down all of my questions for now. Thanks for the changes!

[behnazh-w]

This commit 071e99a adds node_id as an optional attribute of all callgraph nodes, makes the build tool detection deterministic by always sorting it based on the object string representation, and improves the store_inferred_provenance function.

[tromai]

This commit adds node_id as an optional attribute of all callgraph nodes, makes the build tool detection deterministic by always sorting it based on the object string representation, and improves the store_inferred_provenance function.

@behnazh-w I think the commit is not available anymore (I got 404 when I clicked on the link).

[behnazh-w]

This commit adds node_id as an optional attribute of all callgraph nodes, makes the build tool detection deterministic by always sorting it based on the object string representation, and improves the store_inferred_provenance function.

@behnazh-w I think the commit is not available anymore (I got 404 when I clicked on the link).

Please check again.

[tromai]

I can access it again. Thanks @behnazh-w

[tromai]

LGTM. Thanks for the changes.