@conterra/vuln-scan 0.0.35 → 0.0.36

package/dist/schema/jira-config-schema.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "jira-config-schema.json",
+  "title": "JiraConfig",
+  "description": "Configuration file (jira.json) for the ct-vuln-jira-report tool. Defines how vulnerabilities from a scan-summary.json are routed to Jira projects.",
+  "type": "object",
+  "required": ["jiraUrl", "issues"],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "Optional reference to the JSON Schema used to validate this file.",
+      "type": "string"
+    },
+    "jiraUrl": {
+      "description": "Base URL of the Jira instance. Example: \"https://myorg.atlassian.net\"",
+      "type": "string",
+      "format": "uri"
+    },
+    "issues": {
+      "description": "List of routing rules that map scan project identifiers to target Jira projects.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/JiraIssueConfig"
+      }
+    }
+  },
+  "$defs": {
+    "JiraIssueConfig": {
+      "description": "A single routing rule: vulnerabilities affecting any of the listed project patterns will create an issue in the given Jira project.",
+      "type": "object",
+      "required": ["jiraProject", "issueType", "reportProjects"],
+      "additionalProperties": false,
+      "properties": {
+        "jiraProject": {
+          "description": "Jira project key where issues will be created, e.g. \"PLATFORM\".",
+          "type": "string"
+        },
+        "issueType": {
+          "description": "Jira issue type name, e.g. \"Bug\", \"CVE\" or \"Task\".",
+          "type": "string"
+        },
+        "issueLabels": {
+          "description": "Optional list of Jira labels to apply to every issue created by this rule. Example: [\"security\", \"cve\"].",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "boardId": {
+          "description": "Jira Scrum board ID. Required when assignToActiveSprint is true. Used to look up the currently active sprint via the Jira Agile API.",
+          "type": "integer"
+        },
+        "assignToActiveSprint": {
+          "description": "When true and boardId is set, the created issue is assigned to the currently active sprint of that board. If no active sprint is found the issue is still created without a sprint assignment.",
+          "type": "boolean",
+          "default": false
+        },
+        "reportProjects": {
+          "description": "Glob patterns for project identifiers (name@version) whose vulnerabilities should be routed to this Jira project. Use \"*\" to match any string. Examples: \"mapapps@*\", \"smartfinder@4.*\", \"*\".",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "description": "Glob pattern for a project identifier. Example: \"mapapps@*\""
+          }
+        }
+      }
+    }
+  }
+}

package/dist/schema/summary-schema.json

@@ -0,0 +1,152 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "summary-schema.json",
+  "title": "ScanSummary",
+  "description": "Output schema for the CVE vulnerability scan summary (scan-summary.json)",
+  "type": "object",
+  "required": [
+    "errors",
+    "vulnerabilities",
+    "vulnerabilityToProject",
+    "projectToVulnerability",
+    "noLongerDetectedVulnerabilities"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "Optional reference to the JSON Schema used to validate this file.",
+      "type": "string"
+    },
+    "errors": {
+      "description": "Scan errors that occurred per project during the scan run.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/ProjectError"
+      }
+    },
+    "vulnerabilities": {
+      "description": "Map of CVE/vulnerability ID to its details. Only covers newly detected vulnerabilities.",
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/ShortVulnInfo"
+      }
+    },
+    "vulnerabilityToProject": {
+      "description": "Map of CVE/vulnerability ID to the list of affected project identifiers (name@version).",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    },
+    "projectToVulnerability": {
+      "description": "Map of project identifier (name@version) to the list of CVE/vulnerability IDs detected in that project.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    },
+    "noLongerDetectedVulnerabilities": {
+      "description": "Map of CVE/vulnerability ID to the list of project identifiers (name@version) where the vulnerability was declared but is no longer detected.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "Severity": {
+      "description": "Severity level of a vulnerability.",
+      "type": "string",
+      "enum": ["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]
+    },
+    "ComponentNode": {
+      "description": "A node in the reverse dependency tree identifying a component by its purl.",
+      "type": "object",
+      "required": ["purl", "usedBy"],
+      "additionalProperties": false,
+      "properties": {
+        "purl": {
+          "description": "Package URL (purl) of the component.",
+          "type": "string"
+        },
+        "usedBy": {
+          "description": "Components that depend on this component. An empty array means this is a root/direct dependency.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ComponentNode"
+          }
+        }
+      }
+    },
+    "ShortVulnInfo": {
+      "description": "Condensed vulnerability information for a single CVE/vulnerability.",
+      "type": "object",
+      "required": ["id", "severity", "title", "description", "components", "componentTree", "refs"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "description": "Unique identifier of the vulnerability (e.g. CVE-2024-12345).",
+          "type": "string"
+        },
+        "severity": {
+          "$ref": "#/$defs/Severity"
+        },
+        "title": {
+          "description": "Short human-readable title of the vulnerability.",
+          "type": "string"
+        },
+        "description": {
+          "description": "Detailed description of the vulnerability.",
+          "type": "string"
+        },
+        "components": {
+          "description": "List of affected component purls.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "componentTree": {
+          "description": "Reverse dependency tree nodes showing how affected components are used.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ComponentNode"
+          }
+        },
+        "refs": {
+          "description": "List of reference URLs (advisories, NVD entries, etc.).",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uri"
+          }
+        }
+      }
+    },
+    "ProjectError": {
+      "description": "An error that occurred while scanning a specific project.",
+      "type": "object",
+      "required": ["project", "error"],
+      "additionalProperties": false,
+      "properties": {
+        "project": {
+          "description": "Project identifier in the form name@version.",
+          "type": "string"
+        },
+        "error": {
+          "description": "Error message describing what went wrong during the scan.",
+          "type": "string"
+        }
+      }
+    }
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@conterra/vuln-scan",
-  "version": "0.0.35",
+  "version": "0.0.36",
   "description": "con terra vulnerability scan process",
   "author": "con terra GmbH",
   "license": "Apache-2.0",
@@ -15,7 +15,8 @@
     "ct-vuln-add-vex": "dist/add-statement.js",
     "ct-vuln-add-project": "dist/add-project.js",
     "ct-vuln-remove-project": "dist/remove-project.js",
-    "ct-vuln-add-project-to-vex": "dist/add-project-to-vex.js"
+    "ct-vuln-add-project-to-vex": "dist/add-project-to-vex.js",
+    "ct-vuln-jira-report": "dist/jira-reporter.js"
   },
   "engines": {
     "node": ">= 20",
@@ -37,19 +38,19 @@
     "@types/escape-html": "1.0.4",
     "@types/sarif": "^2.1.7",
     "copyfiles": "2.4.1",
-    "esbuild": "0.27.2",
+    "esbuild": "0.27.3",
     "escape-html": "1.0.3",
-    "eslint-plugin-headers": "1.3.3",
+    "eslint-plugin-headers": "1.3.4",
     "eslint": "^9.39.1",
     "globals": "17.3.0",
     "json-schema-to-typescript": "15.0.4",
     "node-sarif-builder": "3.4.0",
     "prettier": "^3.8.1",
-    "rimraf": "6.1.2",
+    "rimraf": "6.1.3",
     "typescript": "5.9.3",
-    "typescript-eslint": "8.54.0",
+    "typescript-eslint": "8.56.1",
     "vitest": "4.0.18",
-    "@inquirer/prompts": "8.2.0"
+    "@inquirer/prompts": "8.3.0"
   },
   "scripts": {
     "full-build": "pnpm run clean && pnpm run type-check && pnpm run lint && pnpm run prod",