Run checks in Spacelift

# syntax=docker/dockerfile:1
# Pin a tag or a digest you reviewed. Check the published tags in the public ECR gallery for
# spacelift/runner-terraform; do not build from :latest.
FROM public.ecr.aws/spacelift/runner-terraform:<pinned-tag>

ARG CTFKIT_VERSION=0.2.1
ARG TARGETARCH=amd64

USER root

# The base image is Alpine and has curl but not jq; the download below needs both.
RUN apk add --no-cache curl jq

# ctfkit: the Linux release archive, downloaded with the token from the gh_token build secret and
# checked against the release checksums before it is unpacked. Release archives are named
# ctfkit_<version>_Linux_x86_64.tar.gz and ctfkit_<version>_Linux_arm64.tar.gz.
RUN --mount=type=secret,id=gh_token set -eu; \
    case "$TARGETARCH" in amd64) arch=x86_64 ;; arm64) arch=arm64 ;; *) exit 1 ;; esac; \
    tarball="ctfkit_${CTFKIT_VERSION}_Linux_${arch}.tar.gz"; \
    api="https://api.github.com/repos/compliancetf/ctfkit"; \
    auth="Authorization: Bearer $(cat /run/secrets/gh_token)"; \
    mkdir -p /tmp/ctfkit; cd /tmp/ctfkit; \
    curl -fsSL -H "$auth" -H "Accept: application/vnd.github+json" \
      "$api/releases/tags/v${CTFKIT_VERSION}" > release.json; \
    for f in "$tarball" checksums.txt; do \
      id=$(jq -r --arg n "$f" '.assets[] | select(.name == $n) | .id' release.json); \
      [ -n "$id" ]; \
      curl -fsSL -H "$auth" -H "Accept: application/octet-stream" \
        -o "$f" "$api/releases/assets/$id"; \
    done; \
    awk -v a="$tarball" '$2==a' checksums.txt | sha256sum -c -; \
    tar -xzf "$tarball" ctfkit; \
    install -m 0755 ctfkit /usr/local/bin/ctfkit; \
    cd /; rm -rf /tmp/ctfkit; \
    ctfkit version

# Optional, for OpenTofu stacks where the image provides tofu instead of Spacelift: install a
# pinned OpenTofu release the same way, checked against its SHA256SUMS file.

# Settings and exceptions live in the image, never in the analyzed repository.
COPY ctfkit.yaml     /opt/ctfkit/ctfkit.yaml
COPY exceptions.yaml /opt/ctfkit/exceptions.yaml

# Switch back to the base image's user: spacelift/runner-terraform runs as spacelift (uid 1983).
USER spacelift

export GH_TOKEN="$CTFKIT_RELEASE_TOKEN"   # from your secret store, never inline
docker build --secret id=gh_token,env=GH_TOKEN -t <your-registry>/ctfkit-runner:<tag> .

# .spacelift/config.yml for a module repository served through the Spacelift module registry.
# Copy this to .spacelift/config.yml at the root of the module repository. These hooks gate that
# repository's own releases, so they belong beside its code. Consuming-stack hooks do not: see
# config.stack.yml and https://compliance.tf/docs/ctfkit/spacelift/.
#
# Every flag that decides an outcome is pinned here and reads from the runner image, never from the
# repository being analyzed: --fail-on, --format, --config, --exceptions, --catalog. A module
# repository therefore cannot lower its own threshold, widen its endpoint allowlist, grant itself an
# exception or swap in a different catalog by committing a file. `--catalog embedded` pins the
# release catalog compiled into the binary and ignores ~/.ctf/control-requirements.yaml, so
# control ids and remediation module sources always resolve and no catalog file has to be shipped
# or kept current.
#
# Shadow mode: --fail-on never means the hook always exits 0 on findings, so a test case can only
# fail on its own merits while the recipe is bedding in. To enforce, change it to --fail-on error.
# This hook renders more than one format, so its exit code decides the test case and the threshold
# matters here. The plan policy in policy.rego does not apply to module test cases.
version: "1"

