feat(general): add proxy to git clone from

checkov/common/goget/github/get_git.py

@@ -5,6 +5,7 @@
 import shutil
 
 from checkov.common.goget.base_getter import BaseGetter
+from checkov.common.proxy.proxy_client import get_proxy_envs
 from checkov.common.resource_code_logger_filter import add_resource_code_filter_to_logger
 from checkov.common.util.contextmanagers import temp_environ
 
@@ -82,16 +83,17 @@ def do_get(self) -> str:
 
     def _clone(self, git_url: str, clone_dir: str) -> None:
         self.logger.debug(f"cloning {self.url if '@' not in self.url else self.url.split('@')[1]} to {clone_dir}")
+        proxy_env = get_proxy_envs()
         with temp_environ(GIT_TERMINAL_PROMPT="0"):  # disables user prompts originating from GIT
             if self.branch:
-                Repo.clone_from(git_url, clone_dir, branch=self.branch, depth=1)  # depth=1 for shallow clone
+                Repo.clone_from(git_url, clone_dir, branch=self.branch, depth=1, env=proxy_env)  # depth=1 for shallow clone
             elif self.commit_id:  # no commit id support for branch
-                repo = Repo.clone_from(git_url, clone_dir, no_checkout=True)  # need to be a full git clone
+                repo = Repo.clone_from(git_url, clone_dir, no_checkout=True, env=proxy_env)  # need to be a full git clone
                 repo.git.checkout(self.commit_id)
             elif self.tag:
-                Repo.clone_from(git_url, clone_dir, depth=1, b=self.tag)
+                Repo.clone_from(git_url, clone_dir, depth=1, b=self.tag, env=proxy_env)
             else:
-                Repo.clone_from(git_url, clone_dir, depth=1)
+                Repo.clone_from(git_url, clone_dir, depth=1, env=proxy_env)
 
     # Split source url into Git url and subdirectory path e.g. test.com/repo//repo/subpath becomes 'test.com/repo', '/repo/subpath')
     # Also see reference implementation @ go-getter https://github.com/hashicorp/go-getter/blob/main/source.go

checkov/terraform/module_loading/proxy_client.py → checkov/common/proxy/proxy_client.py

@@ -1,25 +1,29 @@
+from __future__ import annotations
+
 import os
-from typing import Any
+from typing import Any, Optional
 
 import requests
 
+from checkov.common.util.env_vars_config import env_vars_config
+
 
 class ProxyClient:
     def __init__(self) -> None:
-        self.proxy_ca_path = os.getenv('PROXY_CA_PATH', None)
+        self.proxy_ca_path = env_vars_config.PROXY_CA_PATH
         if self.proxy_ca_path is None:
             raise Exception("[ProxyClient] CA certificate path is missing")
 
     def get_session(self) -> requests.Session:
-        if not os.getenv('PROXY_URL', None):
+        if not env_vars_config.PROXY_URL:
             raise Exception('Please provide "PROXY_URL" env var')
-        proxy_url = os.getenv('PROXY_URL')
+        proxy_url = env_vars_config.PROXY_URL
         session = requests.Session()
         proxies = {
             "http": proxy_url,
             "https": proxy_url,
         }
-        session.proxies.update(proxies)  # type: ignore
+        session.proxies.update(proxies)
         return session
 
     def send_request(self, request: requests.Request) -> requests.Response:
@@ -31,3 +35,13 @@ def send_request(self, request: requests.Request) -> requests.Response:
 def call_http_request_with_proxy(request: requests.Request) -> Any:
     proxy_client = ProxyClient()
     return proxy_client.send_request(request=request)
+
+
+def get_proxy_envs() -> Optional[dict[str, Optional[str]]]:
+    if os.getenv('PROXY_URL'):
+        proxy_env = os.environ.copy()
+        proxy_env["GIT_SSL_CAINFO"] = env_vars_config.PROXY_CA_PATH  # Path to the CA cert
+        proxy_env["http_proxy"] = env_vars_config.PROXY_URL  # Proxy URL
+        proxy_env["https_proxy"] = env_vars_config.PROXY_URL  # HTTPS Proxy URL (if needed)
+        return proxy_env
+    return None

checkov/terraform/module_loading/loaders/registry_loader.py

@@ -19,7 +19,7 @@
     order_versions_in_descending_order,
     get_version_constraints
 )
-from checkov.terraform.module_loading.proxy_client import call_http_request_with_proxy
+from checkov.common.proxy.proxy_client import call_http_request_with_proxy
 
 if TYPE_CHECKING:
     from checkov.terraform.module_loading.module_params import ModuleParams