@aikidosec/ci-api-client 1.0.4 → 1.0.6

package/lib/commands/scanRelease.js

@@ -0,0 +1,182 @@
+import chalk from 'chalk';
+import { Argument, InvalidArgumentError, Option } from 'commander';
+import { pollScanStatus, startScan, } from '../aikidoApi.js';
+import { getApiKey } from '../configuration.js';
+import { outputError, outputHttpError, outputLog, startSpinner, } from '../output.js';
+async function cli(repoId, commitId, options, command) {
+    const apiKey = getApiKey();
+    if (!apiKey) {
+        outputError('Please set an api key using: aikido-cli apikey <key>');
+    }
+    const { apiOptions, cliOptions } = parseCliOptions(options);
+    let loader;
+    let pollCount = 1;
+    const onStart = () => {
+        loader = startSpinner('Starting Aikido Security release scan');
+    };
+    const onStartComplete = (startResult) => {
+        loader?.succeed(`Aikido Security scan started (id: ${startResult.scan_id})`);
+    };
+    const onNextPoll = () => {
+        if (loader) {
+            loader.text = `Polling for Aikido Security scan to complete (${pollCount})`;
+        }
+        pollCount += 1;
+    };
+    const onScanStart = () => {
+        loader = startSpinner('Waiting for scan to complete');
+    };
+    const onScanComplete = (pollResult) => {
+        if (pollResult.gate_passed === true) {
+            loader?.succeed('Scan completed, no open issues found');
+            if (pollResult.diff_url) {
+                outputLog(chalk.gray(`* Diff url: ${pollResult.diff_url}`));
+            }
+        }
+        else {
+            loader?.fail('Scan completed with issues');
+            if (pollResult.new_issues_found) {
+                outputLog(chalk.gray(chalk.bold('Open issues found: ') + pollResult.new_issues_found));
+            }
+            if (pollResult.issue_links) {
+                outputLog(chalk.gray(pollResult.issue_links
+                    .map((issueLink) => '- ' + issueLink)
+                    .join('\n')));
+            }
+            if (pollResult.diff_url) {
+                outputLog(chalk.gray(`* Diff url: ${pollResult.diff_url}`));
+            }
+            process.exit(10);
+        }
+    };
+    const onFail = (error) => {
+        loader?.fail();
+        if (error.response?.status && error.response?.status === 404) {
+            outputError('Please verify your commit SHA');
+        }
+        else {
+            outputHttpError(error);
+        }
+        process.exit(1);
+    };
+    await scan({
+        repoId,
+        commitId,
+        options: apiOptions,
+        pollInterval: cliOptions.pollInterval,
+        onStart,
+        onStartComplete,
+        onStartFail: onFail,
+        onNextPoll,
+        onScanStart,
+        onScanComplete,
+        onScanFail: onFail,
+    });
+}
+export const scan = async ({ repoId, commitId, options, pollInterval = 10, onStart, onStartComplete, onStartFail, onScanStart, onNextPoll, onScanComplete, onScanFail, }) => {
+    onStart?.();
+    let result = null;
+    try {
+        result = await startScan({
+            is_release_gating: true,
+            head_commit_id: commitId,
+            repository_id: repoId,
+            ...options,
+        });
+        if (result.scan_id) {
+            onStartComplete?.(result);
+        }
+        else {
+            onStartFail?.(result);
+            return;
+        }
+    }
+    catch (error) {
+        onStartFail?.(error);
+        return;
+    }
+    onScanStart?.(result);
+    let pollResult;
+    const pollStatus = async () => {
+        try {
+            pollResult = await pollScanStatus(result.scan_id);