test_defaults:
  # An image that carries the pinned ctfkit binary on PATH, plus the settings and exception files
  # the hooks read. The catalog needs no file: it is compiled into the binary. No runner image is
  # published: build one on a Spacelift runner base with ctfkit v0.2.1 or later, following
  # https://compliance.tf/docs/ctfkit/spacelift/, and push it to a registry your Spacelift workers
  # can pull from. A distroless image has no shell and cannot run hooks, so it cannot be the runner
  # image. A ctfkit container image is planned and not published.
  runner_image: <your-registry>/ctfkit-runner:<tag>

  after_init:
    # A metadata file committed to the repository would otherwise be read as this run's result.
    - rm -f ctfkit.custom.spacelift.json
    - >-
      ctfkit report
      --fail-on never
      --format receipt,spacelift --out-dir .ctfkit
      --config /opt/ctfkit/ctfkit.yaml
      --exceptions /opt/ctfkit/exceptions.yaml
      --catalog embedded
    # To import test results into the receipt, add --tests-json to the line above. ctfkit never
    # runs tofu or terraform, so the file must already exist when this hook runs, written by the
    # step that runs the tests, for example `tofu test -json > tests.json`:
    #   ctfkit report --fail-on never --format receipt,spacelift --out-dir .ctfkit --tests-json tests.json ...

tests:
  - name: complete
    project_root: examples/complete
  - name: simple
    project_root: examples/simple

# Hook configuration for a consuming stack.
#
# Configure this in the STACK'S SETTINGS, through the Spacelift UI, API or terraform provider, not
# as a .spacelift/config.yml in the stack repository. A file in the repository is editable by
# anyone who can open a pull request against it, so the hook that produces the evidence could be
# removed in the same change that introduces the finding. Stack settings are a platform admin
# concern and stay that way.
#
# The module-registry test hooks in config.yml are different: they live in the module repository's
# own .spacelift/config.yml, because they gate that repository's releases.
#
# Two hooks, two metadata keys, so neither overwrites the other. Each file is JSON with a verdict,
# a summary of counts and a findings list:
#   after_init  ->  ctfkit report  ->  ctfkit.custom.spacelift.json
#   after_plan  ->  ctfkit scan    ->  ctfkit-scan.custom.spacelift.json
#
# Every flag that decides an outcome is pinned here and reads from the runner image, never from the
# repository being analyzed: --fail-on, --format, --config, --exceptions, --catalog, so a stack
# cannot change any of them by committing a file. `--catalog embedded` pins the release catalog
# compiled into the binary and ignores ~/.ctf/control-requirements.yaml, so control ids and
# remediation module sources always resolve and no catalog file has to be shipped or kept current.
#
# Both hooks render a format list of exactly `spacelift`, which by contract exits 0 on findings, so
# neither can turn the run red however the threshold is set. Exit 2, a tool error, still fails the
# hook, and nothing here suppresses that. Whether a stack is enforced is decided in policy.rego, by
# enforce or by the ctfkit:enforce stack label.
version: "1"

# Your own image with ctfkit v0.2.1 or later on PATH; see https://compliance.tf/docs/ctfkit/spacelift/.
# A distroless image has no shell and cannot run hooks. A ctfkit container image is planned and not
# published.
runner_image: <your-registry>/ctfkit-runner:<tag>

after_init:
  # A metadata file left in the working directory, by an earlier hook or committed to the
  # repository, would otherwise be read by the policy as this run's result.
  - rm -f ctfkit.custom.spacelift.json
  - >-
    ctfkit report
    --fail-on error
    --format spacelift
    --config /opt/ctfkit/ctfkit.yaml
    --exceptions /opt/ctfkit/exceptions.yaml
    --catalog embedded
  # A stack that runs tofu test can import the results: add --tests-json to the line above. ctfkit
  # never runs tofu or terraform, so the file must already exist when this hook runs, written by
  # the step that runs the tests, for example `tofu test -json > tests.json`:
  #   ctfkit report --fail-on error --format spacelift --tests-json tests.json ...

