@docupace/pipeline 1.0.118 → 1.0.120

package/.changeset/loud-coins-double.md

@@ -0,0 +1,5 @@
+---
+'@docupace/pipeline': patch
+---
+
+Fix to repo name for compliance edge

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @docupace/pipeline
 
+## 1.0.120
+
+### Patch Changes
+
+- 4729a56: Add JFrog Xray dependency security scan pipeline
+
 ## 1.0.112
 
 ### Patch Changes

package/bin/xray.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+BASENAME="${BITBUCKET_REPO_SLUG}"
+SLACK_API="https://slack.com/api/chat.postMessage"
+INPUT_TABLE="xray.txt"
+INPUT_JSON="xray.json"
+
+# ------------------------------------------------
+# 1️⃣ Parse table to JSON (handle multi-line wrapping)
+# ------------------------------------------------
+
+awk '
+BEGIN {
+  print "["
+  in_vuln = 0
+}
+
+# Skip separator and header lines
+/^[┌├└]/ { next }
+/CVE.*SEVERITY.*DIRECT.*DEPENDENCY/ { next }
+
+# Process data rows
+/^│/ {
+  gsub(/^│ /, "")
+  gsub(/ *│ *$/, "")
+
+  n = split($0, fields, / *│ */)
+
+  # New vulnerability (has CVE in first column)
+  if (n >= 8 && fields[1] ~ /^CVE-/) {
+    # Output previous entry if exists
+    if (in_vuln) {
+      # Parse fixed versions
+      fixed_versions = "[]"
+      if (saved_fixed_raw != "") {
+        gsub(/\] *\[/, "][", saved_fixed_raw)
+        gsub(/\[/, "\"", saved_fixed_raw)
+        gsub(/\]/, "\"", saved_fixed_raw)
+        gsub(/"  *"/, "\", \"", saved_fixed_raw)
+        gsub(/""/, "\", \"", saved_fixed_raw)
+        fixed_versions = "[" saved_fixed_raw "]"
+      }
+
+      component_key = saved_type "://" saved_affected
+      direct_component = saved_type "://" saved_direct
+
+      print "    {"
+      print "      \"vulnerabilities\": [{"
+      print "        \"severity\": \"" saved_severity "\","
+      print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
+      print "        \"components\": {"
+      print "          \"" component_key "\": {"
+      print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
+      print "            \"affected_version\": \"" saved_affected_ver "\","
+      print "            \"fixed_versions\": " fixed_versions
+      print "          }"
+      print "        }"
+      print "      }]"
+      print "    },"
+    }
+
+    in_vuln = 1
+
+    # Store new vulnerability
+    saved_cve = fields[1]
+    saved_severity = fields[2]
+    saved_direct = fields[3]
+
+    saved_affected = fields[5]
+    saved_affected_ver = fields[6]
+    saved_fixed_raw = fields[7]
+    saved_type = tolower(fields[8])
+  }
+  # Continuation line - append to previous field
+  else if (in_vuln && fields[1] == "" && fields[2] == "") {
+    if (fields[3] != "") {
+      saved_direct = saved_direct fields[3]
+    }
+    if (fields[5] != "") {
+      saved_affected = saved_affected fields[5]
+    }
+    if (fields[7] != "") {
+      saved_fixed_raw = saved_fixed_raw " " fields[7]
+    }
+  }
+}
+
+END {
+  if (in_vuln) {
+    # Output the last entry
+    fixed_versions = "[]"
+    if (saved_fixed_raw != "") {
+      gsub(/\] *\[/, "][", saved_fixed_raw)
+      gsub(/\[/, "\"", saved_fixed_raw)
+      gsub(/\]/, "\"", saved_fixed_raw)
+      gsub(/"  *"/, "\", \"", saved_fixed_raw)
+      gsub(/""/, "\", \"", saved_fixed_raw)
+      fixed_versions = "[" saved_fixed_raw "]"
+    }
+
+    component_key = saved_type "://" saved_affected
+    direct_component = saved_type "://" saved_direct
+
+    print "    {"
+    print "      \"vulnerabilities\": [{"
+    print "        \"severity\": \"" saved_severity "\","
+    print "        \"cves\": [{\"cve\": \"" saved_cve "\"}],"
+    print "        \"components\": {"
+    print "          \"" component_key "\": {"
+    print "            \"impact_paths\": [[null, {\"component_id\": \"" direct_component "\"}]],"
+    print "            \"affected_version\": \"" saved_affected_ver "\","
+    print "            \"fixed_versions\": " fixed_versions
+    print "          }"
