@aikidosec/ci-api-client 1.0.18 → 1.0.19

package/lib/index.js

@@ -6,6 +6,7 @@ import apiKey from './commands/apiKey.js';
 import scan from './commands/scan.js';
 import scanRelease from './commands/scanRelease.js';
 import upload from './commands/upload.js';
+import uploadCoverage from './commands/uploadCoverage.js';
 dotenv.config(process.env.NODE_ENV ? { path: `.env.${process.env.NODE_ENV}` } : {});
 export const program = new Command();
 program
@@ -16,6 +17,7 @@ apiKey.cliSetup(program);
 scan.cliSetup(program);
 scanRelease.cliSetup(program);
 upload.cliSetup(program);
+uploadCoverage.cliSetup(program);
 program
     .option('-q, --quiet', 'Disable console output when executing commands')
     .on('option:quiet', function () {

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@aikidosec/ci-api-client",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@aikidosec/ci-api-client",
-      "version": "1.0.18",
+      "version": "1.0.19",
       "license": "MIT",
       "dependencies": {
         "axios": "1.18.0",
@@ -14,6 +14,7 @@
         "commander": "11.0.0",
         "configstore": "6.0.0",
         "dotenv": "16.3.1",
+        "ignore": "7.0.8",
         "ora": "6.3.1"
       },
       "bin": {
@@ -780,6 +781,15 @@
       ],
       "license": "BSD-3-Clause"
     },
+    "node_modules/ignore": {
+      "version": "7.0.8",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.8.tgz",
+      "integrity": "sha512-YYNsSlXBjMk92SKnkwvB5LOVSa6OznlFUGcsvrFgNJbJCd0M1XKeFVRc8ZByeCqz32FivYNHJVooLmdqrmvp/Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 4"
+      }
+    },
     "node_modules/ignore-by-default": {
       "version": "1.0.1",
       "dev": true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aikidosec/ci-api-client",
-  "version": "1.0.18",
+  "version": "1.0.19",
   "description": "CLI api client to easily integrate the Aikido public CI API into custom deploy scripts",
   "license": "MIT",
   "author": "Bert Devriese <bert@builtinbruges.com>",
@@ -30,6 +30,7 @@
     "commander": "11.0.0",
     "configstore": "6.0.0",
     "dotenv": "16.3.1",
+    "ignore": "7.0.8",
     "ora": "6.3.1"
   },
   "devDependencies": {

package/src/aikidoApi.ts

@@ -1,4 +1,5 @@
 import axios from 'axios';
+import { gzipSync } from 'node:zlib';
 import { getApiKey } from './configuration.js';
 import { outputDebug } from './output.js';
 
@@ -186,3 +187,61 @@ export async function uploadCustomScanResult(
 
   return resultData;
 }
+// #endregion
+
+// #region Upload code coverage
+export type TUploadCodeCoverageFile = {
+  filename: string;
+  format: 'lcov' | 'cobertura';
+  content: string;
+};
+
+export type TUploadCodeCoverageOptions = {
+  repository_id: string | number;
+  repo_name: string;
+  commit_sha: string;
+  branch_name: string;
+  repository_source_paths: string[];
+  eof: Record<string, number>;
+  files: TUploadCodeCoverageFile[];
+};
+
+
+export async function uploadCodeCoverage(data: TUploadCodeCoverageOptions){
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/code_coverage`;
+  const requestConfig = {
+    method: 'POST',
+    data: {
+      repository_id: data.repository_id,
+      repo_name: data.repo_name,
+      commit_sha: data.commit_sha,
+      branch_name: data.branch_name,
+      repository_source_paths: data.repository_source_paths,
+      eof: data.eof,
+      files: data.files.map((file) => ({
+        filename: file.filename,
+        format: file.format,
+        content: gzipSync(file.content).toString('base64'),
+      })),
+    },
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug({
+    ...requestConfig,
+    data: {
+      ...requestConfig.data,
+      files: requestConfig.data.files.map((file) => ({
+        filename: file.filename,
+        format: file.format,
+        content: `[base64 gzip, ${file.content.length} chars]`,
+      })),
+    },
+  });
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}