after_plan:
  # `ctfkit scan` needs plan JSON, and ctfkit never runs tofu or terraform itself, so the hook turns
  # the saved plan into JSON first, with tofu when it is on PATH and terraform otherwise. It takes
  # the first regular file among spacelift.plan, *.plan and *.tfplan in the working directory. The
  # plan file name is not yet verified on a live Spacelift run; the probe covers the
  # likely names until it is. A stale ctfkit-scan file or plan.json is removed first, so the policy
  # never reads a file this run did not write. With no plan file the hook logs one line to stderr
  # and exits 0: the run carries no ctfkit-scan key, and the policy reports it missing, warned in
  # shadow mode and denied once enforcing. A failing show exits 1, and ctfkit scan is the last
  # command, so a ctfkit tool error (exit 2) fails the hook too.
  - |
    rm -f ctfkit-scan.custom.spacelift.json plan.json
    p=
    for f in spacelift.plan *.plan *.tfplan; do
      if [ -f "$f" ]; then p=$f; break; fi
    done
    if [ -z "$p" ]; then
      echo "ctfkit: no plan file (spacelift.plan, *.plan, *.tfplan) in $(pwd); scan skipped" >&2
    else
      if command -v tofu >/dev/null 2>&1; then tf=tofu; else tf=terraform; fi
      "$tf" show -json "$p" > plan.json || exit 1
      ctfkit scan --plan plan.json --stage post_plan \
        --fail-on error \
        --format spacelift \
        --config /opt/ctfkit/ctfkit.yaml \
        --exceptions /opt/ctfkit/exceptions.yaml \
        --catalog embedded
    fi

# Spacelift plan policy for ctfkit by compliance.tf.
#
# Attach this as a Plan policy to every stack that runs the ctfkit hooks. A consuming stack gets its
# hooks from its stack settings (see config.stack.yml), not from a committed file; a
# .spacelift/config.yml applies only to a module repository's test cases (see config.yml). The
# policy renders the verdict the hooks already computed and never re-derives one from counts.
package spacelift

# Rego v1 syntax. The import keeps the file loading on OPA 0.59 or later evaluating in v0 mode
# (0.59 added `import rego.v1`; an older OPA rejects it); on OPA 1.x it changes nothing.
import rego.v1

# Global switch. Set enforce := true to enforce every stack this policy is attached to. While it
# stays false, every rule below is a warning and nothing blocks, except on a stack carrying the
# ctfkit:enforce label (next rule). No hook can turn a run red on its own. Module repositories do
# not use this switch: their test cases switch by changing --fail-on in their .spacelift/config.yml.
#
# Enforce a stack once it has had several shadow runs whose warnings you have reviewed, every run
# carries both metadata keys, and no run reports an unexpected manifest_missing finding.
enforce := false

# Per-stack switch: a stack carrying the label ctfkit:enforce is enforced while enforce stays false,
# so a platform admin can move one stack at a time. Labels live in stack settings, so a stack cannot
# add or remove its own label from its own repository, unless its settings are managed from that
# same repository (an administrative stack or the Spacelift terraform provider). No label means
# shadow mode.
enforce_stack if "ctfkit:enforce" in input.spacelift.stack.labels

# Only the exact label enforces. Any other ctfkit: label is warned, so a typo such as
# ctfkit:enforced does not leave a stack in shadow mode unnoticed.
unrecognized_labels contains label if {
	some label in input.spacelift.stack.labels
	startswith(label, "ctfkit:")
	label != "ctfkit:enforce"
}

warn contains msg if {
	not enforcing
	some label in unrecognized_labels
	msg := sprintf("unrecognized ctfkit label %v; stack stays in shadow mode", [label])
}

warn contains msg if {
	enforcing
	some label in unrecognized_labels
	msg := sprintf("unrecognized ctfkit label %v", [label])
}