+    print "        }"
+    print "      }]"
+    print "    }"
+  }
+  print "]"
+}
+' "$INPUT_TABLE" > "$INPUT_JSON"
+
+# Validate JSON
+if ! jq empty "$INPUT_JSON" 2>/dev/null; then
+  echo "❌ Failed to create valid JSON"
+  cat "$INPUT_JSON"
+  exit 1
+fi
+
+echo "✅ JSON created: $INPUT_JSON"
+
+# ------------------------------------------------
+# 2️⃣ Severity counts
+# ------------------------------------------------
+read CRITICAL HIGH MEDIUM LOW <<< $(
+jq -r '
+.[]
+| select(.vulnerabilities != null)
+| .vulnerabilities[]
+| .severity
+' "$INPUT_JSON" | awk '
+{ c[$1]++ }
+END {
+  print c["Critical"]+0, c["High"]+0, c["Medium"]+0, c["Low"]+0
+}'
+)
+
+echo "📊 Counts: Critical=$CRITICAL, High=$HIGH, Medium=$MEDIUM, Low=$LOW"
+
+TOTAL=$((CRITICAL + HIGH + MEDIUM + LOW))
+if [[ "$TOTAL" -eq 0 ]]; then
+  echo "✅ No vulnerabilities found, skipping Slack notification"
+  exit 0
+fi
+
+# ------------------------------------------------
+# 3️⃣ Parent Slack message
+# ------------------------------------------------
+PARENT_PAYLOAD=$(jq -cn \
+  --arg channel "$XRAY_SLACK_CHANNEL" \
+  --arg project "$BASENAME" \
+  --argjson critical "$CRITICAL" \
+  --argjson high "$HIGH" \
+  --argjson medium "$MEDIUM" \
+  '{
+    channel: $channel,
+    blocks: [
+      { type: "header", text: { type: "plain_text", text: "🚨 Dependency Vulnerability Report" } },
+      { type: "section", text: { type: "mrkdwn", text: ("*Project:* " + $project) } },
+      { type: "section", text: { type: "mrkdwn", text: ("🔴 *Critical:* \($critical)    🔥 *High:* \($high)    🎃 *Medium:* \($medium)") } },
+      { type: "context", elements: [{ type: "mrkdwn", text: "Detailed findings are posted in the thread below 👇" }] },
+      { type: "divider" }
+    ]
+  }')
+
+PARENT_RESPONSE=$(printf '%s' "$PARENT_PAYLOAD" | curl -s -X POST "$SLACK_API" \
+  -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
+  -H "Content-Type: application/json" \
+  --data @-)
+
+THREAD_TS=$(echo "$PARENT_RESPONSE" | jq -r '.ts')
+
+if [[ -z "$THREAD_TS" || "$THREAD_TS" == "null" ]]; then
+  echo "❌ Failed to create parent message"
+  echo "$PARENT_RESPONSE"
+  exit 1
+fi
+
+echo "✅ Parent message created. thread_ts=$THREAD_TS"
+
+# ------------------------------------------------
+# 4️⃣ Thread entries (sorted, CVE links)
+# ------------------------------------------------
+jq -r '
+def rank:
+  if . == "Critical" then 0
+  elif . == "High"   then 1
+  elif . == "Medium" then 2
+  elif . == "Low"    then 3
+  else 9 end;
+
+[
+  .[]
+  | select(.vulnerabilities != null)
+  | .vulnerabilities[]
+  | . as $v
+  | ($v.components | to_entries[]) as $comp
+  | ($v.cves // [{cve:"N/A"}])[]
+  | {
+      sev: $v.severity,
+      r: ($v.severity | rank),
+      text: "*<https://nvd.nist.gov/vuln/detail/\(.cve)|\(.cve)>*\n*Impacted:* `\(
+        $comp.key | sub("^[a-z]+://"; "")
+      )` v\(
+        $comp.value.affected_version // "N/A"
+      )\n*Fixed in:* \(
+        ($comp.value.fixed_versions // [])
+        | join(", ")
+        | if . == "" then "N/A" else . end
+      )\n*Direct dependencies:*\n• \(
+        $comp.value.impact_paths[0][1].component_id
+        | sub("^[a-z]+://"; "")
+      )"
+    }
+]
+| sort_by(.r)
+| .[]
+| [.sev, .text]
+| @tsv
+' "$INPUT_JSON" |
+while IFS=$'\t' read -r SEV TEXT; do
+
+  EMOJI="👻"
+  [[ "$SEV" == "Critical" ]] && EMOJI="🔴"
+  [[ "$SEV" == "High"     ]] && EMOJI="🔥"
+  [[ "$SEV" == "Medium"   ]] && EMOJI="🎃"
+
+  jq -cn \
+    --arg channel "$XRAY_SLACK_CHANNEL" \
+    --arg ts "$THREAD_TS" \
+    --arg body "$EMOJI *$SEV*\n$TEXT" \
+    '{
+      channel: $channel,
+      thread_ts: $ts,
+      blocks: [{ type: "section", text: { type: "mrkdwn", text: $body } }]
+    }' | curl -s -X POST "$SLACK_API" \
+      -H "Authorization: Bearer $XRAY_SLACK_TOKEN" \
+      -H "Content-Type: application/json" \
+      --data @- > /dev/null
+
+  sleep 0.1
+
+done
+
+echo "✅ All vulnerabilities posted to thread"

