Add env variable to control execution of extensions in project repo. (#1326)

* Introduce new env variable to restrict extension files exec

* Add docu on restricting exec of extension files

* Update documentation/docs/extensibility.md

Co-Authored-By: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>

* Rename parameter

* Update documentation/docs/extensibility.md

Co-Authored-By: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>

* Add test for restricting extensions exec

* Fix additional tests

* extract condition

* use binding for env vars

* mock env binding

* Update piperStageWrapper.groovy

🙄

Co-authored-by: Christopher Fenner <26137398+CCFenner@users.noreply.github.com>
Co-authored-by: Marcus Holl <marcus.holl@sap.com>

documentation/docs/extensibility.md

@@ -67,6 +67,11 @@ return this
     Please note that the `Init` stage also checks out your current repository including your extensions.<br />
     Therefore, it is not possible to use extensions on this stage.
 
+!!! note "Disable Extensions Execution"
+    By default, there is a possibility for extensions to get executed. In case of disabling it, please ensure to set `PIPER_DISABLE_EXTENSIONS` to `true`.
+    Setting this parameter to `true` excludes the execution of extension files in `.pipeline/extensions/<StageName>.groovy`.
+
+
 ### Practical example
 
 For a more practical example, you can use extensions in the SAP Cloud SDK pipeline to add custom linters to your pipeline.

test/groovy/PiperStageWrapperTest.groovy

@@ -13,6 +13,7 @@ import util.Rules
 
 import static org.hamcrest.CoreMatchers.containsString
 import static org.hamcrest.Matchers.is
+import static org.hamcrest.Matchers.not
 import static org.junit.Assert.assertThat
 
 class PiperStageWrapperTest extends BasePiperTest {
@@ -181,6 +182,27 @@ class PiperStageWrapperTest extends BasePiperTest {
         assertThat(DebugReport.instance.localExtensions.test_old_extension, is('Extends'))
     }
 
+    @Test
+    void testExtensionDeactivation() {
+        helper.registerAllowedMethod('fileExists', [String.class], { path ->
+            return (path == '.pipeline/extensions/test_old_extension.groovy')
+        })
+        helper.registerAllowedMethod('load', [String.class], {
+            return helper.loadScript('test/resources/stages/test_old_extension.groovy')
+        })
+
+        nullScript.commonPipelineEnvironment.gitBranch = 'testBranch'
+        binding.setVariable('env', [PIPER_DISABLE_EXTENSIONS: 'true'])
+        stepRule.step.piperStageWrapper(
+            script: nullScript,
+            juStabUtils: utils,
+            ordinal: 10,
+            stageName: 'test_old_extension'
+        ) {}
+        //setting above parameter to 'true' bypasses the below message
+        assertThat(loggingRule.log, not(containsString("[piperStageWrapper] Running project interceptor '.pipeline/extensions/test_old_extension.groovy' for test_old_extension.")))
+    }
+
     @Test
     void testPipelineResilienceMandatoryStep() {
         thrown.expectMessage('expected error')

vars/piperStageWrapper.groovy

@@ -80,7 +80,7 @@ private void executeStage(script, originalStage, stageName, config, utils, telem
         def body = originalStage
 
         // First, check if a global extension exists via a dedicated repository
-        if (globalExtensions) {
+        if (globalExtensions && allowExtensions()) {
             echo "[${STEP_NAME}] Found global interceptor '${globalInterceptorFile}' for ${stageName}."
             // If we call the global interceptor, we will pass on originalStage as parameter
             DebugReport.instance.globalExtensions.put(stageName, "Overwrites")
@@ -95,7 +95,7 @@ private void executeStage(script, originalStage, stageName, config, utils, telem
         }
 
         // Second, check if a project extension (within the same repository) exists
-        if (projectExtensions) {
+        if (projectExtensions && allowExtensions()) {
             echo "[${STEP_NAME}] Running project interceptor '${projectInterceptorFile}' for ${stageName}."
             // If we call the project interceptor, we will pass on body as parameter which contains either originalStage or the repository interceptor
             if (projectExtensions && globalExtensions) {
@@ -188,3 +188,7 @@ private boolean isOldInterceptorInterfaceUsed(Script interceptor) {
     MetaMethod method = interceptor.metaClass.pickMethod("call", [Closure.class, String.class, Map.class, Map.class] as Class[])
     return method != null
 }
+
+private boolean allowExtensions(){
+    return env.PIPER_DISABLE_EXTENSIONS == null || Boolean.valueOf(env.PIPER_DISABLE_EXTENSIONS) == false
+}