enforcing if enforce

enforcing if enforce_stack

# Each hook writes its own metadata key, so after_init and after_plan never overwrite each other:
# `ctfkit report` writes ctfkit.custom.spacelift.json, `ctfkit scan` writes
# ctfkit-scan.custom.spacelift.json. A stack run is expected to carry both.
keys := {"ctfkit", "ctfkit-scan"}

schema := "ctfkit.spacelift/1"

report[key] := r if {
	key := keys[_]
	r := input.third_party_metadata.custom[key]
}

missing contains key if {
	key := keys[_]
	not input.third_party_metadata.custom[key]
}

# ctfkit computes the verdict when it writes the file: fail when any unsuppressed error-level
# finding exists. It does not depend on --fail-on, so a hook's threshold cannot make a failing run
# look clean. The policy reads that field rather than counting findings, which is also why a rule
# that runs at both stages cannot be double counted. The totals are quoted for the reader, never
# summed across the two files.
#
# Anything that is not exactly "pass" fails closed, including an absent verdict: a file this policy
# cannot read as a pass is not a pass.
verdict(r) := v if {
	v := r.verdict
}

verdict(r) := "absent" if {
	not r.verdict
}

complete_summary(r) if {
	r.summary.error
	r.summary.warning
}

counts(r) := c if {
	complete_summary(r)
	c := sprintf("%d error, %d warning", [r.summary.error, r.summary.warning])
}

counts(r) := "totals unavailable" if {
	not complete_summary(r)
}

failed[key] := msg if {
	r := report[key]
	v := verdict(r)
	v != "pass"
	msg := sprintf("%v: verdict %v (%v)", [key, v, counts(r)])
}

# Shadow mode: surface everything, block nothing.
warn contains msg if {
	missing[key]
	msg := sprintf("ctfkit metadata is missing from this run under key %v", [key])
}

warn contains msg if {
	msg := failed[_]
}

# Once enforcing, through enforce or the stack label, the policy fails closed. Metadata absent
# under either key, and metadata carrying a schema this policy does not know, both deny: a run
# where a hook silently did not execute cannot pass as a clean run.
deny contains msg if {
	enforcing
	missing[key]
	msg := sprintf("ctfkit metadata is missing from this run under key %v", [key])
}

deny contains msg if {
	enforcing
	r := report[key]
	r.schema != schema
	msg := sprintf("ctfkit metadata under key %v is in unknown schema %v", [key, r.schema])
}

deny contains msg if {
	enforcing
	msg := failed[_]
}

cd adapters/spacelift
opa eval --format pretty --data policy.rego --input test/scan-verdict-fail.json 'data.spacelift.warn'

terraform {
  required_providers {
    spacelift = {
      source  = "spacelift-io/spacelift"
      version = "~> 1.55"
    }
  }
}

resource "spacelift_policy" "ctfkit" {
  name        = "ctfkit"
  description = "Renders the verdicts ctfkit by compliance.tf wrote in the after_init and after_plan hooks"
  type        = "PLAN"
  engine_type = "REGO_V1"
  body        = file("${path.module}/policy.rego")
}

resource "spacelift_stack" "network" {
  name         = "network"
  repository   = "infrastructure"
  branch       = "main"
  project_root = "network"

  terraform_workflow_tool = "OPEN_TOFU"
  runner_image            = "<your-registry>/ctfkit-runner:<tag>"

  # Shadow mode. To enforce this stack later, add the label:
  #   labels = ["ctfkit:enforce"]
  labels = []

  # The hooks of config.stack.yml, saved verbatim.
  after_init = [
    file("${path.module}/ctfkit-after-init.sh"),
  ]

  after_plan = [
    file("${path.module}/ctfkit-after-plan.sh"),
  ]
}

resource "spacelift_policy_attachment" "ctfkit_network" {
  policy_id = spacelift_policy.ctfkit.id
  stack_id  = spacelift_stack.network.id
}