+            if (pollResult.all_scans_completed === false) {
+                onNextPoll?.(pollResult);
+                setTimeout(pollStatus, pollInterval * 1000);
+            }
+            else {
+                onScanComplete?.(pollResult);
+            }
+        }
+        catch (error) {
+            onScanFail?.(error);
+        }
+    };
+    pollStatus();
+};
+const parseCliOptions = (userCliOptions) => {
+    const apiOptions = { version: '1.0.6' };
+    const cliOptions = { pollInterval: 10 };
+    if (userCliOptions.pullRequestTitle) {
+        apiOptions.pull_request_metadata = {
+            ...(apiOptions.pull_request_metadata ?? {}),
+            title: userCliOptions.pullRequestTitle,
+        };
+    }
+    if (userCliOptions.pullRequestUrl) {
+        apiOptions.pull_request_metadata = {
+            ...(apiOptions.pull_request_metadata ?? {}),
+            url: userCliOptions.pullRequestUrl,
+        };
+    }
+    if (userCliOptions.selfManagedScanners) {
+        apiOptions.self_managed_scanners = userCliOptions.selfManagedScanners;
+    }
+    if (userCliOptions.failOnDependencyScan != undefined) {
+        apiOptions.fail_on_dependency_scan = userCliOptions.failOnDependencyScan;
+    }
+    if (userCliOptions.failOnSastScan != undefined) {
+        apiOptions.fail_on_sast_scan = userCliOptions.failOnSastScan;
+    }
+    if (userCliOptions.failOnIacScan != undefined) {
+        apiOptions.fail_on_iac_scan = userCliOptions.failOnIacScan;
+    }
+    if (userCliOptions.failOnSecretsScan != undefined) {
+        apiOptions.fail_on_secrets_scan = userCliOptions.failOnSecretsScan;
+    }
+    if (userCliOptions.minimumSeverityLevel) {
+        apiOptions.minimum_severity = userCliOptions.minimumSeverityLevel;
+    }
+    if (userCliOptions.pollInterval &&
+        (isNaN(userCliOptions.pollInterval) || userCliOptions.pollInterval <= 0)) {
+        outputError('Please provide a valid poll interval');
+    }
+    else if (userCliOptions.pollInterval) {
+        cliOptions.pollInterval = userCliOptions.pollInterval;
+    }
+    return { apiOptions, cliOptions };
+};
+const validateCommitId = (value) => {
+    const testCommitId = (commitId) => commitId.length === 40 && /^[0-9a-f]{40}$/.test(commitId);
+    if (testCommitId(value) === false) {
+        throw new InvalidArgumentError('Please provide a valid commit ID');
+    }
+    return value;
+};
+export const cliSetup = (program) => program
+    .command('scan-release')
+    .addArgument(new Argument('<repository_id>', 'The internal GitHub/Gitlab/Bitbucket/.. repository id you want to scan.').argRequired())
+    .addArgument(new Argument('<commit_id>', 'The commit you want to scan')
+    .argRequired()
+    .argParser(validateCommitId))
+    .addOption(new Option('--no-fail-on-dependency-scan', "Don't fail when scanning depedencies..."))
+    .option('--fail-on-sast-scan', 'Let Aikido fail when new static code analysis issues have been detected...')
+    .option('--fail-on-iac-scan', 'Let Aikido fail when new infrastructure as code issues have been detected...')
+    .option('--fail-on-secrets-scan', 'Let Aikido fail when new exposed secrets have been detected...')
+    .addOption(new Option('--minimum-severity-level <level>', 'Set the minimum severity level. Accepted options are: LOW, MEDIUM, HIGH and CRITICAL.').choices(['LOW', 'MEDIUM', 'HIGH', 'CRITICAL']))
+    .addOption(new Option('--poll-interval [interval]', 'The poll interval when checking for an updated scan result')
+    .preset(10)
+    .argParser(parseFloat))
+    .description('Run a release scan of an Aikido repo.')
