gitlab-qa 14.14.0 → 14.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d73b967d2138dc5d4937126e2eed2a7bf79869c7dbba222bb2288eeb5579b7fa
-  data.tar.gz: c8c5ddbff3b831889fc0f670c00538e936a5528bb2ffc775f5db30abf93366a7
+  metadata.gz: 497913af708d5bd502f32c82f052d0dbcfddb70142979c9e2ecf76ea40ab76d8
+  data.tar.gz: 730eec75c41c7805635602a68d461844062dc786bf953071bc80a0256f5fec97
 SHA512:
-  metadata.gz: c16e9f78c27107f1b512eff6101eb04c7ca39d6b8dd0cdd55cc08b3c07c5d4884a66ce378b61c5526983df982083b7b81e86d0cc3c87913e4050a4ea29ae9fea
-  data.tar.gz: 55af607f3fa32af6494800b66c3bf1614426fe02191a21894e2553361b2979421912dcbef0b488f9021c5d6f281965019fc82f245e09a84db8049a6edd18cb18
+  metadata.gz: e8e4b3d39cf8cdf652cdd0001bd1f3238e8f707e51159b3e48a8bf43d8827485684e18734b345a8a793afdb36bdc2fb8fe36437160ee997dc6a04a4647fb1b7b
+  data.tar.gz: c353c880a71f75860f0ffb6e8bfd13360680bdc5f31573abaa12b455194529273498728d9bbbbe48b61ffda62fddf1b7e02ddc93d5e1abb1ca96e0cbd68ae2be

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (14.14.0)
+    gitlab-qa (14.15.0)
       activesupport (>= 6.1, < 7.2)
       gitlab (~> 4.19)
       http (~> 5.0)

