feat(engine): ignore terraform cache folders

[dim-ops]

Closes #6217
Proposed Changes

• To improve scan Kics can ignore terraform cache folders;

I submit this contribution under the Apache-2.0 license.

[github-advanced-security]

You have successfully added a new gosec configuration .github/workflows/go-ci.yml:security-scan. As part of the setup process, we have scanned this repository and found 19 existing alerts. Please check the repository Security tab to see all alerts.

[kaplanlior]

@dim-ops don't forget to remove the draft status for this PR so we can review it. If you need any help before that - ping me.

[dim-ops]

It works for me, it ignores all .terra folders in current path or in subdirectories. I setup terra to work with terraform and terragrunt cache

[cxMiguelSilva]

Hi @dim-ops,
Thank you for another great contribution! 🚀
From an initial overview, the changes make sense to me. I would only suggest adding some tests to the filesystem_test.go just to make sure the behavior from now onwards works as respected.
Let us know in case you need any help!

[dim-ops]

I changed this test because I didn't understand why "true" was expected. During the test I passed in this line:
_, err := os.Stat(filepath.Join(path, "Chart.yaml"))

Which returned true, nil because I had no Chart.yaml file in my path, so I understood if there is no Chart.yaml file it should be ignored and I don't understand why.

Can you explain me? @cxMiguelSilva

[cxMiguelSilva]

Hi @dim-ops,
That check is in place to ignore all folders of Helm Charts to later make a scan to the Helm templates

[dim-ops]

Yes I understand the interest of _, err := os.Stat(filepath.Join(path, "Chart.yaml"))but I don't understand why true is returned when Chart.yaml doesn't exist. If I understand well true is when folder must be skipped, if Chart.yaml is not present folder should be parsed.

It's why I modify this check

		_, err := os.Stat(filepath.Join(path, "Chart.yaml"))
		if errors.Is(err, os.ErrNotExist) {
			return false, nil
		} else if err != nil || resolved {
			log.Error().Msgf("failed to check helm: %s", err)
			return true, nil
		}

[dim-ops]

Can I have more information @gabriel-cx ?

[dim-ops]

Up @gabriel-cx please 🙏

[gabriel-cx]

Hi @dim-ops ,

Sorry for the late reply!
We plan to give you a proper feedback during next week.

[JoaoAtGit]

Hi @dim-ops , how are you?
So I was looking into your code and made some changes,
first I changed the detection of .terra* to use regex, to cover all the cases present on the issue;
second I removed the logic that you put for the chart.yaml, because I ran regressions, and the files that should scanned with the helm resolver were being treated by the normal yaml resolver and were giving exceptions with this we were losing results.
Let me know what you think.
Br,
Joao Martins

[dim-ops]

Thanks @JoaoCxMartins it seems better 👍

[JoaoAtGit]

Thanks @JoaoCxMartins it seems better 👍

TY for your help improving Kics :)