gitlab-qa 14.14.0 → 14.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d73b967d2138dc5d4937126e2eed2a7bf79869c7dbba222bb2288eeb5579b7fa
-  data.tar.gz: c8c5ddbff3b831889fc0f670c00538e936a5528bb2ffc775f5db30abf93366a7
+  metadata.gz: b98b613be98b09d382003ce5a1bd4562bddf7a7e0216de30a76c0c264c51a973
+  data.tar.gz: 808ee2237ccbcabe62430f504b99a1c39930e90ccaff107d7316ce8a7ee71f52
 SHA512:
-  metadata.gz: c16e9f78c27107f1b512eff6101eb04c7ca39d6b8dd0cdd55cc08b3c07c5d4884a66ce378b61c5526983df982083b7b81e86d0cc3c87913e4050a4ea29ae9fea
-  data.tar.gz: 55af607f3fa32af6494800b66c3bf1614426fe02191a21894e2553361b2979421912dcbef0b488f9021c5d6f281965019fc82f245e09a84db8049a6edd18cb18
+  metadata.gz: edff13e29e9dc6cdda84b1cf8103676e5b74703a45fd6a7a77d34cc5b7f5b1fa836957e130806c263864c2ee659bb7f7cd9c9620e0f97c8c5cce0b756b7b2c60
+  data.tar.gz: 45ef2a7609d5e2345a4ca25067cb722098fe0ec734b9ab18ebf5513bf1af45d87f0a755f91ae0c4b2e10329a809e72c25f81df2c293aaadcc5dc89c763c07f6d

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (14.14.0)
+    gitlab-qa (14.16.0)
       activesupport (>= 6.1, < 7.2)
       gitlab (~> 4.19)
       http (~> 5.0)

