fix(helm): properly handle multiple archived dependencies

Signed-off-by: nikpivkin <[email protected]>

pkg/iac/scanners/helm/parser/parser.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"io/fs"
+	"path"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -95,7 +96,7 @@ func (p *Parser) ParseFS(ctx context.Context, target fs.FS, path string) error {
 			return nil
 		}
 
-		if detection.IsArchive(path) {
+		if detection.IsArchive(path) && !isDependencyChartArchive(p.workingFS, path) {
 			tarFS, err := p.addTarToFS(path)
 			if errors.Is(err, errSkipFS) {
 				// an unpacked Chart already exists
@@ -123,6 +124,16 @@ func (p *Parser) ParseFS(ctx context.Context, target fs.FS, path string) error {
 	return nil
 }
 
+func isDependencyChartArchive(fsys fs.FS, archivePath string) bool {
+	parent := path.Dir(archivePath)
+	if !strings.HasSuffix(parent, "charts") {
+		return false
+	}
+
+	_, err := fs.Stat(fsys, path.Join(parent, "..", "Chart.yaml"))
+	return err == nil
+}
+
 func (p *Parser) addPaths(paths ...string) error {
 	for _, path := range paths {
 		if _, err := fs.Stat(p.workingFS, path); err != nil {

pkg/iac/scanners/helm/parser/parser_test.go

@@ -48,4 +48,19 @@ func TestParseFS(t *testing.T) {
 		}
 		assert.Equal(t, expectedFiles, p.filepaths)
 	})
+
+	t.Run("chart with multiple archived deps", func(t *testing.T) {
+		p, err := New(".")
+		require.NoError(t, err)
+
+		fsys := os.DirFS(filepath.Join("testdata", "multiple-archived-deps"))
+		require.NoError(t, p.ParseFS(context.TODO(), fsys, "."))
+
+		expectedFiles := []string{
+			"Chart.yaml",
+			"charts/common-2.26.0.tgz",
+			"charts/opentelemetry-collector-0.108.0.tgz",
+		}
+		assert.Equal(t, expectedFiles, p.filepaths)
+	})
 }

pkg/iac/scanners/helm/parser/testdata/multiple-archived-deps/Chart.yaml

@@ -0,0 +1,14 @@
+apiVersion: v2
+appVersion: "1.1"
+description: Test Chart
+name: y-chart
+version: 1.0.0
+kubeVersion: ">=1.21"
+
+dependencies:
+  - name: common
+    repository: https://charts.bitnami.com/bitnami
+    version: 2.26.0
+  - name: opentelemetry-collector
+    version: 0.108.0
+    repository: https://open-telemetry.github.io/opentelemetry-helm-charts