+    .action(cli);
+export default { cli, cliSetup, scan };

package/lib/index.js

@@ -4,15 +4,17 @@ import { Command } from 'commander';
 import dotenv from 'dotenv';
 import apiKey from './commands/apiKey.js';
 import scan from './commands/scan.js';
+import scanRelease from './commands/scanRelease.js';
 import upload from './commands/upload.js';
 dotenv.config(process.env.NODE_ENV ? { path: `.env.${process.env.NODE_ENV}` } : {});
 export const program = new Command();
 program
     .name('Aikido API Client')
     .description('CLI api client to easily integrate the Aikido public CI API into custom deploy scripts')
-    .version('1.0.4');
+    .version('1.0.6');
 apiKey.cliSetup(program);
 scan.cliSetup(program);
+scanRelease.cliSetup(program);
 upload.cliSetup(program);
 program
     .option('-q, --quiet', 'Disable console output when executing commands')

package/package.json

@@ -1,51 +1,51 @@
-{
-  "name": "@aikidosec/ci-api-client",
-  "version": "1.0.4",
-  "description": "CLI api client to easily integrate the Aikido public CI API into custom deploy scripts",
-  "license": "MIT",
-  "author": "Bert Devriese <bert@builtinbruges.com>",
-  "private": false,
-  "type": "module",
-  "main": "lib/index.js",
-  "bin": {
-    "aikido-api-client": "./lib/index.js"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/AikidoSec/api-client.git"
-  },
-  "scripts": {
-    "start": "nodemon --watch 'src/**/*.ts' --esm --exec 'ts-node' src/index.ts",
-    "build": "tsc -p .",
-    "local": "yarn build && yarn global add file:$PWD; aikido-api-client",
-    "local-rm": "yarn global remove aikido-api-client",
-    "format": "prettier --write 'src/**/*.ts'",
-    "//": {
-      "refresh": "rm -rf ./node_modules ./yarn.lock && yarn"
-    }
-  },
-  "dependencies": {
-    "axios": "^1.4.0",
-    "chalk": "^5.3.0",
-    "commander": "^11.0.0",
-    "configstore": "^6.0.0",
-    "dotenv": "^16.3.1",
-    "ora": "^6.3.1"
-  },
-  "devDependencies": {
-    "@types/chalk": "^2.2.0",
-    "@types/commander": "^2.12.2",
-    "@types/configstore": "^6.0.0",
-    "@types/dotenv": "^8.2.0",
-    "@types/node": "^20.3.3",
-    "nodemon": "^2.0.22",
-    "prettier": "^2.8.8",
-    "ts-node": "^10.9.1",
-    "typescript": "^5.1.6"
-  },
-  "keywords": [
-    "aikido",
-    "security",
-    "cli"
-  ]
-}
+{
+  "name": "@aikidosec/ci-api-client",
+  "version": "1.0.6",
+  "description": "CLI api client to easily integrate the Aikido public CI API into custom deploy scripts",
+  "license": "MIT",
+  "author": "Bert Devriese <bert@builtinbruges.com>",
+  "private": false,
+  "type": "module",
+  "main": "lib/index.js",
+  "bin": {
+    "aikido-api-client": "lib/index.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AikidoSec/ci-api-client.git"
+  },
+  "scripts": {
+    "start": "nodemon --watch 'src/**/*.ts' --esm --exec 'ts-node' src/index.ts",
+    "build": "tsc -p .",
+    "local": "yarn build && yarn global add file:$PWD; aikido-api-client",
+    "local-rm": "yarn global remove aikido-api-client",
+    "format": "prettier --write 'src/**/*.ts'",
+    "//": {
+      "refresh": "rm -rf ./node_modules ./yarn.lock && yarn"
+    }
+  },
+  "dependencies": {
+    "axios": "^1.4.0",
+    "chalk": "^5.3.0",
+    "commander": "^11.0.0",
+    "configstore": "^6.0.0",
+    "dotenv": "^16.3.1",
+    "ora": "^6.3.1"
+  },
+  "devDependencies": {
+    "@types/chalk": "^2.2.0",
+    "@types/commander": "^2.12.2",
+    "@types/configstore": "^6.0.0",
+    "@types/dotenv": "^8.2.0",
+    "@types/node": "^20.3.3",
+    "nodemon": "^2.0.22",
+    "prettier": "^2.8.8",
+    "ts-node": "^10.9.1",
+    "typescript": "^5.1.6"
+  },
+  "keywords": [