package/src/codeCoverage/collectUploadPayload.ts

@@ -0,0 +1,93 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import { validateFilePath } from './paths.js';
+import { loadProjectFiles } from './projectFiles.js';
+import {
+  TCoverageFormat,
+  detectFormatFromFilename,
+  extractCoveredSourcePaths,
+} from './reportPaths.js';
+import { loadSourceLineFixes } from './sourceLineFixes.js';
+
+export type TCoverageFilePayload = {
+  filename: string;
+  format: TCoverageFormat;
+  content: string;
+};
+
+export type TCollectUploadPayloadResult = {
+  repository_source_paths: string[];
+  eof: Record<string, number>;
+  files: TCoverageFilePayload[];
+};
+
+/**
+ * Read coverage files and collect repository_source_paths + EOF metadata
+ * for backend processing. Mirrors AikidoSec/code-coverage-github-action.
+ */
+export async function collectUploadPayload(
+  filePaths: string[]
+): Promise<TCollectUploadPayloadResult> {
+  if (filePaths.length === 0) {
+    throw new Error(
+      'No code coverage file(s) provided. Specify at least one path.'
+    );
+  }
+
+  const project = await loadProjectFiles();
+  if (!project || project.files.length === 0) {
+    throw new Error(
+      'No source files found in this repository. ' +
+        'Run this command from a checked-out repository before uploading coverage.'
+    );
+  }
+
+  const repositoryRoot = project.root;
+  const files: TCoverageFilePayload[] = [];
+  const coveredPaths = new Set<string>();
+
+  for (const inputPath of filePaths) {
+    validateFilePath(inputPath);
+    
+    const absolutePath = path.resolve(inputPath);
+    const stats = await fs.lstat(absolutePath);
+    const realPath = await fs.realpath(absolutePath);
+    const relativePath = path.relative(repositoryRoot, realPath);
+    if (
+      stats.isSymbolicLink() ||
+      !stats.isFile() ||
+      relativePath.startsWith('..') ||
+      path.isAbsolute(relativePath)
+    ) {
+      throw new Error(
+        `Coverage file must be a regular file inside the repository: ${inputPath}`
+      );
+    }
+    const content = await fs.readFile(realPath, 'utf8');
+    const format = detectFormatFromFilename(inputPath);
+
+    for (const sourcePath of extractCoveredSourcePaths(content, format, repositoryRoot)) {
+      coveredPaths.add(sourcePath);
+    }
+
+    files.push({
+      filename: path.posix.basename(inputPath.replace(/\\/g, '/')),
+      format,
+      content,
+    });
+  }
+
+  const eof: Record<string, number> = {};
+  for (const sourcePath of coveredPaths) {
+    const fixes = await loadSourceLineFixes(repositoryRoot, sourcePath);
+    if (fixes?.eof != null) {
+      eof[sourcePath] = fixes.eof;
+    }
+  }
+
+  return {
+    repository_source_paths: project.files,
+    eof,
+    files,
+  };
+}

package/src/codeCoverage/paths.ts

@@ -0,0 +1,62 @@
+import path from 'node:path';
+
+/**
+ * Validate that a file path is safe to read.
+ * Rejects absolute paths and paths containing '..' segments to prevent
+ * directory traversal and arbitrary file access.
+ */
+export function validateFilePath(filePath: string): void {
+  if (filePath.includes('..') || isAbsoluteSourcePath(filePath)) {
+    throw new Error(
+      'Invalid file path: absolute paths and ".." segments are not allowed'
+    );
+  }
+}
+
+export function isAbsoluteSourcePath(sourcePath: string): boolean {
+  const trimmedPath = sourcePath.trim();
+  const pathInput = normalizePathSeparators(trimmedPath);
+
+  const windowsPath =
+    /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+    trimmedPath.startsWith('\\\\') ||
+    trimmedPath.startsWith('//');
+  const pathApi = windowsPath ? path.win32 : path.posix;
+
+  return pathApi.isAbsolute(pathInput);
+}
+
+/** Trim, use forward slashes, drop a leading `./`. */
+export function normalizePathSeparators(sourcePath: string): string {
+  return sourcePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+export function normalizeSourcePath(
+  sourcePath: string,
+  repositoryRoot: string
+): string {
+  const trimmedPath = sourcePath.trim();
+  const pathInput = normalizePathSeparators(trimmedPath);
+
+  const windowsPath =
+    /^[a-zA-Z]:[\\/]/.test(trimmedPath) ||
+    trimmedPath.startsWith('\\\\') ||
+    trimmedPath.startsWith('//');
+  const pathApi = windowsPath ? path.win32 : path.posix;
+  const absolutePath = pathApi.isAbsolute(pathInput);
+  const normalizedPath = absolutePath
+    ? pathApi.relative(repositoryRoot, pathInput)
+    : pathInput;
+
+  if (
+    absolutePath &&
+    (!normalizedPath ||
+      normalizedPath === '..' ||
+      normalizedPath.startsWith(`..${pathApi.sep}`) ||
+      pathApi.isAbsolute(normalizedPath))
+  ) {
+    throw new Error(`Invalid source path outside the repository: ${sourcePath}`);
+  }
+
+  return normalizePathSeparators(normalizedPath);
+}