package/bitbucket-pipelines.yml

@@ -1,4 +1,6 @@
 # bitbucket-pipelines.yml
+export: true
+
 clone:
   depth: 2
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@docupace/pipeline",
-  "version": "1.0.118",
+  "version": "1.0.120",
   "description": "",
   "main": "index.js",
   "type": "module",

package/src/changeset/validate.js

@@ -23,7 +23,9 @@ export async function validateChangesets() {
   }
 
   if (destBranch.includes('release')) {
-    if (releases.some((item) => item.type !== 'patch')) {
+    if (
+      releases.some((item) => item.type !== 'patch' && item.type !== 'none')
+    ) {
       console.error(
         '❌ A changeset must be a patch for change to a release branch',
       );

package/src/jfrog/xray-scan.yaml

@@ -0,0 +1,29 @@
+definitions:
+  steps:
+    - step: &xray
+        name: JFrog Xray Dependency Scan (TABLE report only)
+        runs-on:
+          - self.hosted
+          - linux.shell
+          - onprem
+        script:
+          - curl -fL https://install-cli.jfrog.io | sh
+          - jf --version
+          - jf config add scan1 --url=$JFROG_XRAY_URL --user=$JFROG_XRAY_USER --access-token=$JFROG_XRAY_PASSWORD
+          - jf c show
+          - mkdir -p xray-report
+          - jf audit . --format=table >  xray-report/xray-audit.txt
+          - jf config remove scan1
+        artifacts:
+          - xray-report/xray-audit.txt
+    - step: &version-step
+        runs-on:
+          - self.hosted
+          - linux.shell
+          - onprem
+        name: Version, Tag
+        caches:
+          - gradle
+        script:
+          - npm config set //registry.npmjs.org/:_authToken $DOCUPACE_NPM_TOKEN
+          - eval $PIPELINE_CMD_VERSION_CHANGESET

package/src/next/config.js

@@ -53,7 +53,7 @@ export const appInfo = {
     deployAttributes: ['image.tag'],
   },
   'compliance-edge-graphql-server': {
-    repositoryName: 'compliance-edge-graphql-server',
+    repositoryName: 'docupace-graphql-server',
     imageName: 'compliance-edge-graphql-server',
     deployAttributes: [
       'image.tag',