Trying to use inputPath for ps-rule-assert@2, can't find a part of the path

[BenjaminEngeset]

Hi there project maintainers and contributors.

Trying to use inputPath instead of repository structure so I am only traversing thru changed files.

  - task: Bash@3
    displayName: "Diff"
    inputs:
      targetType: "inline"
      script: |
        if [ ! -z "$(git diff --name-status HEAD^ HEAD)" ]; then
          echo $(git diff --name-status HEAD^ HEAD)
          git diff --name-status HEAD^ HEAD > /tmp/diff.txt
          if [ ! -z "$(git diff --diff-filter=D HEAD^ HEAD --no-renames)" ]; then
          echo $(git diff --diff-filter=D HEAD^ HEAD  --no-prefix --no-renames | grep ^- | sed -r "s/^([^-+ ]*)[-+ ]/\\1/" | less -r)
          git diff --diff-filter=D HEAD^ HEAD --no-prefix --no-renames | grep ^- | sed -r "s/^([^-+ ]*)[-+ ]/\\1/" | less -r > 
          /tmp/diffdeletedfiles.txt
          $filename = Get-Content /tmp/diff.txt
          $filename | ForEach-Object { Copy-Item -Path $_ -Destination '/out/deployments' }
          fi
        else
          echo "The CI/CD validation pipeline failed because there is currently no change to be processed"
          exit 1
        fi

  - task: ps-rule-install@2
    inputs:
      module: PSRule.Rules.Azure 

  - task: ps-rule-assert@2
    continueOnError: true
    inputs:
      inputType: inputPath
      inputPath: '/out/deployments/*.bicep'                      
      modules: PSRule.Rules.Azure                       .
      baseline: Azure.GA_2022_03                        
      outputFormat: NUnit3                                 
      outputPath: reports/ps-rule-results.xml 

I am not able to make this work. Do the PSRule project see any obvious mistakes from my side here?

I have seen some various ways to use the inputPath, but I am not sure if this is the correct approach.

Running against git diff is great - would really like to make this work.

ps-rule.yml

# Use rules from the following modules/
include:
  module:
    - "PSRule.Rules.Azure"

# Require a minimum version of modules that include referenced baseline.
requires:
  PSRule.Rules.Azure: "@pre >=1.15.2"

execution:
  # Ignore warnings for resources and objects that don't have any rules.
  notProcessedWarning: false

configuration:
  # Enable expansion for Bicep source files.
  AZURE_BICEP_FILE_EXPANSION: true

  # Expand Bicep module from Azure parameter files.
  AZURE_PARAMETER_FILE_EXPANSION: true

  # Set timeout for expanding Bicep source files.
  AZURE_BICEP_FILE_EXPANSION_TIMEOUT: 15

input:
  pathIgnore:
    # Ignore common files that don't need analysis.
    - "**/bicepconfig.json"
    - "*.md"
    - "*.png"
    - ".pipelines/"

    # Include deployment files.
    # - "!out/deployments/**/*.bicep"

rule:
  exclude:
    # Ignore these recommendations for this repo.
    - Azure.Resource.UseTags
    - Azure.ACR.ContentTrust

/b

[BernieWhite]

@bengeset96 There is a few things going on here from what I can tell:

1. You are running on a Linux node so /out/deployments/*.bicep specifically the / actually means find this path from the root file system, what doesn't exist. This is what the error is about. Writing it like out/deployments/*.bicep is one way to address this. Also you can use the predefined variables available in Azure Pipelines.
2. The rules in PSRule for Azure only ever trigger off the inputType: repository configuration. This is just how it currently works. So using inputType: inputPath will not work. We have other work that may change this in the medium term around October but it is something that is early in our dev cycle so could easily be later.

Longer term we would like to provide some support for this type of use case in PSRule, both with documentation and improvements to PSRule to make this easier.

We have an issue #688 on the backlog for this feature. We'd love to see some use cases from the community and open the discussion even further. If this is important to you/ your team 👍 the issue and leave any comments that would help us build this feature correctly in the future.

---

In term of addressing the question; underneath the Azure DevOps task, PSRule is built around PowerShell which gives you a lot of flexibility to do something like this.

I'd try a command line like this:

Install-Module PSRule.Rules.Azure -Scope CurrentUser -Force;
git diff --name-only HEAD^ HEAD | ForEach-Object { Get-ChildItem $_ } | Assert-PSRule -Format File -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2022_03' -OutputFormat NUnit3 -OutputPath 'reports/ps-rule-results.xml'

Note: -Format File is the same as inputType: repository

I hope that helps.

[BenjaminEngeset]

@BernieWhite

First of all I would like to thank you to responding and helping out!

1. You are correct, typo from my side.
2. I understand, then I will not even bother trying to make it work. I am looking forward to the PR that will make that happend.

What you suggested working like a charm! I can't believe it was that easy. I do also like the suggestion, since it uses the same logic with name-only HEAD^ HEAD that I am already using for both validate and deploy.

After starting using PSRule we can't live without it, using it for thousands of resource declarations and it has just changed the quality of our codebase tremendously. Environments also tend to be much more stable since you don't have to do dangerous reconfigurations later on. Best to find it out soon as possible in the loop.

Again, thank you so much. Truly grateful!

Just to add at last, when using your suggestion, does this take ps-rule.yml in consideration exactly the same way as the PSRule task/s did?

Then I will just add

input:
  pathIgnore:
    # Ignore common files that don't need analysis.
    - "**/bicepconfig.json"
    - "*.md"
    - "*.png"
    - ".pipelines/"

    # Include deployments.
    # - "!root/**/*.bicep"
    # - "!root/**/*.json"

Working solution provided by @BernieWhite

Install-Module PSRule.Rules.Azure -Scope CurrentUser -Force;
git diff --name-only HEAD^ HEAD | ForEach-Object { Get-ChildItem $_ } | Assert-PSRule -Format File -Module 'PSRule.Rules.Azure' -Baseline 'Azure.GA_2022_03' -OutputFormat NUnit3 -OutputPath 'reports/ps-rule-results.xml'

/b

[BernieWhite]

@bengeset96 Yes ps-rule.yaml will be read in from the current working path.