package/src/codeCoverage/projectFiles.ts

@@ -0,0 +1,342 @@
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import ignore, { Ignore } from 'ignore';
+
+// Always skip these, even if .gitignore does not list them.
+const HARDCODED_IGNORES = [
+  '.git/',
+  'node_modules/',
+  'vendor/',
+  'coverage/',
+  'dist/',
+  'build/',
+  '.venv/',
+  'venv/',
+  '__pycache__/',
+  '.eggs/',
+  '*.egg-info/',
+  '.tox/',
+  '.mypy_cache/',
+  '.pytest_cache/',
+  '.next/',
+  '.nuxt/',
+  '.turbo/',
+  '.cache/',
+  'bower_components/',
+  '*.png',
+  '*.gif',
+  '*.jpg',
+  '*.jpeg',
+  '*.webp',
+  '*.ico',
+  '*.woff',
+  '*.woff2',
+  '*.ttf',
+  '*.eot',
+  '*.mp4',
+  '*.mp3',
+  '.nyc_output/',
+  'jspm_packages/',
+  '.yarn/cache/',
+  '.pnpm-store/',
+  'target/', // Java/Rust
+  'Pods/', // Swift
+];
+
+type TIgnoreStackEntry = {
+  base: string;
+  ig: Ignore;
+};
+
+export type TProjectFiles = {
+  root: string;
+  files: string[];
+};
+
+// Walk the repo and return relative file paths, applying hardcoded ignores + .gitignore.
+export async function loadProjectFiles(): Promise<TProjectFiles | null> {
+  const root = await findGitRoot(process.cwd());
+  const ignoreManager = ignore().add(HARDCODED_IGNORES);
+
+  try {
+    ignoreManager.add(await fs.readFile(path.join(root, '.gitignore'), 'utf8'));
+  } catch {
+    // No root .gitignore — hardcoded rules still apply.
+  }
+
+  const files: string[] = [];
+  await collectFiles(root, '', [{ base: '', ig: ignoreManager }], files);
+
+  const projectFiles = files.filter(isLikelySourceFile);
+  return projectFiles.length === 0 ? null : { root, files: projectFiles };
+}
+
+async function findGitRoot(startDir: string): Promise<string> {
+  const start = path.resolve(startDir);
+  let dir = start;
+
+  while (path.dirname(dir) !== dir) {
+    try {
+      await fs.access(path.join(dir, '.git'));
+      return dir;
+    } catch {
+      dir = path.dirname(dir);
+    }
+  }
+
+  try {
+    await fs.access(path.join(dir, '.git'));
+    return dir;
+  } catch {
+    return start;
+  }
+}
+
+// Skip coverage report files and .gitignore — not useful as source matches.
+// Not in HARDCODED_IGNORES because these often live at the repo root and are not gitignored.
+function isLikelySourceFile(relativePath: string): boolean {
+  const base = relativePath.slice(relativePath.lastIndexOf('/') + 1);
+  const lower = base.toLowerCase();
+
+  if (
+    lower === '.gitignore' ||
+    lower.endsWith('.lcov') ||
+    lower === 'lcov.info' ||
+    (lower.endsWith('.info') && lower.includes('lcov')) ||
+    lower === 'coverage-final.json' ||
+    lower === 'clover.xml' ||
+    lower === 'cobertura.xml' ||
+    (lower.endsWith('.xml') && lower.includes('cobertura'))
+  ) {
+    return false;
+  }
+
+  return true;
+}
+
+// Recursively list files. ignoreStack is root → nested .gitignore rules for this path.
+async function collectFiles(
+  absoluteDir: string,
+  relativeDir: string,
+  ignoreStack: TIgnoreStackEntry[],
+  files: string[]
+): Promise<void> {
+  let stack = ignoreStack;
+
+  if (relativeDir) {
+    try {
+      const nested = ignore().add(
+        await fs.readFile(path.join(absoluteDir, '.gitignore'), 'utf8')
+      );
+      stack = [...ignoreStack, { base: relativeDir, ig: nested }];
+    } catch {
+      // No nested .gitignore for this directory.
+    }
+  }
+
+  let entries;
+  try {
+    entries = await fs.readdir(absoluteDir, { withFileTypes: true });
+  } catch {
+    return;
+  }
+
+  for (const entry of entries) {
+    const relativePath = relativeDir
+      ? `${relativeDir}/${entry.name}`
+      : entry.name;
+
+    if (isIgnored(relativePath, entry.isDirectory(), stack)) {
+      continue;
+    }
+
+    if (entry.isDirectory()) {
+      await collectFiles(
+        path.join(absoluteDir, entry.name),
+        relativePath,
+        stack,
+        files
+      );
+    } else if (entry.isFile() || entry.isSymbolicLink()) {
+      files.push(relativePath);
+    }
+  }
+}
+
+// Git last-match: walk root → nested; a later matching rule (including !negation) wins.
+function isIgnored(
+  relativePath: string,
+  isDirectory: boolean,
+  stack: TIgnoreStackEntry[]
+): boolean {
+  let ignored = false;
+
+  for (const { base, ig } of stack) {
+    const testPath = base ? relativePath.slice(base.length + 1) : relativePath;
+
+    if (!testPath) {
+      continue;
+    }
+
+    const result = ignoreDecision(ig, testPath, isDirectory);
+
+    if (result.ignored) {
+      ignored = true;
+    } else if (result.unignored) {
