Get OSes from matrix.include if present (#1323)

checks/fileparser/github_workflow.go

@@ -87,6 +87,14 @@ func getJobStrategyMatrixRows(job *actionlint.Job) map[string]*actionlint.Matrix
 	return nil
 }
 
+func getJobStrategyMatrixIncludeCombinations(job *actionlint.Job) []*actionlint.MatrixCombination {
+	if job != nil && job.Strategy != nil && job.Strategy.Matrix != nil && job.Strategy.Matrix.Include != nil &&
+		job.Strategy.Matrix.Include.Combinations != nil {
+		return job.Strategy.Matrix.Include.Combinations
+	}
+	return nil
+}
+
 // FormatActionlintError combines the errors into a single one.
 func FormatActionlintError(errs []*actionlint.Error) error {
 	if len(errs) == 0 {
@@ -125,6 +133,19 @@ func GetOSesForJob(job *actionlint.Job) ([]string, error) {
 		}
 	}
 
+	matrixCombinations := getJobStrategyMatrixIncludeCombinations(job)
+	for _, combination := range matrixCombinations {
+		if combination.Assigns == nil {
+			continue
+		}
+		for _, assign := range combination.Assigns {
+			if assign.Key == nil || assign.Key.Value != os || assign.Value == nil {
+				continue
+			}
+			jobOSes = append(jobOSes, strings.Trim(assign.Value.String(), "'\""))
+		}
+	}
+
 	if len(jobOSes) == 0 {
 		return jobOSes, sce.WithMessage(sce.ErrScorecardInternal,
 			fmt.Sprintf("unable to determine OS for job: %v", GetJobName(job)))

checks/fileparser/github_workflow_test.go

@@ -49,6 +49,16 @@ func TestGitHubWorkflowShell(t *testing.T) {
 			filename:       "../testdata/github-workflow-shells-all-windows-matrix.yaml",
 			expectedShells: []string{"pwsh"},
 		},
+		{
+			name:           "all windows, OSes listed in matrix.include",
+			filename:       "../testdata/github-workflow-shells-all-windows-matrix-include.yaml",
+			expectedShells: []string{"pwsh"},
+		},
+		{
+			name:           "all windows, empty matrix.include",
+			filename:       "../testdata/github-workflow-shells-all-windows-matrix-include-empty.yaml",
+			expectedShells: []string{"pwsh"},
+		},
 		{
 			name:           "all windows",
 			filename:       "../testdata/github-workflow-shells-all-windows.yaml",

checks/testdata/github-workflow-shells-all-windows-matrix-include-empty.yaml

@@ -0,0 +1,23 @@
+# Copyright 2021 Security Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+jobs:
+  Job1:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [windows-2019, windows-latest]
+        include:
+    steps:
+      - run: echo "hello, github"

checks/testdata/github-workflow-shells-all-windows-matrix-include.yaml

@@ -0,0 +1,24 @@
+# Copyright 2021 Security Scorecard Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+jobs:
+  Job1:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        include:
+          - {name: Windows, python: '3.9', os: windows-latest}
+          - {name: Windows, python: '3.8', os: windows-2019}
+    steps:
+      - run: echo "hello, github"