+    "aikido",
+    "security",
+    "cli"
+  ]
+}

package/src/aikidoApi.ts

@@ -1,148 +1,152 @@
-import axios from 'axios';
-import { getApiKey } from './configuration.js';
-import { outputDebug } from './output.js';
-
-const getApiUrl = () => process.env.AIKIDO_API || 'https://app.aikido.dev';
-const getApiHeaders = () => ({
-  'Content-Type': 'application/json',
-  'X-AIK-API-SECRET': getApiKey(),
-});
-
-// #region Scan start
-export type TScanApiOptions = {
-  repository_id?: string | number;
-  base_commit_id?: string;
-  head_commit_id?: string;
-  branch_name?: string;
-  pull_request_metadata?: {
-    title?: string;
-    url?: string;
-  };
-  self_managed_scanners?: string[];
-  fail_on_dependency_scan?: boolean;
-  fail_on_sast_scan?: boolean;
-  fail_on_iac_scan?: boolean;
-  minimum_severity?: string;
-  version: string;
-};
-
-export type TStartScanResult = {
-  scan_id: number;
-};
-
-// Start a scan with options (see: startScanSchema)
-// and return the data
-export async function startScan(
-  data: TScanApiOptions
-): Promise<TStartScanResult> {
-  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
-  const requestConfig = {
-    method: 'POST',
-    data,
-    headers: getApiHeaders(),
-  };
-
-  outputDebug(`API request: ${requestUrl}`);
-  outputDebug(requestConfig);
-
-  const resultData = (await axios(requestUrl, requestConfig)).data;
-  outputDebug(resultData);
-
-  return resultData;
-}
-// #endregion
-
-// #region Scan polling
-export type TPollIsScanningResult = {
-  all_scans_completed: boolean;
-  dependency_scan_completed: boolean;
-  sast_scan_completed: boolean;
-  iac_scan_completed: boolean;
-  sbom_scan_completed?: boolean;
-};
-
-type TPollScanCompletedOptions = {
-  gate_passed: boolean;
-};
-
-type TPollScanFeatureBranchCompletedOptions = {
-  new_issues_found: number;
-  new_dependency_issues_found: number;
-  new_sast_issues_found: number;
-  new_iac_issues_found: number;
-  diff_url: string;
-};
-
-type TPollScanDefaultBranchCompletedOptions = {
-  open_issues_found: number;
-  issue_links: string[];
-};
-
-export type TPollScanFeatureBranchCompletedResult = TPollIsScanningResult &
-  TPollScanCompletedOptions &
-  TPollScanFeatureBranchCompletedOptions;
-
-export type TPollScanCompletedDefaultBranchResult = TPollIsScanningResult &
-  TPollScanCompletedOptions &
-  TPollScanDefaultBranchCompletedOptions;
-
-export async function pollScanStatus(
-  scanId: number
-): Promise<
-  | TPollIsScanningResult
-  | TPollScanFeatureBranchCompletedResult
-  | TPollScanCompletedDefaultBranchResult
-> {
-  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
-  const requestConfig = {
-    method: 'GET',
-    params: { scan_id: scanId },
-    headers: getApiHeaders(),
-  };
-
-  outputDebug(`API request: ${requestUrl}`);
-  outputDebug(requestConfig);
-
-  const resultData = (await axios(requestUrl, requestConfig)).data;
-  outputDebug(resultData);
-
-  return resultData;
-}
-// #endregion
-
-// #region Upload custom result
-export enum TUploadPayloadType {
-  Checkov = 'checkov',
-  JsonSbom = 'json-sbom',
-}
-
-export type TUploadApiOptions = {
-  scan_id?: number;
-  repository_id: string | number;
-  container_image_name?: string;
-  payload_type: TUploadPayloadType;
-  payload: string;
-};
-
-export type TUploadResult = {
-  success: number;
-};
-
-export async function uploadCustomScanResult(
-  data: TUploadApiOptions
-): Promise<TUploadResult> {
-  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/custom`;
-  const requestConfig = {
-    method: 'POST',
-    data,
-    headers: getApiHeaders(),
-  };
-
-  outputDebug(`API request: ${requestUrl}`);
