Setting the file. One moment.
Scan Aspire Functions Secrets · Azure Validate · microsoft/azure-skills · Skills Docs
Back to the top of the page 28.8
Errors · azd
references/scripts/scan-aspire-functions-secrets.sh
references/scripts/ scan-aspire-functions-secrets.sh
Shell · 105 lines · 3 KB
#
16 # Examples:
17 # ./scan-aspire-functions-secrets.sh # Scan current directory
18 # ./scan-aspire-functions-secrets.sh ./src # Scan a specific directory
19 #
20 # Output: a single verdict — NOT APPLICABLE, ALREADY CONFIGURED, or FIX REQUIRED
21 # (with the matching file(s) and line(s)). Exit code is 0 for every verdict;
22 # a non-zero exit only indicates a usage/environment error.
23
24 set -euo pipefail
25
26 ROOT = " ${1 :- . } "
27
28 if [ ! -d " $ROOT " ]; then
29 echo "ERROR: ' $ROOT ' is not a directory." >&2
30 exit 2
31 fi
32
33 CALL = "AddAzureFunctionsProject"
34 SETTING = "AzureWebJobsSecretStorageType"
35
36 # file_contains <fixed-string> <file>
37 # Returns 0 if the file contains the literal string, 1 if not.
38 # A grep read error (exit code 2) is fatal: this is a critical pre-provision
39 # scan, so a file we cannot read must not be silently reported as "no match".
40 file_contains () {
41 local pattern = " $1 " file = " $2 " rc
42 if grep -Fq -- " $pattern " " $file " ; then
43 return 0
44 fi
45 rc = $?
46 if [ " $rc " -eq 2 ]; then
47 echo "ERROR: failed to read ' $file ' while scanning for ' $pattern '." >&2
48 exit 3
49 fi
50 return 1
51 }
52
53 # first_line <fixed-string> <file>
54 # Prints the 1-based line number of the first literal match (or nothing).
55 first_line () {
56 grep -Fn -- " $1 " " $2 " | head -n1 | cut -d: -f1
57 }
58
59 # Collect *.cs files that reference AddAzureFunctionsProject into an array.
60 # find ... -print0 + read -d '' keeps paths intact even if they contain
61 # newlines or spaces (genuinely NUL-safe, unlike a newline-joined string).
62 matches = ()
63 while IFS = read -r -d '' file ; do
64 if file_contains " $CALL " " $file " ; then
65 matches += ( " $file " )
66 fi
67 done < <( find " $ROOT " -type f -name "*.cs" -print0 )
68
69 if [ "${ # matches [ @ ]}" -eq 0 ]; then
70 echo "VERDICT: NOT APPLICABLE"
71 echo "No ' $CALL ' call found in any *.cs file under ' $ROOT '."
72 echo "The Functions secret-storage check does not apply — skip it."
73 exit 0
74 fi
75
76 # Partition matching files by whether they already configure the setting.
77 needs_fix = ()
78 configured = ()
79 for file in "${ matches [ @ ]}" ; do
80 if file_contains " $SETTING " " $file " ; then
81 configured += ( " $file " )
82 else
83 needs_fix += ( " $file " )
84 fi
85 done
86
87 if [ "${ # needs_fix [ @ ]}" -eq 0 ]; then
88 echo "VERDICT: ALREADY CONFIGURED"
89 echo "Every file that calls ' $CALL ' already sets ' $SETTING ':"
90 for file in "${ configured [ @ ]}" ; do
91 echo " - $file (line $( first_line " $SETTING " " $file "))"
92 done
93 echo "No change required."
94 exit 0
95 fi
96
97 echo "VERDICT: FIX REQUIRED"
98 echo "The following file(s) call ' $CALL ' but do NOT set ' $SETTING ':"
99 for file in "${ needs_fix [ @ ]}" ; do
100 echo " - $file (line $( first_line " $CALL " " $file "))"
101 done
102 echo ""
103 echo "Add .WithEnvironment( \" $SETTING \" , \" Files \" ) to the AddAzureFunctionsProject"
104 echo "builder chain in each file above BEFORE running 'azd provision'."
105 exit 0