@conterra/vuln-scan 0.0.35 → 0.1.0

package/dist/schema/jira-config-schema.json

@@ -0,0 +1,94 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "jira-config-schema.json",
+  "title": "JiraConfig",
+  "description": "Configuration file (jira.json) for the ct-vuln-jira-report tool. Defines how vulnerabilities from a scan-summary.json are routed to Jira projects.",
+  "type": "object",
+  "required": ["jiraUrl", "issues"],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "Optional reference to the JSON Schema used to validate this file.",
+      "type": "string"
+    },
+    "jiraUrl": {
+      "description": "Base URL of the Jira instance. Example: \"https://myorg.atlassian.net\"",
+      "type": "string",
+      "format": "uri"
+    },
+    "issues": {
+      "description": "List of routing rules that map scan project identifiers to target Jira projects.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "$ref": "#/$defs/JiraIssueConfig"
+      }
+    }
+  },
+  "$defs": {
+    "JiraIssueConfig": {
+      "description": "A single routing rule: vulnerabilities affecting any of the listed project patterns will create an issue in the given Jira project.",
+      "type": "object",
+      "required": ["jiraProject", "issueType", "reportProjects"],
+      "additionalProperties": false,
+      "properties": {
+        "jiraProject": {
+          "description": "Jira project key where issues will be created, e.g. \"PLATFORM\".",
+          "type": "string"
+        },
+        "issueType": {
+          "description": "Jira issue type name, e.g. \"Bug\", \"CVE\" or \"Task\".",
+          "type": "string"
+        },
+        "issueLabels": {
+          "description": "Global Jira labels applied to every issue created by this rule, regardless of addToBoard matching. Merged with any labels from matching addToBoard entries. Example: [\"security\", \"cve\"].",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "addToBoard": {
+          "description": "Per-board routing rules. Each entry can target a Scrum sprint board (via sprintBoardId) and/or add labels for Kanban board routing. Sprint assignment: the first matching entry with a sprintBoardId wins; subsequent matching sprint entries and their labels are ignored. Kanban entries (no sprintBoardId) always contribute their labels.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/BoardConfig"
+          }
+        },
+        "reportProjects": {
+          "description": "Glob patterns for project identifiers (name@version) whose vulnerabilities should be routed to this Jira project. Use \"*\" to match any string. Examples: \"mapapps@*\", \"smartfinder@4.*\", \"*\".",
+          "type": "array",
+          "minItems": 1,
+          "items": {
+            "type": "string",
+            "description": "Glob pattern for a project identifier. Example: \"mapapps@*\""
+          }
+        }
+      }
+    },
+    "BoardConfig": {
+      "description": "Per-board routing rule within addToBoard. Controls which projects activate this entry, whether to assign the issue to an active Scrum sprint, and which labels to attach.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "sprintBoardId": {
+          "description": "Jira Scrum board ID. When set, the issue is assigned to the currently active sprint of that board. Omit for Kanban boards (routing is handled by Jira's board JQL filter).",
+          "type": "integer"
+        },
+        "issueLabels": {
+          "description": "Labels to attach when this entry matches. For sprint entries: included only if this is the first matching sprint entry. For Kanban entries (no sprintBoardId): always aggregated.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "matchProjects": {
+          "description": "Glob patterns for project identifiers (name@version) that activate this board entry. Defaults to [\"*\"] when omitted (matches any project). Example: [\"mapapps@*\", \"smartfinder@4.*\"].",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  }
+}

package/dist/schema/summary-schema.json

@@ -0,0 +1,156 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "summary-schema.json",
+  "title": "ScanSummary",
+  "description": "Output schema for the CVE vulnerability scan summary (scan-summary.json)",
+  "type": "object",
+  "required": [
+    "errors",
+    "vulnerabilities",
+    "vulnerabilityToProject",
+    "projectToVulnerability",
+    "projectsToComponents",
+    "noLongerDetectedVulnerabilities"
+  ],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "Optional reference to the JSON Schema used to validate this file.",
+      "type": "string"
+    },
+    "errors": {
+      "description": "Scan errors that occurred per project during the scan run.",
+      "type": "array",
+      "items": {
+        "$ref": "#/$defs/ProjectError"
+      }
+    },
+    "vulnerabilities": {
+      "description": "Map of CVE/vulnerability ID to its details. Only covers newly detected vulnerabilities.",
+      "type": "object",
+      "additionalProperties": {
+        "$ref": "#/$defs/ShortVulnInfo"
+      }
+    },
+    "vulnerabilityToProject": {
+      "description": "Map of CVE/vulnerability ID to the list of affected project identifiers (name@version).",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    },
+    "projectToVulnerability": {
+      "description": "Map of project identifier (name@version) to the list of CVE/vulnerability IDs detected in that project.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    },
+    "projectsToComponents": {
+      "description": "Map of project identifier (name@version) to a map of component purl to its reverse dependency tree node. Contains the component usage trees for all vulnerable components per project.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "object",
+        "additionalProperties": {
+          "$ref": "#/$defs/ComponentNode"
+        }
+      }
+    },
+    "noLongerDetectedVulnerabilities": {
+      "description": "Map of CVE/vulnerability ID to the list of project identifiers (name@version) where the vulnerability was declared but is no longer detected.",
+      "type": "object",
+      "additionalProperties": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      }
+    }
+  },
+  "$defs": {
+    "Severity": {
+      "description": "Severity level of a vulnerability.",
+      "type": "string",
+      "enum": ["UNKNOWN", "LOW", "MEDIUM", "HIGH", "CRITICAL"]
+    },
+    "ComponentNode": {
+      "description": "A node in the reverse dependency tree identifying a component by its purl.",
+      "type": "object",
+      "required": ["purl", "usedBy"],
+      "additionalProperties": false,
+      "properties": {
+        "purl": {
+          "description": "Package URL (purl) of the component.",
+          "type": "string"
+        },
+        "usedBy": {
+          "description": "Components that depend on this component. An empty array means this is a root/direct dependency.",
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/ComponentNode"
+          }
+        }
+      }
+    },
+    "ShortVulnInfo": {
+      "description": "Condensed vulnerability information for a single CVE/vulnerability.",
+      "type": "object",
+      "required": ["id", "severity", "title", "description", "components", "refs"],
+      "additionalProperties": false,
+      "properties": {
+        "id": {
+          "description": "Unique identifier of the vulnerability (e.g. CVE-2024-12345).",
+          "type": "string"
+        },
+        "severity": {
+          "$ref": "#/$defs/Severity"
+        },
+        "title": {
+          "description": "Short human-readable title of the vulnerability.",
+          "type": "string"
+        },
+        "description": {
+          "description": "Detailed description of the vulnerability.",
+          "type": "string"
+        },
+        "components": {
+          "description": "List of affected component purls.",
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "refs": {
+          "description": "List of reference URLs (advisories, NVD entries, etc.).",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "format": "uri"
+          }
+        }
+      }
+    },
+    "ProjectError": {
+      "description": "An error that occurred while scanning a specific project.",
+      "type": "object",
+      "required": ["project", "error"],
+      "additionalProperties": false,
+      "properties": {
+        "project": {
+          "description": "Project identifier in the form name@version.",
+          "type": "string"
+        },
+        "error": {
+          "description": "Error message describing what went wrong during the scan.",
+          "type": "string"
+        }
+      }
+    }
+  }
+}