+      ignored = false;
+    }
+  }
+
+  return ignored;
+}
+
+// Directory patterns end with "/"; node-ignore treats "foo" as a file unless we also test "foo/".
+function ignoreDecision(
+  ig: Ignore,
+  testPath: string,
+  isDirectory: boolean
+): { ignored: boolean; unignored: boolean } {
+  const result = ig.test(testPath);
+
+  if (isDirectory) {
+    const directoryResult = ig.test(`${testPath}/`);
+    if (directoryResult.ignored || directoryResult.unignored) {
+      return directoryResult;
+    }
+  }
+
+  return result;
+}
+
+// Drop the file extension: "src/foo.ts" → "src/foo".
+export function pathStem(sourcePath: string): string {
+  const lastSlashIndex = sourcePath.lastIndexOf('/');
+  const lastDotIndex = sourcePath.lastIndexOf('.');
+
+  if (lastDotIndex > lastSlashIndex) {
+    return sourcePath.slice(0, lastDotIndex);
+  }
+
+  return sourcePath;
+}
+
+function normalizePath(filePath: string): string {
+  return filePath.trim().replace(/\\/g, '/').replace(/^\.\//, '');
+}
+
+// True if paths are equal, or one ends with the other after a "/".
+// e.g. "app/src/util.js" matches "src/util.js"; "src/utils.js" does not match "util.js".
+function isSamePathOrSuffix(fullPath: string, possibleSuffix: string): boolean {
+  const normalizedFullPath = fullPath.toLowerCase();
+  const suffix = possibleSuffix.toLowerCase();
+  return (
+    normalizedFullPath === suffix ||
+    normalizedFullPath.endsWith(`/${suffix}`)
+  );
+}
+
+// Count matching segments from the end: "x/a/b.js" and "y/a/b.js" → 2.
+// needed for picking the best match when there are multiple candidates
+function countSharedTrailingSegments(
+  leftPath: string,
+  rightPath: string
+): number {
+  const leftSegments = leftPath.toLowerCase().split('/');
+  const rightSegments = rightPath.toLowerCase().split('/');
+  const maxShared = Math.min(leftSegments.length, rightSegments.length);
+  let sharedCount = 0;
+
+  while (
+    sharedCount < maxShared &&
+    leftSegments[leftSegments.length - 1 - sharedCount] ===
+      rightSegments[rightSegments.length - 1 - sharedCount]
+  ) {
+    sharedCount++;
+  }
+
+  return sharedCount;
+}
+
+// Prefer more shared trailing segments, then the shorter path. Tie → null (ambiguous).
+// needed for picking the best match when there are multiple candidates
+function pickBestMatch(
+  coveragePath: string,
+  candidates: string[]
+): string | null {
+  let best: string | null = null;
+  let bestShared = -1;
+  let bestLength = Infinity;
+  let ambiguous = false;
+
+  for (const candidate of candidates) {
+    const shared = countSharedTrailingSegments(coveragePath, candidate);
+
+    if (
+      shared > bestShared ||
+      (shared === bestShared && candidate.length < bestLength)
+    ) {
+      best = candidate;
+      bestShared = shared;
+      bestLength = candidate.length;
+      ambiguous = false;
+    } else if (shared === bestShared && candidate.length === bestLength) {
+      ambiguous = true;
+    }
+  }
+
+  return ambiguous ? null : best;
+}
+
+// Map a coverage report path (LCOV SF:) to a real project file. No match → null (drop it).
+export function createPathResolver(
+  projectFiles: string[]
+): (coveragePath: string) => string | null {
+  const byBasename = new Map<string, string[]>();
+
+  // group by basename
+  for (const projectPath of projectFiles) {
+    const key = projectPath
+      .slice(projectPath.lastIndexOf('/') + 1)
+      .toLowerCase();
+    const entries = byBasename.get(key);
+    if (entries) {
+      entries.push(projectPath);
+    } else {
+      byBasename.set(key, [projectPath]);
+    }
+  }
+
+  return (coveragePath: string) => {
+    const normalizedCoveragePath = normalizePath(coveragePath);
+    const key = normalizedCoveragePath
+      .slice(normalizedCoveragePath.lastIndexOf('/') + 1)
+      .toLowerCase();
+
+    // find all files with the same basename
+    const candidates = byBasename.get(key) ?? [];
+
+    // filter by path suffix
+    const matches = candidates.filter(
+      (projectPath) =>
+        isSamePathOrSuffix(projectPath, normalizedCoveragePath) ||
+        isSamePathOrSuffix(normalizedCoveragePath, projectPath)
+    );
+
+    if (matches.length === 0) {
+      return null;
+    }
+
+    const exactMatch = matches.find(
+      (projectPath) => projectPath === normalizedCoveragePath
+    );
+    if (exactMatch) {
+      return exactMatch;
+    }
+
+    if (matches.length === 1) {
+      return matches[0];
+    }
+
+    return pickBestMatch(normalizedCoveragePath, matches);
+  };
+}

