Snyk Code / Test / IAC scan will pass if valid files are not found. (#44

)

<!-- markdownlint-disable-file MD041 -->

## Pull request checklist

Please check if your PR fulfills the following requirements:

- [x] I have read the
[CONTRIBUTING](https://github.com/fabasoad/pre-commit-snyk/blob/main/CONTRIBUTING.md)
      doc.
- [ ] Tests for the changes have been added (for bug fixes / features).
- [ ] Docs have been reviewed and added / updated if needed (for bug
fixes / features).

## Pull request type

<!-- Please do not submit updates to dependencies unless it fixes an
issue. -->

<!-- Please try to limit your pull request to one type, submit multiple
pull
requests if needed. -->

Please check the type of change your PR introduces:

- [ ] Bugfix
- [ ] Feature
- [ ] Code style update (formatting, renaming)
- [ ] Refactoring (no functional changes, no api changes)
- [ ] Build related changes
- [ ] Documentation content changes
- [x] Other (please describe):

Modified the IAC, Code & Test hooks to pass if a valid file is not
found.
Hooks to capture the exit codes and pass if either exit code 2 or 3 is
given, echoing the error.

**Snyk CLI Exit codes**
Possible exit codes and their meaning:
0: success (scan completed), no vulnerabilities found
1: action_needed (scan completed), vulnerabilities found
2: failure, try to re-run the command. Use -d to output the debug logs.
3: failure, no supported projects detected

## What is the current behavior

<!-- Please describe the current behavior that you are modifying, or
link to a
relevant issue. -->

Currently, if a valid file is not found then the test fails which stops
the commit. Ideally, this should pass as no vulnerability has been
detected, the valid file is simply not present.

Currently the only way around this is to remove the relevant test from
the .pre-commit-config.yaml to pass.

## What is the new behavior

<!-- Please describe the behavior or changes that are being added by
this PR. -->

- Code / Test / IAC tests pass if valid file is not found.
- Hooks to capture the exit code and pass if either exit code 2 or 3 is
given, echoing the error.
- Commit no longer fails if valid file is not present.

## Does this introduce a breaking change

- [ ] Yes
- [x] No

<!-- If this introduces a breaking change, please describe the impact
and
migration path for existing applications below. -->

## Other information

<!-- Any other information that is important to this PR such as
screenshots of
how the component looks before and after the change. -->
<!-- This document was adapted from the open-source
[appium/appium](https://github.com/appium/appium/blob/master/.github/PULL_REQUEST_TEMPLATE.md)
repository. -->

---

Closes #{IssueNumber}

.pre-commit-hooks.yaml

@@ -14,24 +14,28 @@
   entry: hooks/snyk-iac.sh
   language: script
   pass_filenames: false
+  verbose: true
 
 - id: snyk-test
   name: Snyk Test
   description: Runs 'snyk test' command
   entry: hooks/snyk-test.sh
   language: script
   pass_filenames: false
+  verbose: true
 
 - id: snyk-code
   name: Snyk Code
   description: Runs 'snyk code test' command
   entry: hooks/snyk-code.sh
   language: script
   pass_filenames: false
+  verbose: true
 
 - id: snyk-log4shell
   name: Snyk log4shell
   description: Runs 'snyk log4shell' command
   entry: hooks/snyk-log4shell.sh
   language: script
   pass_filenames: false
+  verbose: true

hooks/snyk-code.sh

@@ -1,10 +1,21 @@
 #!/usr/bin/env sh
-set -eu
+set -u
 
 SCRIPT_PATH=$(realpath "$0")
 HOOKS_FOLDER_PATH=$(dirname "${SCRIPT_PATH}")
 INSTALLATION_FOLDER_PATH="${HOOKS_FOLDER_PATH}/installation"
 
 sh "${INSTALLATION_FOLDER_PATH}/main.sh"
 
+# Capture exit code of Snyk Test hook
+set +e
 snyk code test "$@"
+snyk_exit_code=$?
+set -e
+
+# Check if the exit code is 3
+if [ "$snyk_exit_code" = 3 ]; then
+  exit 0
+fi
+
+exit "$snyk_exit_code"

hooks/snyk-iac.sh

@@ -1,10 +1,21 @@
 #!/usr/bin/env sh
-set -eu
+set -u
 
 SCRIPT_PATH=$(realpath "$0")
 HOOKS_FOLDER_PATH=$(dirname "${SCRIPT_PATH}")
 INSTALLATION_FOLDER_PATH="${HOOKS_FOLDER_PATH}/installation"
 
 sh "${INSTALLATION_FOLDER_PATH}/main.sh"
 
+# Capture exit code of Snyk Test hook
+set +e
 snyk iac test "$@"
+snyk_exit_code=$?
+set -e
+
+# Check if the exit code is 3
+if [ "$snyk_exit_code" = 3 ]; then
+  exit 0
+fi
+
+exit "$snyk_exit_code"

hooks/snyk-log4shell.sh

@@ -1,10 +1,21 @@
 #!/usr/bin/env sh
-set -eu
+set -u
 
 SCRIPT_PATH=$(realpath "$0")
 HOOKS_FOLDER_PATH=$(dirname "${SCRIPT_PATH}")
 INSTALLATION_FOLDER_PATH="${HOOKS_FOLDER_PATH}/installation"
 
 sh "${INSTALLATION_FOLDER_PATH}/main.sh"
 
+# Capture exit code of Snyk Test hook
+set +e
 snyk log4shell "$@"
+snyk_exit_code=$?
+set -e
+
+# Check if the exit code is 3
+if [ "$snyk_exit_code" = 3 ]; then
+  exit 0
+fi
+
+exit "$snyk_exit_code"

hooks/snyk-test.sh

@@ -1,10 +1,21 @@
 #!/usr/bin/env sh
-set -eu
+set -u
 
 SCRIPT_PATH=$(realpath "$0")
 HOOKS_FOLDER_PATH=$(dirname "${SCRIPT_PATH}")
 INSTALLATION_FOLDER_PATH="${HOOKS_FOLDER_PATH}/installation"
 
 sh "${INSTALLATION_FOLDER_PATH}/main.sh"
 
+# Capture exit code of Snyk Test hook
+set +e
 snyk test "$@"
+snyk_exit_code=$?
+set -e
+
+# Check if the exit code is 3
+if [ "$snyk_exit_code" = 3 ]; then
+  exit 0
+fi
+
+exit "$snyk_exit_code"