-  outputDebug(requestConfig);
-
-  const resultData = (await axios(requestUrl, requestConfig)).data;
-  outputDebug(resultData);
-
-  return resultData;
-}
+import axios from 'axios';
+import { getApiKey } from './configuration.js';
+import { outputDebug } from './output.js';
+
+const getApiUrl = () => process.env.AIKIDO_API || 'https://app.aikido.dev';
+const getApiHeaders = () => ({
+  'Content-Type': 'application/json',
+  'X-AIK-API-SECRET': getApiKey(),
+});
+
+// #region Scan start
+export type TScanApiOptions = {
+  repository_id?: string | number;
+  base_commit_id?: string;
+  head_commit_id?: string;
+  branch_name?: string;
+  pull_request_metadata?: {
+    title?: string;
+    url?: string;
+  };
+  self_managed_scanners?: string[];
+  fail_on_dependency_scan?: boolean;
+  fail_on_sast_scan?: boolean;
+  fail_on_iac_scan?: boolean;
+  fail_on_secrets_scan?: boolean;
+  minimum_severity?: string;
+  version: string;
+  is_release_gating?: boolean;
+};
+
+export type TStartScanResult = {
+  scan_id: number;
+};
+
+// Start a scan with options (see: startScanSchema)
+// and return the data
+export async function startScan(
+  data: TScanApiOptions
+): Promise<TStartScanResult> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
+  const requestConfig = {
+    method: 'POST',
+    data,
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}
+// #endregion
+
+// #region Scan polling
+export type TPollIsScanningResult = {
+  all_scans_completed: boolean;
+  dependency_scan_completed: boolean;
+  sast_scan_completed: boolean;
+  iac_scan_completed: boolean;
+  secrets_scan_completed: boolean;
+  sbom_scan_completed?: boolean;
+};
+
+type TPollScanCompletedOptions = {
+  gate_passed: boolean;
+};
+
+type TPollScanFeatureBranchCompletedOptions = {
+  new_issues_found: number;
+  new_dependency_issues_found: number;
+  new_sast_issues_found: number;
+  new_iac_issues_found: number;
+  new_leaked_secret_issues_found: number;
+  diff_url: string;
+};
+
+type TPollScanDefaultBranchCompletedOptions = {
+  open_issues_found: number;
+  issue_links: string[];
+};
+
+export type TPollScanFeatureBranchCompletedResult = TPollIsScanningResult &
+  TPollScanCompletedOptions &
+  TPollScanFeatureBranchCompletedOptions;
+
+export type TPollScanCompletedDefaultBranchResult = TPollIsScanningResult &
+  TPollScanCompletedOptions &
+  TPollScanDefaultBranchCompletedOptions;
+
+export async function pollScanStatus(
+  scanId: number
+): Promise<
+  | TPollIsScanningResult
+  | TPollScanFeatureBranchCompletedResult
+  | TPollScanCompletedDefaultBranchResult
+> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/repository`;
+  const requestConfig = {
+    method: 'GET',
+    params: { scan_id: scanId },
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}
+// #endregion
+
+// #region Upload custom result
+export enum TUploadPayloadType {
+  Checkov = 'checkov',
+  JsonSbom = 'json-sbom',
+}
+
+export type TUploadApiOptions = {
+  scan_id?: number;
+  repository_id: string | number;
+  container_image_name?: string;
+  payload_type: TUploadPayloadType;
+  payload: string;
+};
+
+export type TUploadResult = {
+  success: number;
+};
+
+export async function uploadCustomScanResult(
+  data: TUploadApiOptions
+): Promise<TUploadResult> {
+  const requestUrl = `${getApiUrl()}/api/integrations/continuous_integration/scan/custom`;
+  const requestConfig = {
+    method: 'POST',
+    data,
+    headers: getApiHeaders(),
+  };
+
+  outputDebug(`API request: ${requestUrl}`);
+  outputDebug(requestConfig);
+
+  const resultData = (await axios(requestUrl, requestConfig)).data;
+  outputDebug(resultData);
+
+  return resultData;
+}