package/src/codeCoverage/reportPaths.ts

@@ -0,0 +1,63 @@
+import { normalizePathSeparators, normalizeSourcePath } from './paths.js';
+
+export type TCoverageFormat = 'lcov' | 'cobertura';
+
+/**
+ * Detect coverage format from the report filename only.
+ */
+export function detectFormatFromFilename(filename: string): TCoverageFormat {
+  const lower = normalizePathSeparators(filename).toLowerCase();
+  const base = lower.slice(lower.lastIndexOf('/') + 1);
+
+  if (base.endsWith('.lcov') || base.endsWith('.info') || base.includes('lcov')) {
+    return 'lcov';
+  }
+
+  if (base.endsWith('.xml') || base.includes('cobertura')) {
+    return 'cobertura';
+  }
+
+  throw new Error(
+    `Could not detect coverage format from filename "${filename}". ` +
+      'Use a name like lcov.info, *.lcov, or *cobertura*.xml.'
+  );
+}
+
+/**
+ * Extract source file paths referenced in a coverage report (for EOF map).
+ */
+export function extractCoveredSourcePaths(
+  content: string,
+  format: TCoverageFormat,
+  repositoryRoot: string
+): string[] {
+  if (format === 'cobertura') {
+    return extractCoberturaFilenames(content, repositoryRoot);
+  }
+
+  return extractLcovFilenames(content, repositoryRoot);
+}
+
+function extractLcovFilenames(
+  content: string,
+  repositoryRoot: string
+): string[] {
+  return [...content.matchAll(/^SF:([^\r\n]+)$/gm)]
+    .map((match) => normalizeSourcePath(match[1], repositoryRoot))
+    .filter(Boolean);
+}
+
+function extractCoberturaFilenames(
+  content: string,
+  repositoryRoot: string
+): string[] {
+  const paths: string[] = [];
+  for (const match of content.matchAll(/\bfilename\s*=\s*"([^"]+)"/gi)) {
+    const normalized = normalizeSourcePath(match[1], repositoryRoot);
+    if (normalized) {
+      paths.push(normalized);
+    }
+  }
+
+  return paths;
+}