data/docs/what_tests_can_be_run.md

@@ -375,6 +375,30 @@ $ export EE_LICENSE=$(cat /path/to/Geo.gitlab_license)
 $ gitlab-qa Test::Integration::Geo EE
 ```
 
+[test-cvs]: ...
+
+### `Test::Integration::ContinuousVulnerabilityScanning EE|<full image address>`
+
+This tests [Continuous Vulnerability Scanning](https://docs.gitlab.com/ee/user/application_security/continuous_vulnerability_scanning/)
+which is functionality to allow updated vulnerabilities to be downloaded and shown for
+relevant software dependencies.
+
+It is designed to run against a particular end to end spec as per the example.
+
+It is EE functionality and requires a license to be set.
+
+**Required environment variables:**
+
+- `EE_LICENSE`: A valid EE license.
+
+Example:
+
+```shell
+$ export EE_LICENSE=$(cat /path/to/gitlab_license)
+$ export GITLAB_LICENSE_MODE=test
+$ gitlab-qa Test::Integration::ContinuousVulnerabilityScanning EE
+````
+
 [test-geo]: https://gitlab.com/gitlab-org/gitlab-ee/blob/master/qa/qa/ee/scenario/test/geo.rb
 
 ### `Test::Integration::GitalyCluster CE|EE|<full image address>`

data/fixtures/cvs/vulnerabilities_template.erb

@@ -0,0 +1,2 @@
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Arbitrary test vulnerability","description":"An arbitrary vulnerability exists for testing. This vulnerability should be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= Date.today.prev_day.iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-12345","value":"CVE-2124-12345","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-12345"},{"type":"ghsa","name":"GHSA-abcd-123e-fg4h","value":"GHSA-abcd-123e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-42","value":"42","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Outdated test vulnerability","description":"An Outdated vulnerability exists for testing. This vulnerability should NOT be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= (Date.today - 15).iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-54321","value":"CVE-2124-54321","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-54321"},{"type":"ghsa","name":"GHSA-abcd-321e-fg4h","value":"GHSA-abcd-321e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-43","value":"43","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}

data/lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'date'
+require 'erb'
+require 'pathname'
+
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Integration
+          class ContinuousVulnerabilityScanning < Scenario::Template
+            def initialize
+              @network = Runtime::Env.docker_network
+              @tag = 'secure_cvs'
+            end
+
+            def perform(release, *rspec_args)
+              Component::Gitlab.perform do |gitlab|
+                setup_and_run_tests(gitlab, release, *rspec_args)
+              end
+            end
+
+            private
+
+            def setup_and_run_tests(gitlab, release, *rspec_args)
+              set_up_gitlab(gitlab, release)
+              gitlab.instance do
+                place_new_vulnerabilities(gitlab)
+                run_specs(gitlab, *rspec_args)
+              end
+            end
+
+            def set_up_gitlab(gitlab, release)
+              gitlab.release = QA::Release.new(release)
+              gitlab.name = 'gitlab'
+              gitlab.network = @network
+            end
+
+            def place_new_vulnerabilities(gitlab)
+              write_vulnerabilities(gitlab, generate_filepath, generate_vulnerabilities)
+              start_advisory_sync_worker(gitlab)
+            end
+
+            def generate_vulnerabilities
+              template = File.read(File.expand_path('../../../../../../fixtures/cvs/vulnerabilities_template.erb', __dir__))
+              ERB.new(template).result(binding)
+            end
+
+            def generate_filepath
+              File.join(
+                "/opt/gitlab/embedded/service/gitlab-rails/vendor/package_metadata/advisories/v2/rubygem/#{Time.now.to_i}",
+                '000000000.ndjson'
+              )
+            end
+
+            def write_vulnerabilities(gitlab, filepath, content)
+              gitlab.docker.exec(gitlab.name, "mkdir -p #{File.dirname(filepath)}")
+              gitlab.docker.write_files(gitlab.name) { |f| f.write(filepath, content, false) }
+            end
+
+            def start_advisory_sync_worker(gitlab)
+              gitlab.docker.exec(gitlab.name, "PM_SYNC_IN_DEV=true gitlab-rails runner 'loop do PackageMetadata::AdvisoriesSyncWorker.new.perform; sleep 30; end' &")
+            end
+
+            def run_specs(gitlab, *rspec_args)
+              Runtime::Logger.info('Running Continuous Vulnerability Scanning spec...')
+              rspec_args << "--" unless rspec_args.include?('--')
+              rspec_args << "--tag" << @tag
+              run_spec_component(gitlab, rspec_args)
+            end
+
+            def run_spec_component(gitlab, rspec_args)
+              Component::Specs.perform do |specs|
+                specs.suite = 'Test::Instance::All'
+                specs.release = gitlab.release
+                specs.network = gitlab.network
+                specs.args = [gitlab.address, *rspec_args]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '14.14.0'
+    VERSION = '14.15.0'
   end
 end

data/support/data/admin_access_token_seed.rb

@@ -18,7 +18,7 @@ class AdminAccessTokenSeed
 
     admin_user.personal_access_tokens.build(token_params).tap do |pat|
       pat.set_token(TOKEN_VALUE)
-      pat.organization = Organizations::Organization.default_organization
+      pat.organization = Organizations::Organization.default_organization if Gitlab.version_info >= Gitlab::VersionInfo.new(17, 4)
       pat.save!
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 14.14.0
+  version: 14.15.0
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-09-11 00:00:00.000000000 Z
+date: 2024-09-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -376,6 +376,7 @@ files:
 - docs/waits.md
 - docs/what_tests_can_be_run.md
 - exe/gitlab-qa
+- fixtures/cvs/vulnerabilities_template.erb
 - fixtures/ldap/1_add_nodes.ldif
 - fixtures/ldap/2_add_users.ldif
 - fixtures/ldap/3_add_groups.ldif
@@ -450,6 +451,7 @@ files:
 - lib/gitlab/qa/scenario/test/integration/ai_gateway_no_seat_assigned.rb
 - lib/gitlab/qa/scenario/test/integration/chaos.rb
 - lib/gitlab/qa/scenario/test/integration/client_ssl.rb
+- lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb
 - lib/gitlab/qa/scenario/test/integration/elasticsearch.rb
 - lib/gitlab/qa/scenario/test/integration/geo.rb
 - lib/gitlab/qa/scenario/test/integration/gitaly_cluster.rb