data/docs/what_tests_can_be_run.md

@@ -375,6 +375,30 @@ $ export EE_LICENSE=$(cat /path/to/Geo.gitlab_license)
 $ gitlab-qa Test::Integration::Geo EE
 ```
 
+[test-cvs]: ...
+
+### `Test::Integration::ContinuousVulnerabilityScanning EE|<full image address>`
+
+This tests [Continuous Vulnerability Scanning](https://docs.gitlab.com/ee/user/application_security/continuous_vulnerability_scanning/)
+which is functionality to allow updated vulnerabilities to be downloaded and shown for
+relevant software dependencies.
+
+It is designed to run against a particular end to end spec as per the example.
+
+It is EE functionality and requires a license to be set.
+
+**Required environment variables:**
+
+- `EE_LICENSE`: A valid EE license.
+
+Example:
+
+```shell
+$ export EE_LICENSE=$(cat /path/to/gitlab_license)
+$ export GITLAB_LICENSE_MODE=test
+$ gitlab-qa Test::Integration::ContinuousVulnerabilityScanning EE
+````
+
 [test-geo]: https://gitlab.com/gitlab-org/gitlab-ee/blob/master/qa/qa/ee/scenario/test/geo.rb
 
 ### `Test::Integration::GitalyCluster CE|EE|<full image address>`

data/fixtures/cvs/vulnerabilities_template.erb

@@ -0,0 +1,2 @@
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Arbitrary test vulnerability","description":"An arbitrary vulnerability exists for testing. This vulnerability should be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= Date.today.prev_day.iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-12345","value":"CVE-2124-12345","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-12345"},{"type":"ghsa","name":"GHSA-abcd-123e-fg4h","value":"GHSA-abcd-123e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-42","value":"42","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}
+{"advisory":{"id":"<%= SecureRandom.uuid %>","source":"glad","title":"Outdated test vulnerability","description":"An Outdated vulnerability exists for testing. This vulnerability should NOT be picked up by Continuous Vulnerability Scanning.","cvss_v3":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","published_date":"<%= (Date.today - 15).iso8601 %>","urls":["https://gitlab.com/willmeek"],"identifiers":[{"type":"cve","name":"CVE-2124-54321","value":"CVE-2124-54321","url":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2124-54321"},{"type":"ghsa","name":"GHSA-abcd-321e-fg4h","value":"GHSA-abcd-321e-fg4h","url":"https://gitlab.com/willmeek"},{"type":"cwe","name":"CWE-43","value":"43","url":"https://gitlab.com/willmeek"}]},"packages":[{"name":"RedCloth","purl_type":"gem","affected_range":"<=3.39.0","solution":"Upgrade to version 3.39.0 or above.","fixed_versions":["3.39.0"]}]}

data/lib/gitlab/qa/component/gitlab.rb

@@ -140,7 +140,8 @@ module Gitlab
           set_qa_user_agent
           env = @omnibus_gitlab_rails_env.merge(
             {
-              'GITLAB_ALLOW_SEPARATE_CI_DATABASE' => Runtime::Env.allow_separate_ci_database.to_s
+              'GITLAB_ALLOW_SEPARATE_CI_DATABASE' => Runtime::Env.allow_separate_ci_database.to_s,
+              'COVERBAND_ENABLED' => Runtime::Env.coverband_enabled?.to_s
             }
           )
 

data/lib/gitlab/qa/runtime/env.rb

@@ -24,6 +24,7 @@ module Gitlab
           'AWS_S3_REGION' => :aws_s3_region,
           'CACHE_NAMESPACE_NAME' => :cache_namespace_name,
           'CHROME_DISABLE_DEV_SHM' => :chrome_disable_dev_shm,
+          'COVERBAND_ENABLED' => :coverband_enabled,
           'CI' => :ci,
           'CI_JOB_ID' => :ci_job_id,
           'CI_JOB_NAME' => :ci_job_name,
@@ -468,6 +469,10 @@ module Gitlab
           enabled?(env_var_value_if_defined('GITLAB_ALLOW_SEPARATE_CI_DATABASE'), default: false)
         end
 
+        def coverband_enabled?
+          enabled?(env_var_value_if_defined('COVERBAND_ENABLED'), default: false)
+        end
+
         def mock_github_enabled?
           enabled?(env_var_value_if_defined('QA_MOCK_GITHUB'), default: true)
         end

data/lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require 'date'
+require 'erb'
+require 'pathname'
+
+module Gitlab
+  module QA
+    module Scenario
+      module Test
+        module Integration
+          class ContinuousVulnerabilityScanning < Scenario::Template
+            def initialize
+              @network = Runtime::Env.docker_network
+              @tag = 'secure_cvs'
+            end
+
+            def perform(release, *rspec_args)
+              Component::Gitlab.perform do |gitlab|
+                setup_and_run_tests(gitlab, release, *rspec_args)
+              end
+            end
+
+            private
+
+            def setup_and_run_tests(gitlab, release, *rspec_args)
+              set_up_gitlab(gitlab, release)
+              gitlab.instance do
+                place_new_vulnerabilities(gitlab)
+                run_specs(gitlab, *rspec_args)
+              end
+            end
+
+            def set_up_gitlab(gitlab, release)
+              gitlab.release = QA::Release.new(release)
+              gitlab.name = 'gitlab'
+              gitlab.network = @network
+            end
+
+            def place_new_vulnerabilities(gitlab)
+              write_vulnerabilities(gitlab, generate_filepath, generate_vulnerabilities)
+              start_advisory_sync_worker(gitlab)
+            end
+
+            def generate_vulnerabilities
+              template = File.read(File.expand_path('../../../../../../fixtures/cvs/vulnerabilities_template.erb', __dir__))
+              ERB.new(template).result(binding)
+            end
+
+            def generate_filepath
+              File.join(
+                "/opt/gitlab/embedded/service/gitlab-rails/vendor/package_metadata/advisories/v2/rubygem/#{Time.now.to_i}",
+                '000000000.ndjson'
+              )
+            end
+
+            def write_vulnerabilities(gitlab, filepath, content)
+              gitlab.docker.exec(gitlab.name, "mkdir -p #{File.dirname(filepath)}")
+              gitlab.docker.write_files(gitlab.name) { |f| f.write(filepath, content, false) }
+            end
+
+            def start_advisory_sync_worker(gitlab)
+              gitlab.docker.exec(gitlab.name, "PM_SYNC_IN_DEV=true gitlab-rails runner 'loop do PackageMetadata::AdvisoriesSyncWorker.new.perform; sleep 30; end' &")
+            end
+
+            def run_specs(gitlab, *rspec_args)
+              Runtime::Logger.info('Running Continuous Vulnerability Scanning spec...')
+              rspec_args << "--" unless rspec_args.include?('--')
+              rspec_args << "--tag" << @tag
+              run_spec_component(gitlab, rspec_args)
+            end
+
+            def run_spec_component(gitlab, rspec_args)
+              Component::Specs.perform do |specs|
+                specs.suite = 'Test::Instance::All'
+                specs.release = gitlab.release
+                specs.network = gitlab.network
+                specs.args = [gitlab.address, *rspec_args]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '14.14.0'
+    VERSION = '14.16.0'
   end
 end

data/rubocop/cop/gitlab/dangerous_interpolation.rb

@@ -95,6 +95,7 @@ module RuboCop
           'CI_PIPELINE_URL' => :ci_pipeline_url,
           'CI_PIPELINE_CREATED_AT' => :ci_pipeline_created_at,
           'CI_MERGE_REQUEST_IID' => :ci_merge_request_iid,
+          'COVERBAND_ENABLED' => :coverband_enabled,
           'GITLAB_CI' => :gitlab_ci,
           'ELASTIC_URL' => :elastic_url,
           'GITLAB_QA_LOOP_RUNNER_MINUTES' => :gitlab_qa_loop_runner_minutes,

data/support/data/admin_access_token_seed.rb

@@ -18,7 +18,7 @@ class AdminAccessTokenSeed
 
     admin_user.personal_access_tokens.build(token_params).tap do |pat|
       pat.set_token(TOKEN_VALUE)
-      pat.organization = Organizations::Organization.default_organization
+      pat.organization = Organizations::Organization.default_organization if Gitlab.version_info >= Gitlab::VersionInfo.new(17, 4)
       pat.save!
     end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 14.14.0
+  version: 14.16.0
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2024-09-11 00:00:00.000000000 Z
+date: 2024-09-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control
@@ -376,6 +376,7 @@ files:
 - docs/waits.md
 - docs/what_tests_can_be_run.md
 - exe/gitlab-qa
+- fixtures/cvs/vulnerabilities_template.erb
 - fixtures/ldap/1_add_nodes.ldif
 - fixtures/ldap/2_add_users.ldif
 - fixtures/ldap/3_add_groups.ldif
@@ -450,6 +451,7 @@ files:
 - lib/gitlab/qa/scenario/test/integration/ai_gateway_no_seat_assigned.rb
 - lib/gitlab/qa/scenario/test/integration/chaos.rb
 - lib/gitlab/qa/scenario/test/integration/client_ssl.rb
+- lib/gitlab/qa/scenario/test/integration/continuous_vulnerability_scanning.rb
 - lib/gitlab/qa/scenario/test/integration/elasticsearch.rb
 - lib/gitlab/qa/scenario/test/integration/geo.rb
 - lib/gitlab/qa/scenario/test/integration/gitaly_cluster.rb